Margaret Kelsey checks her phone while riding the ferry into Portland in August. Ben McCanna/Staff Photographer

Business groups argued against passage of a statewide digital privacy law during a public hearing Tuesday, saying the proposed limits on the amount of sensitive information they can collect and sell could lead to costly lawsuits and end popular customer loyalty programs.

Maine’s attorney general and other supporters said the law is needed to prevent companies from using and selling personal information without consent. Planned Parenthood of Northern New England said the protection is needed for people from states that don’t allow abortions or gender-affirming care who come to Maine to seek health care they need.

Members of the Legislature’s Judiciary Committee, which is meeting in between legislative sessions, did not make any decisions about how to move forward following Tuesday’s public hearing. The sponsors of competing bills said they would continue to work toward a compromise that could be supported by businesses and consumers.

Corporations such as Google, Meta and Amazon collect vast amounts of digital information about people based on their online shopping, viewing and reading habits. Data brokers collect information that is not otherwise public and sell it to companies that can use the information to sell products or change consumers’ behavior.

Michael Kebede, policy counsel for the ACLU of Maine, said technology companies can use the data to influence people “really in any way the highest bidder wants to modify our behavior.”

“The touchstone of behavior modifications depends on amassing as much data as possible from everything that’s connected to the internet,” Kebede said. “That means companies that are not interested in behavioral modification or data gathering … are massively incentivized to share our data behind our backs so larger, better-resourced firms can modify our behavior.”

If passed, Maine would join 12 other states that have enacted internet privacy laws in the absence of federal regulation. California has the strictest privacy law in the country, while other states, including Connecticut, have passed less comprehensive laws that have the support of technology companies.

State Rep. Maggie O’Neil, D-Saco in the Cross State Office Building in Augusta in April 2023. Joe Phelan/Kennebec Journal

Rep. Maggie O’Neil, D-Saco, has proposed a sweeping digital privacy bill. It is one of four held over from the last session that lawmakers are considering in between sessions. Her other bills target the use of medical and biometric information, which includes face scans, voice recognition and fingerprints.

“Collection and processing of personal data at this massive scale is the root cause of many problems online, from discrimination to threats to democratic society,” O’Neil said.

COMPETING BILLS

Businesses opposed O’Neil’s comprehensive privacy while supporting an alternative proposal from Sen. Lisa Keim, R-Dixfield, which is modeled after Connecticut’s law. But privacy advocates say that Keim’s proposal falls short of protections needed and contains no meaningful enforcement action.

Caitriona Fitzgerald, deputy director of the Electronic Privacy Information Center, which helped draft O’Neil’s bill, portrayed Keim’s proposal as being written by big technology companies. The Electronic Privacy Information Center played a central role in crafting federal legislation that received bipartisan support in Congress but was never enacted.

Fitzgerald said Amazon wrote a version of the privacy law that was implemented in Connecticut and other states.

“This is big tech’s playbook,” she said. “They just want weaker bills at the state level so they can lower the bar for an eventual federal law.”

Keim pushed back against that characterization, saying she updated her bill to address concerns from the ACLU, although she chose not to include a provision to allow consumers to sue companies that violate the law. She said Maine’s bill should be aligned with other states to provide consistency for businesses and customers.

“My goal 100% is protection of Maine people,” Keim said. “I’m not trying to protect business, though I do want them to be successful and be able to be here in the state of Maine. What we need to do is pass a law that businesses understand and can comply with, and that people understand as well. Simplicity matters.”

O’Neil’s bill, L.D. 1977, would prohibit businesses from collecting or selling information that is not reasonably necessary for providing products or services requested by the customer. Additional safeguards are added for sensitive information, especially of minors.

Companies would be required to tell customers upon request about the information they collected and what they do with it.

Violations of the bill could be enforced by the attorney general, or by consumers who sue for punitive damages. The ability for consumers to go to court is what concerned businesses.

LEGAL ACTION AN ISSUE FOR CHAMBER

Ashley Luszczki, a lobbyist for the Maine State Chamber of Commerce, which represents over 5,000 businesses, said the potential for consumer legal action would “create a more litigious environment and drive up the costs of doing business. … In the case of small businesses, it could be detrimental to their very existence.”

But O’Neil said the provision was central to the bill’s effectiveness, saying it would only apply to larger companies.

“Maine’s law needs teeth to be enforceable,” she said. “Companies oppose this because it creates real consequences for breaking the law. This is the most important part of the bill, especially because it only applies to large companies.”

Businesses also were concerned about the impact on loyalty programs. While those programs would be allowed, the law would not allow businesses to offer incentives or discounts to people who let the businesses collect and sell user data unrelated to the products or services.

Deputy Attorney General Christopher Taub, who testified in support of O’Neil’s bill, said that provision was a matter of social justice, since people with less money would feel more financial pressure to waive privacy to get a discount, while wealthier customers could afford to keep their information private.

“We believe privacy should be available to everyone and not just the people who can afford to pay for it,” Taub said.

Lisa Margulies, the Maine vice president of public affairs at Planned Parenthood Northern New England, said privacy protections are needed more than ever for people who may travel from states with abortion bans to other states such as Maine where the procedure remains legal. Similar protections are needed for people unable to access gender-affirming care in their home states, Margulies said.

“As states across the nation ban or impede access to abortion and gender-affirming care, Maine plays a critical role as a safe harbor for patients throughout the country,” she said. “Improving privacy protections for personal data is essential in safeguarding safe health care access.”