Maine shakes up debate with tough internet privacy law

Maine is shaking up the national privacy debate with a new law, one that advocates say puts in place some of the toughest measures on internet service providers (ISPs) in the country.

The law, which bars those companies from using, selling or distributing customer data without consent, was signed by Maine Gov. Janet Mills (D) last week and goes into effect on July 1, 2020.

Another state privacy law, in California and slated to take effect in 2020, imposes tough privacy rules as well, but privacy experts say Maine’s law goes further.

{mosads}

The California Consumer Privacy Act imposes regulations on a broad range of tech companies, including broadband providers and web companies such as Google and Facebook. But the California law allows customers to opt out of such data practices, while Maine forces companies to require customers to opt in before they even begin using that data.

Industry groups have already voiced their opposition to the Maine law and its tougher standard, fearing not only a patchwork of privacy laws that vary by state, but also that states are competing with each other to pass increasingly more stringent standards.

USTelecom, a coalition of broadband providers including Verizon and AT&T, opposed the Maine law as it went through state legislative committees, sending a letter in April detailing their concerns.

“Consumers expect consistent privacy protections online, regardless of where they are located or what services they use,” USTelecom wrote. “Data does not recognize state borders, and a fragmented, state-by-state approach sets uneven and inconsistent protections for consumers that are difficult, and sometimes impossible to implement.”

USTelecom also argued that the new law could violate ISPs’ First Amendment rights “relative to online actors that use and disclose the same information.”

The law could also face questions from federal regulators.

Under former President Obama, the Federal Communications Commission (FCC) approved regulations that imposed tough internet privacy rules. Those measures blocked ISPs from selling customers’ personal data to third parties. But President Trump signed legislation from the Republican Congress in 2017 repealing those regulations.

{mossecondads}

A spokesperson for the FCC declined to comment when asked whether the FCC supported the new Maine law. A spokesperson for the Federal Trade Commission (FTC), which has a more important role in protecting consumer privacy, also declined to comment.

The law’s effects are likely to have implications far beyond Maine’s borders. The law could provide a template for other states looking to draft data privacy rules and in Washington, D.C., where Congress is grappling with its own efforts to draft the first federal privacy law.

Lawmakers in Washington, though, have struggled to get traction on a federal law.

The House Energy and Commerce Committee has been among the panels on Capitol Hill working on the issue of data privacy in recent months, holding two major hearings on the issue including one with all five commissioners from the Federal Trade Commission.

While a spokesperson for committee Chairman Frank Pallone Jr. (D-N.J.) declined to comment on the new law, a spokesperson for ranking member Greg Walden (R-Ore.) told The Hill that the legislation could lead to a “confusing” situation around privacy.

“A patchwork of state laws is confusing – Congress needs to pass a federal privacy law that sets one national standard,” the spokesperson for Walden said.

The Senate Commerce Committee has also been focused on drafting a privacy bill over the past few months, also holding multiple hearings. Spokespersons for Senate Commerce Committee Chairman Roger Wicker (R-Miss.) and ranking member Maria Cantwell (D-Wash.) did not respond to request for comment.

The law will likely mean sweeping changes to how major internet service providers implement their data policies in Maine.

Currently, AT&T, Comcast and Verizon have privacy policies that allow for the use of customer data for purposes including delivering customized advertising, for billing services and for monitoring for illegal activity on accounts.

A spokesperson for Comcast told The Hill the company was not commenting on the new bill due to its “limited” presence in Maine.

But some ISPs in the state have already begun to implement policies that are more protective of customers’ privacy rights.

GWI pledged to customers in a recent blog post that “under no circumstances will we EVER sell your information.” Another company, Viasat, told The Hill that “it does not presently sell customer data, and has no plans to sell customer data in Maine or any other state.”

Mark Ouellette, president and CEO of Axiom, told The Hill the company “welcomes the new law” and that “we have never shared our data with any third-party and we have no plans to do so.”

The implementation of the Maine law will be closely watched, though, as the industry’s biggest players push back.

And one of the nation’s largest ISPs criticized the Maine law for not targeting other companies that also handle consumer data.

A spokesperson for Charter Communications, which provides internet services to 41 states, including Maine, under the Spectrum brand, told The Hill that “the legislation doesn’t go far enough to protect our customers in Maine because it exempts search engines, social media apps, websites and data brokers from having to protect the privacy of consumers’ online information.”