Maine recently enacted a new privacy law (“An Act To Protect the Privacy of Online Customer Information”) that prohibits internet service providers (ISPs) from using, disclosing, selling, or permitting access to personal information generated from a customer’s use of that internet service. [§ 35-A M.R.S. c. 94].
Like most privacy laws, this law does certain things well, but falls short in other areas. This article highlights a few such areas.
- The Affirmative Consent Requirement
The new law requires Maine residents to provide express, affirmative consent to an ISP that they permit an ISP to use, disclose, sell, or access their personal information for purposes other than providing internet service. Because the default option prohibits use, disclosure, sale, or access, Maine’s law protects its residents from unknowingly allowing the disclosure of their personal information. [35-A M.R.S. c. 94, §9301 3A].
- Customers Are Not Penalized for Protecting Their Privacy
The new prohibits an ISP from penalizing consumers for exercising their privacy rights. An ISP cannot deny service to a customer or charged that customer a higher price for service if that customer does not provide express, affirmative consent. [35-A M.R.S. c. 94, §9301 3B].
- No “Sale” Loophole
The limits that the new law imposes on the ISP extend beyond the mere sale of personal information. Under the new law, an ISP may not “use, disclose, sell or permit access to customer personal information…” [35-A M.R.S. c. 94, §9301 3A]. This language prohibits an ISP from circumventing the new law by disclosing personal information without actually selling that information.
- Broad Definition of Personal Information
The new law defines personal information broadly. [35-A M.R.S. c. 94, §9301 1C]. It stretches beyond a customer’s name, billing information, billing address, and social security number and extends to the customer’s web browsing history and the content of the customer’s communications.
- The Scope of the New Law
While Maine is taking affirmative steps to protect the privacy rights of its citizens, the new privacy law is limited in scope to internet services providers. Other companies, such as social media companies that collect personal information are outside the scope of this law.
The new law is silent on enforcement. It is therefore unclear whether Maine residents can enforce their rights under the law, and what penalties, if any, ISPs could face.