Gov. Charlie Baker gives the keynote speech at the 2018 Margaret C. Carlson Realtor Day on Beacon Hill.

Massachusetts residents will get new consumer protections against identity theft under a new law, An Act Relative to Consumer Protection from Security Breaches, HB 4806, just signed by Gov. Charlie Baker.

The new law enables consumers to safeguard their personal financial information by allowing them to “freeze” and “thaw” their credit files for free – preventing thieves from opening new credit accounts in their names, adding into to state statute a provision recently passed by Congress.

The law also requires that credit bureaus and other companies give consumers free credit monitoring services after a data breach, and improves consumer notifications among other protections.

Last month Marriott announced a security breach that put more than 500 million customers at risk of identity theft, and months before that Equifax, one of the three largest credit bureaus in the country, announced an especially dangerous breach.

“This is good news and offers consumers new tools to protect themselves from identity theft after a security breach like the recently announced ones at Equifax and Marriott,” said Deirdre Cummings, legislative director for MASSPIRG. “While a good first step, we still have some more work to do to hold companies accountable for failing to properly safeguard our personal information.”

MASSPIRG praised the leadership of Baker, Chairman of the Consumer Protection Committee Tacky Chan and the bill sponsors, former Sen. Barbara L’Italien and Rep. Jennifer Benson.

Key provisions in the Act Relative to Consumer Protection from Security Breaches include:

Free credit freeze: A new federal law established in September 2018 allows consumers to freeze and thaw their credit files at any time, for free. This law establishes this provision in state statue. Unlike credit monitoring (which alerts you after potential identity theft has already occurred), a credit freeze makes it harder for someone to open a new fraudulent account in your name. The three major credit bureaus had been charging Massachusetts consumers $5 per freeze/thaw transaction.

Free credit monitoring: If a security breach involving a Social Security number occurs at a consumer reporting agency – such as Equifax – the law requires credit reporting agencies to provide at least 3.5 years of free monitoring to affected consumers, for all other entities they must offer consumers at least 1.5 years of free monitoring. Credit monitoring services can help alert consumers to incidences of fraud allowing them to act quickly to minimize damage to their finances.

Prohibits binding arbitration clause in credit monitoring products: No one should have to give up their right to sue for redress just to receive credit monitoring after a breach.

Addition consumer information: The new law would better inform consumers about security breaches and their rights. Credit reporting agencies would not be able to sell consumers credit freeze services without first disclosing that consumers are entitled by law to a free freeze. The agencies also would have to tell consumers how to get those free freezes.