Today:  States Consider Internet Privacy Rules/Legislation 

States Consider Internet Privacy Rules/Legislation

In light the signing of the Congressional Review Act resolution disapproving the FCC’s broadband privacy regulations  See the Regulatory Mix dated 4/4/17,  many states are considering legislation to address internet privacy rules.  Some of them are listed below.

The Alaska Legislature is considering two bills, HB 230 and HB 232, that would bar telecommunications service and internet service providers from collecting personal information from customers without their express written approval.  It also prevents telecommunications service and internet service providers from refusing service to those who don't opt in to the data collection.

In Kansas HB 2423 would prohibit providers of information services from collecting, storing, or selling the personal information of a Kansas resident who uses the services without the express written authorization of the person affected.  The bill would also prohibit any provider of such services from refusing to provide services to a Kansas resident based on the resident’s refusal to approve collection, storage, or sale of the person’s information.

Maryland’s proposed SB 1200, Internet Consumer Privacy Rights Act of 2017, would prohibit an Internet service provider from selling or transferring a consumer’s personally identifying information to a person without the consumer’s express and affirmative permission.  It would also ban an ISP from sending to a consumer an advertisement that has been selected because of the consumer’s browsing history without the consumer’s express and affirmative permission.  An ISP may not refuse to provide its services to a consumer because of the consumer’s refusal to provide the express and affirmative permission as specified under the bill.

The Massachusetts Legislature is considering two bills, S.2062 and S.2053 which would prohibit an internet service provider from collecting, using, disclosing, or otherwise disseminating personal information from a customer resulting from the customer’s use of the telecommunications or internet service provider without express written approval from the customer.  It would also prevent internet service providers from imposing a surcharge or refusing service if a customer opts out.

Minnesota’s proposed SF 1937 would prohibit telecommunications or internet service providers from collecting personal information from a customer without express written approval from the customer.  No telecommunication or internet service provider could refuse to provide its services to a customer on the grounds that the customer has not approved collection of the customer's personal information.  HF 2642 would require telecommunications and Internet service providers to reimburse consumers for distributing consumer information obtained from the Internet.  The Public Utilities Commission would establish the level of reimbursement. 

The New York State Assembly has before it several bills concerning consumer privacy.  Among them are S05576/A07236 which would require internet service providers to provide customers with a copy of their privacy policy and to obtain written and explicit permission from a customer prior to sharing customer information and S05603/A07191 which would prohibit the disclosure of personally identifiable information by an internet service provider without the express written approval of the customer.

In Rhode Island proposed H 6087 would protect individuals from Internet disclosure of personally identifiable information by commercial websites/online service operators and creates right of action for violations.

In the Vermont General Assembly an act relating to privacy and data security rules applicable to telecommunications service providers, including internet service providers has been introduced.  H.535/S.147 would adopt privacy and data security rules modeled after the FCC privacy rules at 47 C.F.R. part 64, subpart U.

In addition, proposed Washington Senate Bill 5919/HB2200 would prohibit certain telecommunications or internet service providers from: (1) Collecting personal information from a customer resulting from the customer's use of the telecommunications or internet service provider without express written approval from the customer; and (2) Refusing to provide its services to a customer on the grounds that the customer has not approved collection of his or her personal information.  See the Regulatory Mix dated 5/8/17 for details regarding the City of Seattle rule requiring cable operators to obtain opt-in consent before sharing a customer’s web browsing history.

____________________________________________________________________

The Regulatory Mix, TMI’s daily blog of telecom related regulatory activities, is a snapshot of PUC, FCC, legislative, and occasionally court issues that our regulatory monitoring team uncovers each day. Depending on their significance, some items may be the subject of a TMI Briefing.