The Governor of Maine, Janet Mills (‘the Governor’), announced, on 6 June 2019, that she had signed the bill for An Act To Protect the Privacy of Online Customer Information (‘the Bill’) into law, following its approval by the legislature. In particular, the Governor highlighted that the Bill prohibits internet service providers (‘ISPs’) from using, disclosing, selling or permitting access to consumer personal information unless the consumer has expressly given their consent.
Peter Guffin, Partner at Pierce Atwood LLP, told DataGuidance by OneTrust, “The Bill gives Maine consumers new data protection rights which did not exist before. [In particular,] the Bill, which comes into effect on 1 July 2020, provides consumers with protections similar to the federal privacy regulations that were repealed by the U.S. Congress in 2017. It applies to ISPs operating in Maine when providing broadband internet access services to consumers who are physically located and billed for services received in Maine.”
In addition, the Bill prohibits an ISP from refusing to serve consumers, charging them a penalty, or offering a discount if they do or do not consent to the use, disclosure, sale or access of their personal information. Moreover, the Bill requires ISPs to provide consumers with a clear, conspicuous and non-deceptive notice at the point of sale of consumer data, and on the ISP’s publicly accessible website, as well as outlines the ISP’s obligations and consumers’ rights.
The Bill reflects a growing trend among state legislatures across the US to enact laws to protect the privacy rights of consumers in today’s digital world
Guffin outlined, “In addition to personally identifiable information, customer personal information includes their use of broadband internet access service, such as web browsing history, application usage history, precise geolocation information, device identifiers and the origin and destination of internet protocol addresses. […] [Moreover,] there is no provision in the Bill for aggrieved consumers to bring a private cause of action in the event an ISP failing to comply with the law. Additionally, the Bill is silent as to who will enforce the law on behalf of Maine consumers, or what penalties will apply for non-compliance.”
Furthermore, the Bill outlines that, in addition to providing for the increased protection of consumers’ rights, ISPs may collect, retain, use, disclose, sell and permit access to consumer personal information without their approval where, among other things, compliance with a court order is required, or to protect consumers from fraudulent, abusive or unlawful use of, or subscription to, ISP services.
Guffin concluded, “I believe that the Bill may lead to the enactment, by the Maine State Legislature, of a more comprehensive data protection law during the next legislative session. Like the newly enacted California Consumer Privacy Act of 2018, which also comes into effect in 2020, the Bill reflects a growing trend among state legislatures across the US to enact laws to protect the privacy rights of consumers in today’s digital world, given the absence of a comprehensive federal data protection law.”
ALEXANDER FETANI Junior Privacy Analyst