Democrats are looking to pass a bill to protect digital privacy in a way that would be unique in the United States and perhaps beyond.
After months of work trying to reconcile competing proposals and opposing interests, the Judiciary Committee voted along party lines Tuesday to advance a digital privacy bill that won the support of committee Democrats but has stirred concern among businesses and Republicans. Opponents have ranged from Big Tech to local businesses, which worry they will not be able to acquire the data needed to target potential customers in new markets.
The 18-page bill would apply to data that’s traceable to an individual or a device, but excludes nonprofits, hospitals and educational institutions. Complex and highly technical, the measure is difficult to compare to legislation in California and other states. Opponents said the fact that it is unique will make it hard for businesses to adjust their digital practices just to continue doing business in Maine.
The 7-1 party-line vote, with six members absent, came after Keir Lamont, the director of U.S. legislation for the Future for Privacy Forum, a think tank whose corporate members include Facebook and Google, told lawmakers that the heavily amended version of L.D. 1977, would be a “very new approach,” especially in how it limits the type of digital information companies can collect and maintain.
“It would be largely a new paradigm for protecting individual privacy both in the United States or globally,” Lamont said.
Republicans cited the unique nature of the bill and the potential impacts on businesses as reasons for opposing it.
Rep. Rachel Henderson, R-Rumford, who was the only Republican committee member present for the vote, expressed concern about the impact on businesses that use digital information to enhance online shopping and to target online ads.
“My concern is that in an attempt to be special we’re adopting new data minimization standards that is going to make it very difficult for businesses to do business in the state of Maine and almost give them every reason to avoid us,” Henderson said. “We’re asking businesses in the state of Maine to comply with standards that no other company that runs in the world has to comply with.”
The bill would limit the digital information that a company can collect, process and maintain largely to only the information that is reasonably needed to offer a service or good specifically requested by a consumer. It also would prohibit companies from targeting advertisements to people under the age of 18.
The bill contains additional protections for sensitive data, including an individual’s protected status, genetic/biometric information, precise geolocations and other information, including Social Security and driver’s license numbers.
12 STATES HAVE PRIVACY LAWS
If passed, Maine would join 12 other states that have enacted internet privacy laws in the absence of federal regulation. California has the strictest privacy law in the country, while other states, including Connecticut, have passed less comprehensive laws that have the support of technology companies.
Rep. Erin Sheehan, D-Biddeford, said the bill would still allow companies to conduct online advertising and marketing while giving consumers more control over their digital information. She pointed to growing awareness of how social media companies target children, exacerbating mental health problems and other issues, as a reason to support it.
“I understand that it is very uncomfortable for industry groups to accept something that is new, but I think it’s really important to protect the next generations of Mainers’ data,” Sheehan said. “I think the ship has sailed for people our age. We have a chance to do better.”
Patrick Woodcock, president of the Maine State Chamber of Commerce, said Wednesday that he was still getting up to speed on the version that came out of committee Tuesday. But he’s worried that the proposal’s unique approach, rather than being modeled after similar laws in other states, would make Maine an outlier and make it harder for the state’s businesses to find new customers in the global marketplace.
“Companies are concerned their entire structure of marketing would have to be altered because of this bill,” Woodcock said.
Maine companies, including L.L.Bean, testified in opposition to the original version of the bill, which was modeled after federal legislation that failed in Congress. Jason Sulham, public affairs manager for Bean, said he didn’t have time to discuss the new version of the bill on Wednesday.
The bill would take effect on July 1, 2025. Entities that collect digital information on fewer than 100,000 Maine consumers in a calendar year would be exempt until Jan. 1, 2027, when that threshold would drop to entities with data on 50,000 Maine consumers. It also would apply to entities that collect data on 10,000 consumers in a year, provided at least 20% of their revenue comes from selling personal data.
Enforcement would be conducted by the Office of the Maine Attorney General – individuals would not have the right to sue a company for violating the law.
The committee worked for months, holding 11 work sessions from May 2023 through this month, to reconcile two competing versions of digital privacy bills – one sponsored by Rep. Maggie O’Neil, D-Saco, that was backed by privacy advocates and another from Sen. Lisa Keim, R-Dixfield, that was backed by Big Tech and businesses.
During a public hearing last fall, Attorney General Aaron Frey and other supporters said the law is needed to prevent companies from using and selling personal information without consumers’ consent. Planned Parenthood of Northern New England said the protection is needed for people who live in states that don’t allow abortions or gender-affirming care and come to Maine to seek health care they need.
Corporations such as Google, Meta and Amazon collect vast amounts of digital information about people based on their online shopping, viewing and reading habits. Data brokers collect information that is not otherwise public and sell it to companies that can use the information to sell products or change consumers’ behavior.
BIOMETRIC DATA INCLUDED
One of the biggest differences between the two bills was over “digital minimization,” which limits the type of information collected, processed and stored.
Democrats added stricter limits than Republicans, including prohibiting targeted ads to minors and requiring consent to collect a consumer’s biometric data, which includes a fingerprint, voiceprint, eye retina or other biological features that could be linked to a specific user.
Keim said in an interview that she expects most – if not all – of Republicans on the committee who were absent to register votes against the bill. She was disappointed that the committee could not produce a bipartisan bill. She criticized the exceptions made in the Democrat’s bill.
“I was pretty much willing to compromise absolutely as much as possible because we really needed a unanimous report,” Keim said. “I said right along: ‘I want the strongest privacy protection we can get while still allowing businesses to be able to operate in the state of Maine and operate successfully.’ ”
O’Neil said she was not available Wednesday to speak about her bill.
Copy the Story LinkSend questions/comments to the editors.
Success. Please wait for the page to reload. If the page does not reload within 5 seconds, please refresh the page.
Enter your email and password to access comments.
Hi, to comment on stories you must . This profile is in addition to your subscription and website login.
Already have a commenting profile? .
Invalid username/password.
Please check your email to confirm and complete your registration.
Only subscribers are eligible to post comments. Please subscribe or login first for digital access. Here’s why.
Use the form below to reset your password. When you've submitted your account email, we will send an email with a reset code.