SECTION 1. Section 1 of chapter 93H of the General Laws, as appearing in the 2014 Official Edition, is hereby amended by adding the following definitions:-

“Internet of Things (IOT)”, a internetworking system of physical devices embedded with electronics, software, sensors, unique identifiers, and network connectivity that are able to collect and transfer personal information over a network without requiring human-to-human or human-to-computer interaction.

“IOT Personal Data”, information collected by an IOT device relating to an individual or individuals who can be identified, directly or indirectly, by reference to the IOT device’s unique identifier and to one or more factors specific to that individual’s physical, physiological, mental, economic, cultural or social identity.

SECTION 2. Section 2 of chapter 93H of the general laws, as so appearing, is hereby amended by striking out subsection (a) and inserting in place thereof the following subsection:-

“(a) The department of consumer affairs and business regulation shall adopt regulations relative to any person that owns or licenses personal information about a resident of the commonwealth, any person that manufactures any IOT device that collects personal information or IOT personal data about a resident of the commonwealth, and any person that manufactures any autonomous vehicle that uses or incorporates an IOT device in the vehicle that collects personal information or IOT personal data about a resident of the commonwealth. Such regulations shall be designed to safeguard the personal information and IOT personal data of residents of the commonwealth and shall be consistent with the safeguards for protection set forth in the federal regulations by which the person is regulated. The objectives of the regulations shall be to: insure the security and confidentiality of customer information in a manner fully consistent with industry standards; protect against anticipated threats or hazards to the security or integrity of such information; and protect against unauthorized access to or use of such information that may result in substantial harm or inconvenience to any consumer. The regulations shall take into account the person's size, scope and type of business, the amount of resources available to such person, the amount of stored data, and the need for security and confidentiality of both consumer and employee information.”