AUGUSTA — A Saco lawmaker’s efforts to protect Mainers’ digital privacy drew opposition Monday from technology companies and business leaders concerned about making the state an outlier and driving business away.
Business and technology groups are opposing a series of bills sponsored by Rep. Maggie O’Neil, D-Saco, that would make it harder for companies to collect, use and sell personal information, ranging from health information voluntarily entered into phone apps and web searches to biometric data, which includes unique personal information such as face scans, fingerprints or voiceprints.
Instead, opponents want to work on digital privacy concerns through a more comprehensive bill sponsored by Assistant Senate Minority Leader Lisa Keim, R-Dixfield. Keim, meanwhile, asked members of the Legislature’s Judiciary Committee to delay action on her bill and form a stakeholder group to work on the issue through the summer.
O’Neil said additional digital privacy rights are needed because of the evolution of technology, including artificial intelligence and facial recognition programs.
O’Neil is concerned about privacy related to health care, especially after the U.S. Supreme Court overturned Roe v. Wade last year and opened the door to new abortion restrictions in Republican-controlled states. She’s worried about the chilling effect that increased online surveillance will have on people seeking health care, especially as some states outlaw abortion or gender-affirming care and seek to punish people seeking out-of-state services and providers.
“Until we enact this law, few protections exist to prevent companies from collecting, retaining or disclosing this personal information to third parties,” O’Neil said. “We’re trying to prevent harm before it happens. There are costs associated with having your data exposed, and they range from monetary costs to fear of exposure to criminal prosecution.”
O’Neil’s bills would require that companies get consent from users before collecting and storing certain kinds of data. One bill, L.D. 1705, focuses on biometric data, while another, L.D. 1902, focuses on health information not protected under federal privacy laws. Both would give users the right to sue any company that violates the law.
The biometric data bill builds off a law passed by the previous Legislature that prohibits municipalities from using facial recognition technology, which misidentifies people of color and women at higher rates than white men, leading to false accusations.
Lawmakers considered a similar bill last session, but it died between chambers. To address concerns raised last time, O’Neil said her bill expands the list of biometric identifiers exempt from the bill, including handwriting, photos, demographics and tattoo descriptions, among others.
But business groups oppose O’Neil’s bills. They argue that small businesses use data to improve service, not to sell it as a commodity. And they worry that state-level laws, if not crafted to be consistent with the laws of other states, could make Maine an outlier and discourage businesses from locating here.
“If we are going to be pushing forward privacy legislations, we feel it should be broadly spread across all different sectors, not just one specific thing as it pertains to biometric information,” said Ben Lucas, a lobbyist for the Maine State Chamber of Commerce.
Lucas said the right of private action in the bills was “of grave concern” to the business community.
Instead, the chamber and other industry groups endorsed working on digital privacy issues through a bill proposed by Keim, L.D. 1973. Some sectors, including insurance companies, banks and credit unions, requested to be exempt because they already are heavily regulated by the federal government.
Keim, who is the assistant minority leader in the Senate, said her bill is modeled after a Connecticut law because Congress is unlikely to act anytime soon.
“I just don’t see them getting anything done at the federal level,” Keim said. “Americans want this. This is our private information that is just bought and sold without us knowing again and again in cyberspace.”
Keim’s bill is opposed by civil rights advocates and Attorney General Aaron Frey, who called out a provision that would eliminate Maine’s first-in-the-nation law requiring that internet service providers receive permission from customers before using, disclosing or selling their digital information, such as websites visited, locations, the content of communications or financial information.
Frey said Maine successfully defended that law in the courts for two years. “Now we have L.D. 1973, which is another way, in my opinion, that this good law is being attacked,” he said.
Keim’s bill was supported by Charter Communications, which owns the internet service provider, Spectrum. Kate Gore, the state director of governmental affairs at Charter Communications, said the bill would provide better parity on the internet by subjecting search engines, e-commerce sites, streaming services, social networks and mobile carriers to the same laws as service providers.
“Consumers are best served by a uniform framework that is applied consistently across the entire internet ecosystem and is not based on who is collecting or what kind of service is being offered,” Gore said. “Maine’s current law singles out ISPs only, without providing the same level of privacy protection for others within the internet ecosystem. Therefore, the law is in drastic need of reform.”
OPT IN OR OPT OUT
The two sides also clashed over consent requirements, with civil liberties advocates saying that users should have to “opt-in” to allow companies to sell their data, and industry groups saying consumers should be allowed to “opt-out” of the program, a practice they said is more common in other states.
Five states, including California and Connecticut, have consumer data privacy laws that allow people to access and delete personal information and opt out of the sale of personal information, according to the National Conference of State Legislatures.
At least three states specifically restrict access to biometric data, while proposals are still pending in at least six states, according to Husch Blackwell, a law firm tracking the issue.
Frey endorsed O’Neil’s biometric bill, which is modeled after an Illinois law, saying Maine citizens currently have no way to be sure about what is being done with their very sensitive biometric information.
The bill, he said, would allow people to “take control over this very powerful, lucrative information that should be working for consumers and not for anybody else.”
While technology companies already possess vast amounts of consumer information, Meagan Sway, policy director of the American Civil Liberties Union, urged lawmakers to pass O’Neil’s bill to give consumers more control over their information before it’s too late.
“This is an emerging field,” Sway said. “We’re still at a place where the genie can, if not go back in the bottle, can at least be stopped halfway out of the bottle. I really think we’re in a place where if we wait too much longer the genie is out of the bottle.”
The committee is expected to schedule a work session in the coming week.
Send questions/comments to the editors.
