Lawmakers still split over data privacy policy as bill advances to floor

Yahoo

3 days ago

Republican Rep. Rachel Henderson of Rumford (middle) discusses her data privacy proposal with Judiciary Committee analyst Janet Stocco (left). (Emma Davis/ Maine Morning Star)
Members of the Judiciary Committee late Friday advanced one of three proposals to better protect data privacy in Maine with the hope that the effort to rein in the reach of Big Tech would not founder as it did last year.
Before voting against her own bill, Rep. Rachel Henderson (R-Rumford) told the Judiciary Committee Friday afternoon that she thinks the best chance the Legislature has to get a comprehensive data privacy law passed this year is for there to be just one plan for the Maine Senate and House of Representatives to consider.
'To me, it's not about having a bill in my name,' Henderson said. 'It's about the policy. Transparently, it took me a while to get there. I've got an ego too.'
However, that decision does not mean lawmakers agree on what the right policy is. That will still be worked out in the chambers.
For the sake of procedure, the committee opted to advance just one of the bills, but the competing components of the plans will still have the opportunity to be considered as majority and minority reports.
As Henderson put it, 'I would hate to see happen this year what happened last year.'
Legislature rejects paths to a comprehensive data privacy law in Maine
Last session, after a dozen public meetings, countless hours of behind-the-scenes work and sizable lobbying influence from Big Tech, the Legislature rejected two competing data privacy bills on the last day, during which floor speeches demonstrated confusion over the various differences in the bills.
The fundamental differences between last year's legislation — namely how companies approach the collection of user data — could not be reconciled. The plans being considered this year, which lean heavily on last year's proposals, still have those key differences, so whether a resolution can be reached this year will remain to be seen.
The main disagreement is how to approach a standard called data minimization, which broadly means limiting the collection of personal information to only what is necessary to fulfill the consumer service.
The legislation the majority of the committee advanced, LD 1822 sponsored by Rep. Amy Kuhn (D-Falmouth), uses this approach. It specifically would limit the collection of personal data to only what is reasonably necessary and proportionate to provide a specific product or service requested by the consumer.
The key reason business interests at the public hearing opposed this bill was because they were concerned it would prevent them from doing targeted advertising. While Kuhn built her bill off of one of the versions last year that was favored by privacy advocates and opposed by businesses, she altered it to ensure small businesses that have to stretch their advertising dollars can access ad exchanges, which are marketplaces where companies can buy and sell advertising.
On Friday, Maine Assistant Attorney General Brendan O'Neil said, 'I don't see a restriction on targeted advertising in the bill.'
Henderson's bill, LD 1088, which the majority of committee rejected, would use a notice and consent model, allowing companies to collect data as long as consumers agree to it in privacy notices. Earlier in May, the committee rejected a similar bill, LD 1224, to narrow down the number of competing proposals.
These two bills are similar to the version last session that was favored by businesses, who argued for Maine to adopt a law that is consistent with those adopted by other states.
​​There is currently a patchwork of state laws and parts of federal legislation governing the current landscape, as there remains no one federal law regulating internet privacy, despite several proposals. But more than a dozen states have modeled their laws off one first passed in Connecticut, which is the basis for LD 1088 and LD 1224.
However, Connecticut's attorney general has since recommended that its state Legislature amend the law to strengthen data minimization provisions rather than rely on its current 'exploitable' notice-and-consent model.
Reading from the Connecticut report released in April, O'Neil said, 'They start out by saying that, in many cases, serious privacy and data security concerns could have been offset, if not fully alleviated, if companies had properly minimized the data they collected and maintained. That's really what LD 1822's data minimization standard aims to do.'
Maryland passed a law last year that is similar to Kuhn's proposal, marking a departure from the years-long trend of states following what privacy advocates see as Connecticut's watered down model.
Maine's full Legislature will now decide between these two versions of a data privacy law.
The committee voted 7-1 against LD 1088, with Rep. Adam Lee opposed, but his minority report was to strike and replace the bill with Kuhn's bill. Six members were absent for the vote.
The committee also voted 7-1 in favor of LD 1822, with Henderson opposed. Her minority report is to strike and replace the bill for her bill language. Six members were again absent for the vote.
Essentially, these minority reports afford lawmakers avenues to take up the versions as they see fit but, the committee hopes, without the confusion of competing bills like last year.
With the possibility of changes coming to Connecticut's law and waiting to see how Maryland's law works in practice, lawmakers also prepared to have a vehicle to use should Maine pass a law and then want to amend it based on lessons learned from other states.
A concept draft, LD 595 sponsored by Judiciary Committee co-chair Anne Carney (D-Cumberland), will be carried over into next year, which currently reads that it could 'further update certain consumer privacy laws in response to recent developments in federal and state consumer privacy laws.'
SUPPORT: YOU MAKE OUR WORK POSSIBLE