Maine's Governor Signs New Internet Privacy Law | Practical Law

Maine's Governor Signs New Internet Privacy Law | Practical Law

Maine's Governor has signed a new internet privacy law that requires ISPs to obtain express consent from customers to sell their personal information. The changes take effect on July 1, 2020.

Maine's Governor Signs New Internet Privacy Law

Practical Law Legal Update w-020-7201 (Approx. 3 pages)

Maine's Governor Signs New Internet Privacy Law

by Practical Law Data Privacy Advisor
Published on 10 Jun 2019 • Maine, USA (National/Federal)
Maine's Governor has signed a new internet privacy law that requires ISPs to obtain express consent from customers to sell their personal information. The changes take effect on July 1, 2020.
On June 6, 2019, Maine Governor Janet Mills signed LD 946 into law. The Act To Protect the Privacy of Online Customer Information (Internet Privacy Law) prohibits broadband internet service providers (ISPs) from using, selling, disclosing, or permitting access to a customer’s personal information without the customer's express, opt-in consent, unless an exception applies.
Under the Internet Privacy Law, customer personal information includes:
  • Personally identifying information, such as a customer's:
    • name;
    • Social Security number;
    • billing address; or
    • demographic data.
  • Information about service use, such as a customer's:
    • web browsing history;
    • geolocation information;
    • financial or health information or information about the customer's children;
    • communication contents; or
    • device identifier or internet protocol (IP) address.
The Internet Privacy Law also requires ISPs to:
  • Provide customers with a notice at the point of sale and on the ISP's website regarding the provider's obligations and customers' rights under the Internet Privacy Law.
  • Secure customer personal information by implementing reasonable security measures to protect it from unauthorized use, disclosure, or access.
  • Not treat customers differently based on whether they consent to the use, disclosure, sale, or access of their personal information, for example by:
    • refusing to serve a customer;
    • charging a penalty; or
    • offering a discount if the customer consents.
Providers operating within Maine that provide broadband internet access services to and bill customers physically located in the state should review their processes for:
  • Obtaining customer consent before using or selling their information.
  • Securing and otherwise handling customers' personal information.
The law will take effect on July 1, 2020.