Maine shakes up debate with tough internet privacy law

Maine shakes up debate with tough internet privacy law
© iStock, The Hill illustration

Maine is shaking up the national privacy debate with a new law, one that advocates say puts in place some of the toughest measures on internet service providers (ISPs) in the country.

The law, which bars those companies from using, selling or distributing customer data without consent, was signed by Maine Gov. Janet Mills (D) last week and goes into effect on July 1, 2020.

Another state privacy law, in California and slated to take effect in 2020, imposes tough privacy rules as well, but privacy experts say Maine’s law goes further.

ADVERTISEMENT

The California Consumer Privacy Act imposes regulations on a broad range of tech companies, including broadband providers and web companies such as Google and Facebook. But the California law allows customers to opt out of such data practices, while Maine forces companies to require customers to opt in before they even begin using that data.

Industry groups have already voiced their opposition to the Maine law and its tougher standard, fearing not only a patchwork of privacy laws that vary by state, but also that states are competing with each other to pass increasingly more stringent standards.

USTelecom, a coalition of broadband providers including Verizon and AT&T, opposed the Maine law as it went through state legislative committees, sending a letter in April detailing their concerns.

“Consumers expect consistent privacy protections online, regardless of where they are located or what services they use,” USTelecom wrote. “Data does not recognize state borders, and a fragmented, state-by-state approach sets uneven and inconsistent protections for consumers that are difficult, and sometimes impossible to implement.”

USTelecom also argued that the new law could violate ISPs’ First Amendment rights “relative to online actors that use and disclose the same information.”

The law could also face questions from federal regulators.

Under former President Obama, the Federal Communications Commission (FCC) approved regulations that imposed tough internet privacy rules. Those measures blocked ISPs from selling customers’ personal data to third parties. But President TrumpDonald John TrumpNew Bob Woodward book will include details of 25 personal letters between Trump and Kim Jong Un On The Money: Pelosi, Mnuchin talk but make no progress on ending stalemate | Trump grabs 'third rail' of politics with payroll tax pause | Trump uses racist tropes to pitch fair housing repeal to 'suburban housewife' Biden commemorates anniversary of Charlottesville 'Unite the Right' rally: 'We are in a battle for the soul of our nation' MORE signed legislation from the Republican Congress in 2017 repealing those regulations.

ADVERTISEMENT

A spokesperson for the FCC declined to comment when asked whether the FCC supported the new Maine law. A spokesperson for the Federal Trade Commission (FTC), which has a more important role in protecting consumer privacy, also declined to comment.

The law’s effects are likely to have implications far beyond Maine’s borders. The law could provide a template for other states looking to draft data privacy rules and in Washington, D.C., where Congress is grappling with its own efforts to draft the first federal privacy law.

Lawmakers in Washington, though, have struggled to get traction on a federal law.

The House Energy and Commerce Committee has been among the panels on Capitol Hill working on the issue of data privacy in recent months, holding two major hearings on the issue including one with all five commissioners from the Federal Trade Commission.

While a spokesperson for committee Chairman Frank Pallone Jr.Frank Joseph PallonePharma execs say FDA will not lower standards for coronavirus vaccine Dem chairmen urge CMS to prevent nursing homes from seizing stimulus payments Federal watchdog finds cybersecurity vulnerabilities in FCC systems MORE (D-N.J.) declined to comment on the new law, a spokesperson for ranking member Greg WaldenGregory (Greg) Paul WaldenHillicon Valley: Trump backs potential Microsoft, TikTok deal, sets September deadline | House Republicans request classified TikTok briefing | Facebook labels manipulated Pelosi video Top House Republicans request classified TikTok briefing Pelosi huddles with chairmen on surprise billing but deal elusive MORE (R-Ore.) told The Hill that the legislation could lead to a “confusing” situation around privacy.

“A patchwork of state laws is confusing – Congress needs to pass a federal privacy law that sets one national standard,” the spokesperson for Walden said.

The Senate Commerce Committee has also been focused on drafting a privacy bill over the past few months, also holding multiple hearings. Spokespersons for Senate Commerce Committee Chairman Roger WickerRoger Frederick WickerDavis: The Hall of Shame for GOP senators who remain silent on Donald Trump The Hill's Coronavirus Report: INOVIO R&D Chief Kate Broderick 'completely confident' world will develop a safe and effective COVID-19 vaccine; GOP boxed in on virus negotiations Hillicon Valley: Lawmakers zero in on Twitter after massive hack | US, UK, Canada allege Russian hackers targeted COVID-19 vaccine researchers | Top EU court rules data transfer deal with the US is illegal MORE (R-Miss.) and ranking member Maria CantwellMaria Elaine CantwellThe Hill's Coronavirus Report: Mike Roman says 3M on track to deliver 2 billion respirators globally and 1 billion in US by end of year; US, Pfizer agree to 100M doses of COVID-19 vaccine that will be free to Americans Overnight Energy: Supreme Court reinstates fast-track pipeline permit except for Keystone XL | Judge declines to reverse Dakota Access Pipeline shutdown OVERNIGHT ENERGY: Watchdog accuses Commerce of holding up 'Sharpiegate' report | Climate change erases millennia of cooling: study | Senate nixes proposal limiting Energy Department's control on nuclear agency budget MORE (D-Wash.) did not respond to request for comment.

The law will likely mean sweeping changes to how major internet service providers implement their data policies in Maine.

Currently, AT&T, Comcast and Verizon have privacy policies that allow for the use of customer data for purposes including delivering customized advertising, for billing services and for monitoring for illegal activity on accounts.

A spokesperson for Comcast told The Hill the company was not commenting on the new bill due to its “limited” presence in Maine.

But some ISPs in the state have already begun to implement policies that are more protective of customers’ privacy rights.

GWI pledged to customers in a recent blog post that “under no circumstances will we EVER sell your information.” Another company, Viasat, told The Hill that “it does not presently sell customer data, and has no plans to sell customer data in Maine or any other state.”

Mark Ouellette, president and CEO of Axiom, told The Hill the company “welcomes the new law” and that “we have never shared our data with any third-party and we have no plans to do so.”

The implementation of the Maine law will be closely watched, though, as the industry’s biggest players push back.

And one of the nation’s largest ISPs criticized the Maine law for not targeting other companies that also handle consumer data.

A spokesperson for Charter Communications, which provides internet services to 41 states, including Maine, under the Spectrum brand, told The Hill that “the legislation doesn’t go far enough to protect our customers in Maine because it exempts search engines, social media apps, websites and data brokers from having to protect the privacy of consumers’ online information.”