Maine has scored a court victory, and cable providers a defeat, over the state's law preventing ISPs from "using, disclosing, selling or permitting access to" a customer's personal information without express consent, and restricts the use of non-personal information if a customer opts out.
Related: ISPs Take Aim at Maine Law
A Maine judge denied ISPs' motion that the court rule the state statute preempted by federal action and unconstitutional to boot, and instead granted the state's cross motion that the statute was not preempted.
The ISP challenge will now have to go to trial.
The Maine statute also holds that an ISP can't refuse to serve a customer or charge a penalty for not allowing use of their information, or offer a discount to induce them to give up information.
ACA Connects, NCTA-The Internet & Television Association, CTIA, the wireless association; and USTelecom, together representing the vast majority of all wired and wireless ISPs, challenged the law in a Maine U.S. District Court and sought an immediate judgement based on the pleadings.
The bill requires opt-in permission for what ISPs say is not sensitive personal information, an opt-out option for collection of data that is not personal at all, and preventing them from offering consumer-benefiting discounts or rewards. The ISPs argue that such limitations are impermissible restrictions on how they communicate with their customers that are not “remotely tailored” to protecting consumer privacy and are thus unconstitutional restrictions on speech.
ISPs argued that the state law was preempted by the congressional resolution invalidating privacy regulations adopted by the FCC under Democratic chair Tom Wheeler (so-called conflict preemption). They also said the law conflicted with the FCC's Restoring Internet Freedom Order because the FCC said the way to enforce privacy is a combination of ISP disclosures and Federal Trade Commission enforcement of those disclosures while the state was adopting prescriptive rules.
Maine Attorney General Aaron Frey, the defendant in the suit, countered that the state law "regulates a space Congress explicitly left open, and any conflict is a figment of Plaintiffs’ imaginative pleading."
ISPs also argued that it was unconstitutionally vague due to lack of clarity about its geographic scope, so unclear as to whom the law would apply. For example, out of state residents using their mobile phones in the state. They also said it was void for vagueness due to the "nebulousness" of the definition of personal information.
Judge Lance Walker said that since Congress' resolution was simply the nullification of the FCC's ISP privacy order, it created "no overarching federal policy, and enacts no scheme with which the Maine Privacy Statute can conflict."
As to the unconstitutionally vague personal information definition. "Plaintiffs’ Motion simply fails to clarify how an ill-defined opt-in and opt-out regime would inhibit any protected First Amendment activity," said Walker, "for example, how it might chill them from preparing particular marketing materials for sale to customers. And, they have not begun to bear their burden to show the statute would be unconstitutional in “all of its applications,” as they must for a facial challenge ...Because Plaintiffs’ members are businesses accustomed to regulation, and the Privacy Statute does not appear to carry any criminal penalty, the vagueness review is less searching in this case," said Walker.
As to the issue of geography, the judge said that as he saw it, the law "applies to a clearly-defined set of businesses when providing services to a clearly-defined set of customers; the law regulates ISPs operating in Maine serving customers that are physically located in Maine, and physically billed for those services in Maine."
ISPs will still have a chance to make the rest of their case at trial.
“While we disagree with the court's initial decision, the glaring deficiencies with the Maine privacy statute remain," said NCTA in a statement. "Consumers expect – and deserve – the same meaningful privacy protections across the internet. Broadband providers are united in support of a comprehensive national privacy framework that puts consumers first and applies to all companies, including all those operating online, in a uniform and technology-neutral manner.”
