Feels like the word 'sale' may actually turn into a loophole. It should have probably been worded to use 'exchange' or 'transfer' instead. But this is progress.
Yeah, we need data minimization. As long as it's collected it is a liability for consumers, turn it into a liability for businesses to incentive them to collect as little as possible.
SECTION 1. The General Laws are hereby amended by inserting after chapter 93L the following chapter:-
Chapter 93M. Massachusetts Data Privacy Act
Section 1. As used in this chapter, the following words shall have the following meanings unless the context otherwise requires:
...
“Sale of personal data”, the transfer of personal data in exchange for monetary or other valuable consideration by the controller to a third party; provided, however, that “sale of personal data” shall not include: (i) the disclosure of personal data to a processor that processes the personal data on behalf of the controller if limited to the purposes of the processing; (ii) the disclosure of personal data to a third party for purposes of providing a product or service affirmatively requested by the consumer; (iii) the disclosure or transfer of personal data to an affiliate of the controller; (iv) the disclosure of personal data with the consumer’s affirmative consent, where the consumer affirmatively directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party; (v) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction or a proposed merger, acquisition, bankruptcy or other transaction, in which the third party assumes control of all or part of the controller’s assets; or (vi) the disclosure of personal data that the consumer: (A) intentionally made available to the general public via a channel of mass media; and (B) did not restrict to a specific audience.