Maine Adopts ISP Privacy Law

Maine Governor Janet Mills signed into law privacy bill SP275 / LD946 in the first week of June to regulate data privacy practices at internet service providers (ISPs) operating in Maine. The new privacy law will take effect on July 1, 2020.

Known as An Act to Protect the Privacy of Online Customer Information, it will be codified at 35-A M.R.S. c. 94. The law follows an effort last year to pass a similar ISP privacy bill in Maine that was unsuccessful.

The new law applies to providers of broadband Internet access service and protects the personal information of their current or former customers, including personally identifying information and information about their service including their web browsing history, application usage history, precise geolocation information, financial information, health information, information pertaining to the customer’s children, device identifiers, content of the customer’s communications, and the origin/destination IP addresses.

It has three essential compliance requirements:

Customer Personal Information – A provider may not use, disclose, sell or permit access to customer personal information except as governed by an exception provided in the law. Exceptions include express affirmative customer consent, marketing/advertising, compliance with a lawful court order, billing/payment, fraud protection, and the provision of geolocation information in certain circumstances.

Security – The law requires providers to implement reasonable measures to protect customer personal information from unauthorized use, disclosure or access. The nature and scope of the activities, the sensitivity of the data collection, the size of the provider and the technical feasibility of the security measures may be taken into account.

Disclosures – The law requires providers to offer a clear, conspicuous and nondeceptive notice on their website and at the point of sale concerning the provider’s obligations and the consumer’s rights under the law.

There have already been discussions in the media about whether the Maine privacy law will be susceptible to legal challenges. The Maine Attorney General provided written comments as part of the legislative process indicating that the AG believed it was legally defensible and would strongly defend it on behalf of consumers.

The new Maine law follows efforts by California and Nevada to strengthen their data privacy practices. The Nevada law (SB 220) will go into effect on October 1, 2019 and the California Consumer Privacy Act goes into effect on January 1, 2020. Maine, which is limited only to internet service providers, follows six months later.