Law / United States / 
Maine
Broadband internet access service, customer personal information privacy
In force since .
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, User location
- Audit expectation
- none
What it requires
- Obtain a Maine broadband customer's express, affirmative, opt-in consent before using, disclosing, selling, or permitting access to their customer personal information, and let them revoke that consent at any time.
- Do not refuse service, or charge a penalty or offer a discount, based on a customer's consent decision under this statute.
- Do not treat this statute as reaching biometric data. Its customer personal information definition never names biometric, fingerprint, voiceprint, or faceprint data.
These lines are LexLint's reading of the law's text. Also read by: ACA Connects - America's Communications Association v. Frey, No. 1:20-cv-00055-LEW (D. Me. ) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-med-1_20-cv-00055/pdf/USCOURTS-med-1_20-cv-00055-0.pdf
- Case citation
- ACA Connects - America's Communications Association v. Frey, No. 1:20-cv-00055-LEW (D. Me. )
- Open questions
- Does "customer personal information" in 35-A M.R.S. ยง 9301(1)(C), whose examples are introduced by "including but not limited to", reach only the categories the Federal Communications Commission's ISP Privacy Order treated as sensitive plus those the statute names, or any other personally identifying or usage information?
What it makes you log
Logging duty
A broadband provider may not use, disclose, sell or permit access to customer personal information except with the customer's express, affirmative consent, revocable at any time, or under the listed exceptions; must take reasonable measures to protect the information; and must give each customer a notice of its obligations and the customer's rights. A consent the provider must obtain, a security duty and a notice state conditions and rules and require no log, register or consent record, and the section sets no period for keeping the information beyond the exceptions that let the provider retain it. The section applies to providers operating within the State serving customers physically located and billed in the State, coded as an establishment prong and a user-location prong.
- Kind
- None
- As of
What this law does
A provider of broadband internet access service may not use, disclose, sell, or permit access to a customer's customer personal information except with the customer's express, affirmative, opt-in consent, revocable at any time, and may not refuse service or charge a penalty or offer a discount based on the customer's consent decision.
"Customer personal information" is defined broadly (name, billing information, Social Security number, demographic data, browsing history, application usage history, precise geolocation, financial and health information, children's information, device identifiers, communications content, and origin and destination IP addresses) but never mentions biometric data.
The section's own history note dates enactment to PL 2019, c. 216, sec. 1, and the Act takes effect under its section 2; the section carries no amendment since. No enforcement or penalty provision appears within the section itself as read.
When LexLint raises it
When your app profile says your app provides telecom services or processes personal data.
Back to the example · Lint your app
Page updated .