The Maine legislature has passed a bill that requires internet service providers (ISPs) operating in Maine to obtain express, affirmative consent from customers before using, disclosing, selling or permitting access to a customer’s personal information, which would include web-browsing history, application-usage history, geolocation information, financial information and health information. With certain exceptions, the bill would prohibit a provider from “refusing to serve a customer, charging a customer a penalty or offering a customer a discount if the customer does or does not consent to the use, disclosure, sale or access.” If signed by Governor Janet Mills, the law would take effect July 1, 2020.

TAKEAWAY

Prescriptive requirements requiring opt-in consent are onerous and even more stringent than the opt-out requirements of the California Consumer Privacy Act (CCPA). Companies need to pay close attention to updates like this to properly implement policies and procedures to remain in compliance with state and federal laws.

Read more in the full June issue of the Privacy and Data Security Client Alert.