Federal privacy votes fuel legislative efforts in a growing list of states

8 May 2017 11:23am

2 May 2017. By Mike Swift.

Fueled by perceived public displeasure about the rollback of privacy rules for Internet service providers by Congress, at least 16 states are considering legislation that would restrict the sharing of consumers' personal information by ISPs, or impose new transparency rules for online services that use it.

While the vote to block the Federal Communications Commission from imposing privacy and data security rules on ISPs was supported by Republicans in Congress and President Trump, some of the states considering new privacy measures — including Alaska, Montana and South Carolina — have Republican-dominated legislatures.

And in Illinois, where two significant privacy bills are making progress toward becoming law, backers say the rollback of the FCC rules has significantly improved the political climate for their efforts.

"It's incumbent on states now to take the lead on these issues. That's what we're trying to do in Illinois," said state Representative Arthur Turner, a Chicago Democrat who is sponsoring an Internet transparency bill that may come to a vote soon in the Illinois House. "It was fortunate that [the vote on the FCC privacy rules] happened during our process, but I think it's just a sign of the times that people are interested in privacy. They want to make sure they are protected."

A handful of states, including Minnesota and New York, reacted almost immediately to the FCC rules rollback, as lawmakers or state attorneys general announced they would propose ISP privacy legislation to replace the renounced federal rules. But over the past month, the list of states considering ISP privacy bills and other privacy legislation has expanded.

And in states like Illinois where privacy legislation was introduced before the votes in Congress in late March on the FCC rules, backers of privacy laws have found increased support in the wake of the votes in Washington.

"When we started this, we really didn't think [the privacy bills] would get out of committee," said James T. Donovan, special assistant and counsel to Cook County Sheriff Thomas J. Dart, one prominent backer of transparency and geolocation privacy bills in the Illinois General Assembly. "We went into it knowing it was a longshot, but we were going to fight for it."

The Illinois House of Representatives voted 69-42 on April 27 to pass the "Geolocation Privacy Protection Act," which prohibits any private entity from collecting, storing or sharing a person's location data without affirmative express consent. Action in the Senate is pending.

Turner hopes to get a vote on the floor of the House for his transparency bill sometime during the week of May 9, when lawmakers return from a recess. The Illinois "Right to Know Act" would not limit any privacy practices by websites or online services. But it would require entities to disclose to consumers when they share personal data with a third party, such as data brokers who compile detailed digital dossiers on millions of Americans.

The bill defines personal information broadly, including not just standard identifiers such as names, e-mail addresses and Social Security numbers, but also sexual orientation and gender status, age, race or ethnicity, religious affiliation or activity, financial data and medical information. A Senate version of the bill could come to a vote as soon as Wednesday.

Illinois law has had a national impact on privacy litigation already, with the state's Biometric Information Privacy Act being used in private class action litigation against Facebook, Google and others in federal courts in California and other states over the use of facial recognition technology.

But in the process of moving the "Right to Know Act" out of committee, Turner and other backers accepted a key compromise: They removed a private right of action from the bill, amid concerns from Republicans that the bill could harm Illinois-based tech companies. Instead, the sole enforcement authority would be with the Illinois attorney general.

"There was some concern from other members about the private right of action actually being used as gotcha language for law firms or people who want to do civil cases against big companies. That wasn't what this bill was about, so I was comfortable with removing it," Turner said. Exemptions were also added for public utilities and non-profit entities.

So far, only two states, Nevada and Minnesota, have existing privacy limits that prohibit ISPs from sharing private information such as a customer's online browsing history, according to the National Conference of State Legislatures. In Minnesota, ISPs can't share that information without consumer consent.

As of Tuesday, the states besides Illinois that are expected to consider online privacy legislation this year include Alaska, Hawaii, Maryland, Massachusetts, Minnesota, Montana, North Dakota, South Carolina, New York, Washington, Wisconsin, Vermont, Rhode Island, Connecticut and Kansas, according to research by NCSL and MLex.


Several of those states are considering multiple privacy bills, with many considering ISP privacy limits to replace the FCC rules. Minnesota and New York are considering as many as six privacy bills each, according to NCLS.

In some of those states, lawmakers have made public statements that they will introduce bills, but have yet to do so. In Connecticut, for example, Senate Majority Leader Bob Duff plans to introduce a set of ISP privacy rules as an amendment to another bill sometime before the end of the legislative session in early June, Adam Joseph, Duff's press secretary, said Tuesday.

It is still too soon to predict if any legislatures will actually pass bills and have them signed into law by state governors.

In Illinois, lawmakers have long braced for a veto from the state's Republican governor, Bruce Rauner, even if they get privacy bills though the House and Senate. But Turner hopes his compromises on a private right of action will attract some Republican votes. He also hopes that polls showing the unpopularity of the privacy vote in Washington will carry weight with the governor.

"I'm hoping the governor will see the light and think about his opposition to privacy rights, versus the public opinion about privacy," Turner said.

CCPA Report