Competing proposals to protect the online data privacy of Maine residents ran aground Wednesday as the Legislature scrambled to wrap its 2024 session.

The Maine Senate rejected the stricter of the two data privacy proposals, voting 18-15 Wednesday morning against L.D. 1977, a bill opposed by Maine business owners and advocates because it takes a tougher approach to limiting personal data collection and targeted online advertising.

The House, which had narrowly approved the bill 75-70 Tuesday night, took it up again Wednesday afternoon, approving it again, this time by a 85-57 vote. The House then sent it back to the Senate to insist on reconsideration Wednesday night in the hope that some senators might change their minds, but it died there.

Meanwhile, the House followed the Senate’s lead Wednesday afternoon when representatives voted 81-63 against L.D. 1773, a bill favored by the business community that is similar to data privacy laws passed in a dozen states. Barring extraordinary measures, that bill is essentially dead after the Senate voted it down 18-14 on Tuesday.

Either bill would need to pass both chambers, in identical form, to advance to the desk of Gov. Janet Mills.

Sen. Anne Carney, D-Cape Elizabeth, Senate chair of the Judiciary Committee, which backed L.D. 1977, declined to discuss her thoughts about the bill’s standing or its potential for passage.

“It’s just an earnest difference in policy choice,” Carney said, describing the gap in legislators’ support for either bill.

The ACLU of Maine expressed disappointment Wednesday that the Senate rejected L.D. 1977, “which would have implemented the nation’s strongest privacy protections.”

“Maine has a proud tradition of leading the nation in data privacy, limiting data collection by internet service providers, banning governments from using facial recognition technology, and requiring warrants to obtain cellphone data,” Meagan Sway, policy director for the ACLU of Maine, said in a statement. “We are excited to continue working with lawmakers, small-business leaders, and concerned Mainers to advance this important legislation next year.”

Sway also praised both houses for rejecting L.D. 1973, “a bill created by and for Big Tech. Under the guise of protecting Maine people’s privacy, the bill would have allowed tech giants to continue exploiting our most personal information so long as they let us know in their privacy policy.”

Rep. Rachel Henderson, R-Rumford, who is a Judiciary Committee member, testified Wednesday that L.D. 1973 “truly does strike a balance” between protecting consumer privacy and allowing businesses to function in the digital marketplace.

Rep. Matt Moonen, D-Portland, House chair of the Judiciary Committee, countered that the bill has “major flaws,” saying that it basically allows companies to do anything they want with people’s online data as long as it’s outlined in privacy notices that few people read.

‘WE CAN DO BETTER’

“We can do better. I believe we did do better,” Moonen said, referring to L.D. 1977.

In her testimony Wednesday, Carney said the stricter bill includes better privacy protections for all Mainers, especially children, and greatly limits personal data collection across websites.

It doesn’t, however, prevent businesses from engaging in targeted marketing as feared, she said.

“Businesses can do targeted advertising under L.D. 1977 within their ecosystems,” she said. “Businesses … could gather personal data (from a social media website) to build a profile about a consumer based on that consumer’s interactions with the social media website. What you like, what you read, who your friends are, where you work, what your recreational interests are. And a retailer in Maine could purchase targeted ads on that social media website.”

What couldn’t happen under the stricter bill, Carney said, “is tracking of the consumer across websites, across the retailer’s website, as well as across the social media website, and then also tracking over time.”

Targeted advertising refers to online ads directed toward certain people based on demographic information, like their age, gender and other data collected online and through personal devices such as phones, fitness trackers and smart home appliances.

Opponents of unchecked targeted advertising say online data mining exposes individuals and their private information to theft, data breaches, discrimination and other abuses. Proponents say it makes ads more relevant to users and is more cost-effective, particularly for smaller businesses with limited budgets and staff, which is why the bill has faced steep opposition from Maine’s business community.

Sen. Lisa Keim, R-Dixfield, who co-sponsored L.D. 1973 and opposed L.D. 1977, testified Wednesday that the stricter bill would hurt Maine businesses by restricting targeted advertising and would make it difficult for companies outside the state to do business in Maine.

She and other Republicans emphasized that nonprofit organizations would be exempted from L.D. 1977, while it would make “Maine businesses do what’s nearly impossible” and jeopardize an already challenging commercial climate.

Sen. Joe Baldacci, D-Bangor, agreed with Keim and voted against L.D. 1977, testifying that he listened “to our local businesses who are unified against” the stricter bill, which he described as “policy by sledgehammer.”

EXEMPTIONS OUTLINED

Other exemptions named in the summary of the stricter proposal include colleges and universities; health care facilities and practitioners; and entities that both processed the personal data of fewer than 10,000 consumers in the preceding calendar year and derived no more than 20% of gross revenue from the sale of personal data.

The summary also specifies that the bill doesn’t prohibit businesses from using personal data collected in a lawful manner for purposes such as internal product research, product recalls and targeted advertising, “as long as a consumer’s targeted advertising opt-out request, if any, is honored and the personal data processed for purposes of the advertisement does not include sensitive data.”

The stricter bill aims to regulate the collection, use, processing, transfer, sale and deletion of non-publicly available personal data that is “linked or reasonably linkable to” a Maine resident.

Under the act, businesses, including third-party platforms, would have to limit the collection and processing of “personal data” to what is “reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer.”

The collection and processing of “sensitive data” would be limited to what is “strictly necessary to provide or maintain a specific product or service requested by the consumer.” Sensitive data would include information revealing a consumer’s race or ethnic origin, religious beliefs, mental or physical health conditions or diagnoses, sexual orientation, gender identity, citizenship or immigration status; genetic or biometric data; precise geolocation data; Social Security, driver’s license or nondriver identification card numbers; specific financial or account access information; data of a known minor; or data concerning the consumer’s status as the victim of a crime.

A business would have to obtain a consumer’s permission before collecting any biometric data. If a business knows that a consumer has not reached age 13, it must have parental consent to process that consumer’s data for any purpose. Businesses must provide consumers with a privacy notice explaining what personal data is being processed, how it’s being used and what type of third parties it’s being shared with.

Carney emphasized Wednesday that L.D. 1977 would be enforced by the Office of the Maine Attorney General, and that people wouldn’t be able to take court action privately based on the bill.

Copy the Story Link

« Previous

Biden backs House’s Ukraine, Israel package as Speaker Johnson fights to keep his job

Next »

Republicans scrutinize voting rolls and prepare for mass challenges ahead of election