The success and sustainability of any retail business depends on the establishment of long-term customer relationships.  Such relationships are built by providing positive customer experiences as well as earning and maintaining the customer’s trust.  The collection and utilization of information provided by consumers, and the manner in which the retailer treats such information within its possession play a key role in both aspects of such relationship building.

The collection of consumer data is therefore an essential part of any retail business.  It is necessary for the completion of sales transactions, deliveries, and returns, for the detection of fraud, and for the administration of consumer loyalty and discount pricing programs.  In each instance, data provided by the consumer allows for more efficient business operations and a more positive customer experience.

The protection of consumer-provided personal information is therefore a top priority for retailers.  A consumer’s perception of how a retailer handles their sensitive information will weigh heavily on their willingness to exchange their information for a received benefit in the future.  Recognizing this, retailers invest heavily in technology and the development of policies designed to ensure data protection in compliance with state and federal laws.  Those policies also further the effort to provide customer service at the highest level.  Simply stated, retailers utilize consumer data for the principal purpose of serving their customers as they wish to be served. 

Unfortunately, legislation currently pending before the Massachusetts Legislature to establish a regulatory framework for the collection and use of consumer data threatens to interfere with the ability of retailers to continue to serve their customers in this manner.

As currently drafted, H.4746 and S.2516, would place Massachusetts businesses at a competitive disadvantage and lead to unintended consequences for businesses and consumers alike.  By departing from the existing body of law adopted in 22 states throughout the country, these proposals would impose an undue burden and additional compliance costs on Massachusetts businesses only, interfere with their ability to market and provide services to Massachusetts consumers, and deny them access to certain services they currently rely upon to conduct business.  While RAM supports a comprehensive approach to consumer data protection, it is imperative that Massachusetts align with the national consensus framework to avoid such outcomes.

The general provisions of these bills will require retailers to invest significant resources to update policies, procedures, marketing and advertising plans, websites, record keeping systems, tracking and reporting mechanisms, and existing contractual arrangements.  This will include the hiring of highly technical employees and consultants with the advanced knowledge and training necessary to navigate the complex nature of these requirements, as well as the procurement of new technology.  Based on feedback from our members, the cost of compliance nationally would be in the billions of dollars.  Yet despite making such investments, even an inadvertent error made in good faith by a responsible retailer, could result in a costly legal claim for non-compliance—especially if the proposed legislation retains provisions authorizing enforcement through a private right of action. 

In addition to these direct compliance costs facing larger businesses subject to the requirements of the law, there will also be downstream impacts on small businesses that rely on data-driven tools for reaching new customers, marketing product, and conducting market analysis.  For example, 48% of Massachusetts small businesses use digital advertisements to communicate with existing customers and identify new customers online.  Likewise, data-based insights provided by digital partners help small businesses improve their marketing strategies.  Each of these tools are made possible through the aggregation of consumer data from various sources.  The overregulation of such data will dilute this aggregated information thereby making these tools less effective and more expensive.  It would also negatively impact the availability of these tools in Massachusetts.  Simply put, policymakers should not be making it harder for in-state businesses to communicate with Massachusetts consumers when compared to their out-of-state competitors.      

RAM is also concerned with the potential impact these proposals will have on the loyalty and discount pricing programs used across the retail industry, which are highly popular among consumers.  A study published by Forrester Research found that 72% of American adults online belong to at least one loyalty program, and that the average number of loyalty program memberships that each adult has is nine^[1].  These programs rely on the retailer’s ability to provide exclusive offers to voluntary participants versus non-participants.  Where non-participation is the result of a consumer’s exercise of rights afforded under a consumer data privacy law (opt-out or withholding consent), an inherent compliance conflict arises when non-discrimination provisions are also included.  To allow for the continued offer of these programs, the pending proposals must retain provisions making it clear that they should not be interpreted to prohibit, restrict or limit the operation of bona fide loyalty programs.

RAM, both independently and in conjunction with a larger coalition of business groups, has conducted extensive outreach and advocacy on Beacon Hill to seek a balanced and workable framework for the regulation of consumer data in Massachusetts.  In an effort to place Massachusetts businesses on a level playing field with their out of state competitors, and to ensure that Massachusetts consumers retain access to the same products, prices and offers available throughout the U.S., the Legislature should be pursuing uniformity with the existing consensus consumer privacy framework adopted in other states throughout the country.