Governor Mills signed, “An Act To Protect the Privacy of Online Customer Information,” (LD- 946) which requires Internet service providers (ISPs) to obtain opt-in consent prior to, “using, disclosing, selling or permitting access to [a consumer’s] prohibited personal information.” LD- 946, goes into effect July 2020.
An Act To Protect the Privacy of Online Customer Information (LD- 946)
“Internet service providers should not be able to sell or share everything that they know about you — including your most private and sensitive personal information — without your consent,” said Sen. Shenna Bellows, D-Manchester. Accordingly, Maine has passed LD- 946, which requires ISPs to obtain the consent of a consumer before selling, sharing or giving away that consumer’s sensitive personal data or information.
LD-946 defines “personal information” to include both personally identifying information (such as billing information and social security number) as well as information from a customer’s use of broadband Internet services including:
- The customer’s web browsing history;
- The customer’s application usage history;
- The customer’s device identifier, such as a media access control address, international mobile equipment identity or Internet protocol address;
- The content of the customer’s communications; and
- The origin and destination Internet protocol addresses.
LD-946 also states that an ISP may not:
- Refuse to serve a customer who does not provide consent under paragraph or
- Charge a customer a penalty or offer a customer a discount based on the customer’s decision to provide or not provide consent.
The law also requires the provider to:
- Take reasonable measures to protect personal information from unauthorized use, disclosure or access; and
- Provide customers a “clear, conspicuous and nondeceptive” notice at the point of sale and on the provider’s publicly accessible website of the provider’s obligations and a customer’s rights.
However, there are exceptions that allow for the sharing of personal information including:
- To provide the service from which such information is derived;
- To advertise the provider’s communications-related services to the customer;
- To comply with a lawful court order;
- To initiate, render, bill for and collect payment for broadband Internet access service;
- To protect users from fraudulent, abusive or unlawful use of or subscription to such services; and
- Certain geolocation services.
The law only applies to broadband providers operating within Maine when providing services to individuals physically located in Maine and becomes effective on July 1, 2020.