HOUSE BILL REPORT

ESHB 2200

As Reported by House Committee On:

Technology & Economic Development

Title: An act relating to protecting the privacy and security of internet users.

Brief Description: Protecting the privacy and security of internet users.

Sponsors: House Committee on Technology & Economic Development (originally sponsored by Representatives Hansen, Taylor, Smith, Buys, Harmsworth, Graves, Maycumber, Walsh, Kraft, Haler, Condotta, Nealey, Bergquist, Steele, Van Werven, Stonier, Macri, Farrell, Cody, Slatter, Tarleton, Senn, Kagi, Pollet, Frame, Chapman, Dye, Hudgins, Stanford, Reeves, Dent, Hayes, Ryu, Peterson, Sells, Kloba, Santos, Johnson, Fitzgibbon, Holy, Ormsby, Caldier, Sawyer, Wylie, Hargrove, Kilduff, Blake, Orcutt, Gregerson, Young, Appleton, Shea, Koster, Morris, Tharinger, Irwin, Muri, Schmick, Volz, Goodman, Clibborn, McCaslin, Pellicciotti, Doglio, Jinkins, Dolan, Kirby, Sullivan, Lytton, Kretz, Riccelli, Rodne, McBride, McCabe and Pettigrew).

Brief History:

Committee Activity:

Technology & Economic Development: 4/12/17, 4/14/17 [DPS], 1/18/18, 1/30/18 [DP].

Majority Report: Do pass. Signed by 13 members: Representatives Morris, Chair; Kloba, Vice Chair; Tarleton, Vice Chair; Doglio, Fey, Harmsworth, Hudgins, McDonald, Santos, Slatter, Steele, Wylie and Young.

Minority Report: Do not pass. Signed by 3 members: Representatives DeBolt, Assistant Ranking Minority Member; Manweller and Nealey.

Staff: Lily Smith (786-7175).

Background:

Federal Communications Commission.

The Federal Communications Commission (FCC) regulates interstate and international communications in commerce, with particular requirements for common carriers under Title II of the federal Communications Act (Title II). Providers of telecommunications services are considered common carriers.

Prior to 2015, the FCC classified the provision of broadband Internet access services (Internet service) as an information service, which is not subject to common carrier regulation under Title II. In a 2015 order, the FCC reclassified Internet service as a telecommunications service, which subjected Internet providers to Title II. Section 222 of Title II requires common carriers to protect the confidentiality of customer proprietary information.

In October 2016 the FCC adopted new rules implementing section 222. The rules used a sensitivity-based framework for customer information, and included requirements regarding:

• notice of privacy policies;

• notice and consent regarding use of, disclosure of, and permitting access to customer information;

• conditioning of service and privacy right waivers; and

• data security and data breach notifications.

The 2016 FCC rules did not apply to online services beyond Internet service, such as websites, electronic mail, and music and video streaming services (sometimes referred to as "edge services").

In April 2017 a law enacted through the Congressional Review Act (CRA) repealed the 2016 FCC rules. Issuance of a rule substantially the same as one repealed under the CRA is prohibited, unless the rule is specifically authorized by a law enacted after the date of repeal of the original rule.

In 2018 the FCC issued an order reclassifying Internet service as an information service.

Federal Trade Commission.

The Federal Trade Commission (FTC) is tasked with preventing unfair or deceptive acts or practices in or affecting commerce under the Federal Trade Commission Act (FTCA), along with enforcement of specific consumer protection and antitrust laws.

The FTCA does not apply to common carriers when engaged in business as a common carrier. Prior to the 2015 FCC order reclassifying Internet service as a telecommunications service, the FTC had authority over Internet service providers under the FTCA. The 2018 FCC order returns that authority.

State Consumer Protection Act.

The state Consumer Protection Act (CPA) prohibits unfair or deceptive acts or practices in trade or commerce. A private person or the Attorney General may bring a civil action to enforce the provisions of the CPA. A person or entity found to have violated the CPA is subject to treble damages and attorney's fees.

–––––––––––––––––––––––––––––––––

Summary of Bill:

An Internet provider must obtain opt-in approval to: (1) sell or transfer customer proprietary information (PI); or (2) send or display an advertisement to a customer that was selected based on the customer's PI. Approval must be solicited at the time of sale, and new approval must be obtained for changes inconsistent with the terms or conditions at prior approval. A mechanism must be provided for a customer to grant, deny, or withdraw approval.

An Internet provider may not condition or refuse service as a consequence of a customer's refusal to waive privacy rights. If an Internet provider offers a financial incentive in exchange for customer approval regarding customer PI, it must disclose certain information regarding the use of the information and provide a mechanism to withdraw participation.

A violation of the act is enforceable under the CPA.

The Utilities and Transportation Commission (UTC) is authorized to adopt rules further defining the definitions and prescribing appropriate notice to be provided to customers.

The substantive sections of the act expire upon determination by the UTC that the federal government has established Internet service customer protections standards substantially equivalent to the levels of protection provided in the act.

"Customer proprietary information" means any of the following an Internet provider acquires in connection with its provision of Internet service:

• content of communication;

• call detail information;

• financial information;

• health information;

• information pertaining to children;

• Social Security numbers;

• precise geolocation information;

• web browsing history, application usage history, and the functional equivalents of either; and

• other personally identifiable information.

–––––––––––––––––––––––––––––––––

Appropriation: None.

Fiscal Note: Available.

Effective Date: The bill takes effect 90 days after adjournment of the session in which the bill is passed, except for sections 1 through 7, relating to Internet user privacy, which take effect December 31, 2018.

Staff Summary of Public Testimony:

(In support) The concept that Internet providers should not be able to double dip by profiting from customers' information is simple. The current substitute bill is the product of extensive bipartisan work that took care of some of the industry's issues with workability. Seattle put similar restrictions in last year, and more rural areas should have the same protections. There are indications that some service providers did intend to use customer information. This bill is important to constituents. Federal Trade Commission jurisdiction is not a panacea, as enforcement will depend on the federal administration. There may be a risk of litigation, but the test will be of Congress's intent, not a specific agency. There is no reason not to create a floor to protect Washington citizens.

(Opposed) The FTC established a privacy framework in 2012, and then the FCC enacted privacy rules only for Internet providers instead of all online companies. Internet providers have adopted privacy principles that are enforceable by the FTC and the state Attorney General. The FTC will have enforcement authority in this area again and state action is not needed. Internet providers do not have access to comprehensive data and do not share personally identifying information without opt-in consent. There are no gaps in protections. This subject got attention because a narrative took hold in a toxic environment. The bill treats sensitive and nonsensitive customer information the same, though they were treated differently at the federal level. It broadens the definitions of customer information. This regulation would slow down the Internet. The FCC is returning to the traditional federal approach of Internet regulation and has cautioned against state action.

(Other) The extreme swing in regulations indicates that this is an issue that should be settled by Congress. This bill will guarantee litigation. The FTC will regain jurisdiction in this area and there is evidence they will take quick action, which will negate the potential problems this bill seeks to address. Multiple provisions would need to be modified to align with FTC precedent and FCC requirements.

Persons Testifying: (In support) Representative Hansen, prime sponsor; and Alex Alben, Office of Privacy and Data Protection.

(Opposed) Gerard Keegan, CTIA; Ron Main, Broadband Communications Association of Washington; Joanie Deutsch, TechNet; Mike Ennis, Association of Washington Business; and Tom McBride, CompTIA.

(Other) Michael Schutzler, Washington Technology Industry Association.

Persons Signed In To Testify But Not Testifying: None.