Enforcement of Maine's strict online privacy law begins without clear strategy - Press Herald

ersamoyor.blogspot.com

Enforcement of Maine’s landmark online privacy law, which bans internet service providers from collecting and selling customers’ personal data without their permission, began this month after clearing a major legal hurdle in July.

Still, state officials could not provide a clear picture of what would happen to providers in Maine if they don’t comply.

The law dictates that internet providers must gather express, affirmative consent from customers before collecting any of their identifying data, such as location, browsing history or device identification. Providers also must give customers “clear, conspicuous and non-deceptive notice” of their rights at the point of sale, and are not allowed to offer promotions to customers who choose to give consent or refuse service to those who do not.

Customers can expect to see posted notices of their rights on their internet provider’s website, and new customers will be asked for consent if their provider wants to collect their data. It remains unclear whether providers must actively provide existing customers with notice of their newly gained privacy rights.

The law, which was modeled after an Obama-era Federal Communications Commission rule that was repealed in 2017, is one of the strictest in the country and the first of its kind to explicitly require providers to get customers’ permission before collecting and selling their data.

The law was signed in June 2019 and went into effect July 1. Maine Attorney General Aaron Frey agreed to postpone enforcement because of the coronavirus pandemic and a pending lawsuit over the law brought by four internet industry groups. However, most of the plaintiffs’ arguments were rejected by a federal judge on July 7, including their claim that the privacy law violates internet companies’ First Amendment rights.

“I think it does fundamentally change how (internet service providers) are dealing with consumer data,” Ariel Pardee, an attorney who works in the privacy and data security practice group at New England-based law firm Pierce Atwood, said about Maine’s law. “We haven’t had an opt-in law.”

Though enforcement of the law began August 1, it remains unclear exactly how providers will be held accountable.

Pardee said the law is unusual in that there it includes no enforcement provision, and that without such a provision, the responsibility for enforcement has fallen to Frey and the state Office of the Attorney General.

Frey, whose office supported the legislation, said he intends to rely partially on the good faith of internet companies to enforce the law.

“We have an open dialogue with attorneys for the (providers), and they don’t want their client to be in trouble, so you can use that relationship and make sure there’s no problems, and (we can) look to see whether or not the notice requirements are being complied with,” Frey said.

He noted that he’s spoken with representatives from many of the companies, and they’ve told him that they don’t collect and sell consumer data.

“It’s my hope that they were being forthright with me that they’re not using consumer data in this way now,” Frey said. “So it should be pretty easy for them to comply with if they were representing (themselves) accurately.”

However, given the lawsuit, it’s clear that not all internet providers support the law.

Fletcher Kittredge is the CEO of GWI, a small provider based in Biddeford. Kittredge said he lobbied for passage of the bill because he supports online privacy and his company doesn’t collect or sell personal data for advertising purposes. He said most Maine-based internet providers were in favor of the bill because their business is providing internet service, not advertising.

“If you look at the the list of the people who have sued to block the implementation, it’s the big, national companies,” Kittredge said. “I don’t think any local companies joined that. There’s pretty much a breakdown: The Maine companies think the Maine law is great, the national companies don’t.”

Frey said he also intends to rely on consumer awareness to enforce the law – should consumers suspect that their personal data has been collected or sold without their consent, they should contact the attorney general’s office.

That could be difficult, according to Pardee, an expert in the legal realm of internet privacy.

Barring technological advancements that make the monitoring of data collection accessible to the everyday consumer, Pardee said, whistle-blowers would be the most likely way that noncompliance would come to light, not consumer complaints.

“That’s often how these sorts of things get brought to our attention as consumers – somebody inside the company finds out and blows the whistle,” Pardee said. “As for the everyday consumer, I just don’t see how they would know.”

Frey also pointed out the while the new law regulates providers, the state government has little power to regulate which data websites or other internet companies – such as Google or Facebook – can and cannot collect.

Though states have some agency to fill the hole left by the repealed federal regulations, Frey said the federal government must act more broadly.

“When an individual chooses to go (to a website) and that information is collected … that’s something that the federal government is in the best position (to regulate),” Frey said.

California’s Consumer Privacy Act is similar to Maine’s in that it mandates a level of transparency from websites. But even then, the law empowers consumers to learn what data is being collected, request that it be deleted, and opt out of collection, and does not employ an opt-in model such as the law in Maine.

Invalid username/password.

Please check your email to confirm and complete your registration.

Use the form below to reset your password. When you've submitted your account email, we will send an email with a reset code.

« Previous

How Susan Collins was lobbied to write the PPP exception that benefited hotel chains

Canada outpaces U.S., recouping 55% of jobs lost to pandemic

filed under: