SENATE BILL REPORT

SB 5919

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

As of January 29, 2018

Title: An act relating to consumer protection of internet privacy.

Brief Description: Concerning consumer protection of internet privacy.

Sponsors: Senators Ranker, Fain, Miloscia, Rivers, Rossi, Billig, Carlyle, Brown, Rolfes, Frockt, Hasegawa, Conway, Warnick, Darneille, Pedersen, Keiser, Zeiger, Baumgartner, Cleveland, Chase, Kuderer, Takko, McCoy, Hunt, Nelson, Saldaña, Fortunato, Liias, Short, Mullet, Palumbo, Wellman, Hobbs, Pearson and Sheldon.

Committee Activity: Energy, Environment & Technology: 1/11/18.

Brief Summary of Bill

Requires broadband Internet providers to obtain opt-in consent to sell or transfer certain customer information.

Requires broadband Internet providers to obtain opt-in consent to send or display an advertisement to a customer based on certain customer information.

SENATE COMMITTEE ON ENERGY, ENVIRONMENT & TECHNOLOGY

Staff: Jan Odano (786-7486)

Background: Federal Regulation. The Federal Communications Commission (FCC) regulates interstate and international communication in promotion of several purposes, including development and provision of services at reasonable rates and promotion of safety of life and property through communications use. The Federal Trade Commission (FTC) is tasked with preventing unfair or deceptive acts or practices in or affecting commerce, except with regard to certain industry sectors.

Prior to 2015, the FCC classified the provision of broadband Internet access services (BIAS) as an information service. The provision of information services is not subject to common carrier regulation by the FCC under the Federal Telecommunications Act. The FTC has authority to enforce privacy and data security for information services through its broad enforcement power over unfair or deceptive acts or practices. The Federal Trade Commission Act restricts the FTC from exercising jurisdiction over common carriers when engaged in business as a common carrier.

In a 2015 order, the FCC reclassified the provision of BIAS as a telecommunications service, subjecting it to common carrier regulation under Title II of the Federal Telecommunications Act. Section 222 of Title II requires telecommunications carriers to protect the confidentiality of customer proprietary information. In the 2015 order, the FCC declined to apply to BIAS providers the majority of the rules previously promulgated under Title II for other telecommunications service providers, including existing rules implementing section 222.

In October 2016, the FCC adopted new rules implementing section 222, and applied them to all telecommunications services, including BIAS. The new harmonized rules used a sensitivity-based framework for customer information, and included requirements regarding:

notice of privacy policies;
notice and consent regarding use of, disclosure of, and permitting access to customer information;
conditioning of service and privacy right waivers; and
data security and data breach notification.

The 2016 FCC rules did not apply to online services beyond BIAS, such as websites, electronic mail, and music and video streaming services—sometimes referred to as edge services.

In April 2017, a law enacted through the Congressional Review Act (CRA) repealed the 2016 FCC rules. Issuance of a rule substantially the same as one repealed under the CRA is prohibited, unless the rule is specifically authorized by a law enacted after the date of repeal of the original rule.

State Consumer Protection Act. Under the Consumer Protection Act (CPA), unfair or deceptive acts or practices in trade or commerce are unlawful. The CPA provides that any person injured in the person's business or property through such practices may bring a civil action to recover actual damages sustained and costs of the suit, including reasonable attorney's fees. Treble damages may also be awarded in the court's discretion, provided the damage award does not exceed $25,000. The Attorney General may bring an action under the CPA in order to restrain and prevent unfair and deceptive acts and practices.

Summary of Bill: The bill as referred to committee not considered.

Summary of Bill (Proposed Substitute): A BIAS provider must obtain opt-in consent to sell or transfer customer proprietary information (PI), or to send or display an advertisement to a customer that was selected based on the customer's PI. Approval must be solicited at the time of sale, and new approval must be obtained for changes inconsistent with the terms or conditions at prior approval.

Providers of BIAS must provide a mechanism for a customer to grant, deny, or withdraw approval to: (1) sell or transfer customer PI, or (2) send or display an advertisement to a customer that was selected based on the customer's PI. A BIAS provider may not condition or refuse service as a consequence of a customer's refusal to waive privacy rights. If a BIAS provider offers a financial incentive in exchange for customer approval regarding customer PI, it must disclose certain information regarding the use of the information and provide a mechanism to withdraw participation.

A violation of these requirements is enforceable under the CPA.

The Utilities and Transportation Commission (UTC) is authorized to adopt rules further defining the definitions and prescribing appropriate notice to be provided to customers.

The substantive sections of the act expire upon determination by the UTC that the federal government has established BIAS customer protections standards substantially equivalent to the levels of protection provided in the act.

Customer proprietary information means any of the following a carrier acquires in connection with its provision of BIAS:

content of communication;

call detail information;

financial information;

health information;

information pertaining to children;

Social Security numbers;

precise geolocation information;

web browsing history, application usage history, and the functional equivalents of either; and

other personally identifiable information.

Appropriation: None.

Fiscal Note: Not requested.

Creates Committee/Commission/Task Force that includes Legislative members: No.

Effective Date: Ninety days after adjournment of session in which bill is passed.

Staff Summary of Public Testimony on Proposed Substitute: PRO: Washington should remain a technology and privacy leader. This protects privacy rights. Citizens broadly support internet privacy legislation.

CON: Internet service providers have committed to privacy principles that are enforceable under the consumer protection act by the attorney general. These are very complex and complicated issues. There will be unintended consequences as services may stop or be interrupted.

OTHER: These regulations must be taken care of at the federal level.

Persons Testifying: PRO: Senator Kevin Ranker, Prime Sponsor; Alex Alben, Office of Privacy & Data Protection. CON: Jo Deutsch, TechNet; Gerard "Gerry" Keegan, CTIA; Bob Battles, Association of Washington Business; Ron Main, Broadband Communications Association of Washington; Tom McBride, CompTIA. OTHER: Michael Schutzler, Washington Technology Industry Association.

Persons Signed In To Testify But Not Testifying: No one.