The FCC Creates Privacy, Data Protection, and Data Breach Rules for Internet Service Providers





The Federal Communications Commission is venturing into new areas of privacy regulation.  By a narrow vote, the FCC has approved new rules that govern how internet service providers ("ISPs") use consumers' information.

 

ISPs long ago realized that customer data is valuable, and are continuing to develop ways to monetize that information.  For example, last month, AT&T explained that a major factor in its decision to bid on Time Warner was the lure of new possibilities in targeted advertising.  Last year, Comcast bought targeted advertising firm Visible World for similar reasons.

 

Efforts by ISPs to monetize user data have triggered concerns among privacy watchdogs and the FCC.  On October 27, 2016, the FCC adopted new rules to control when and how this information can be used and shared.  "It's the consumers' information.  How it is used should be the consumers' choice" said FCC Chairman Tom Wheeler. 

 

According to the FCC, the rules "do not prohibit ISPs from using or sharing their customers’ information – they simply require ISPs to put their customers into the driver’s seat when it comes to those decisions.”  The new rules require specific notices to consumers about:

• The types of information the ISP collects from them


• How the ISP uses and shares the information


• The types of entities with whom the ISP shares the information

The rules also require ISPs to give a degree of control to the consumer.  ISPs will be required to obtain consumer consent (an "opt-in") before sharing certain categories of "sensitive" information, including:

• Health information


• Financial information


• Geo-location


• Children’s information


• Social Security numbers


• Web browsing history


• App usage history


• Content of communications

For other categories of information (those not deemed “sensitive," such as an email address or service level), ISPs must still offer users the opportunity to “opt-out” of the use and sharing of their information, with some exceptions.  Customer consent can be inferred for certain uses, such as providing services and for billing and collection activities.

 

ISPs are prohibited from rejecting a customer for refusing to provide a requested consent.  Because it is more profitable for the ISP if the customers permit data use and sharing, the rules permit an ISP to give customers a discount or other financial incentive to provide a requested consent.

 

The FCC has made it clear that its rules “do not regulate the privacy practices of websites or apps, like Twitter or Facebook, over which the FTC has authority.”  Websites and apps currently collect much more data than ISPs, so the practical impact of the rules on consumer privacy is likely to be limited.

 

The new rules impose a requirement that ISPs implement reasonable data security practices, including robust customer authentication and data disposal practices.  The rules also include a data breach notification requirement, which preempts those in existence in 47 states, but only to the extent that the FCC rules are inconsistent with a state's requirements.   

 

The rules become effective with respect to different sections at different times, with all of the rules likely becoming enforceable within one year. 

 

This action by the FCC creates just one more piece in the mosaic of statues, regulations, and treaties that together comprise privacy and data security law. 

New N.C. Privacy Statute Becomes Effective

 

Several new North Carolina laws become effective today, December 1st, 2015. Among them are some privacy law enhancements including provisions that are known as the "revenge porn" statute. [Session Law 2015-250] Just over half of the states currently have such laws on the books, and about nine states' statutes create a civil remedy. The statutes are designed to address a troubling trend of people posting intimate images or video of another person, usually a former partner, on the internet to gain "revenge" by humiliating the person. Some states' courts recognize common law legal theories that can be used to combat this activity, but many states concluded that a specific statute was necessary and appropriate. As of today, North Carolina is among them.

The new statute makes it unlawful to "disclose a private image" if all five of the following facts and circumstances are present:

   (1) Intent. The person knowingly discloses an image of another person with the intent to coerce, harass, intimidate, demean, humiliate, or cause financial loss to the depicted person (or cause others to do so).

  (2) Identifiable. The depicted person must be identifiable from the disclosed image itself or information provided in connection with the image.

   (3) Private Parts or Conduct. The depicted person's intimate parts are exposed or the depicted person is engaged in sexual conduct in the image.

  (4) Lack of Consent. The person discloses the image without the affirmative consent of the depicted person.

  (5) Expectation of Privacy. The person discloses the image under circumstances such that the person knew or should have known that the depicted person had a reasonable expectation of privacy.

A violation of the statute is a felony and gives the person who is the subject of the image a right to sue the offending person. In a lawsuit, the subject of the image can recover his or her actual damages (which are assumed to be the higher of $1,000 per day for each day of the violation or $10,000); punitive damages (to punish the offender); and attorneys' fee and other litigation costs. A court can also order the destruction of the image(s). The lawsuit must be filed no later than one year after the discovery of the offense, and no later than seven years after the last known disclosure of the image.  

The criminal penalties may be subject to a Constitutional challenge in the future, because the First Amendment guarantees rights that the statute could be interpreted to limit. Similar statutes in several other states have been challenged on Constitutional grounds. It will be interesting to see how North Carolina's statute will fare when the inevitable challenge comes.

You can read more about the statute here.