Assembly Dem-Sponsored Bills Protecting Internet Users’ Privacy Clears Assembly Panel

Two consumer protections bills sponsored by Assembly Democrats Andrew Zwicker, Daniel Benson, Paul Moriarty, Joann Downey, and Wayne DeAngelo to prohibit Internet service providers from selling or otherwise disclosing a subscriber’s online browsing history and personal information and requiring commercial websites and online service operators to post privacy policy advanced in the Assembly on Thursday.

“In today’s world, using the Internet is essential to everyday life, which means that Internet service providers have unparalleled access to a great deal of information about their subscribers’ highly personal habits, preferences, even medical issues,” said Zwicker. (D-Hunterdon/Mercer/Middlesex/Somerset) “That private data should not be up for sale to the highest bidder without subscribers’ knowledge or consent.¨

The bill (A-1527) would require internet service providers (ISPs) like Verizon, Comcast and AT&T to keep their subscribers’ personally identifiable information confidential, unless a subscriber expressly authorizes the ISP to disclose the information. The legislation comes after President Donald Trump signed legislation last May rescinding Federal Communications Commission protections intended to prohibit ISPs from selling their subscribers’ personal data.

“We are excited that technology is advancing but the fundamental principle that consumers have a right to privacy over their information should not be compromised,¨ said Benson (D- Mercer/Middlesex). “It is more important than ever to ensure that consumers know that their personal information is confidential and that they are protected from the potential harm caused by unpermitted disclosure.¨

New Jersey joins more than a dozen other states with similar bills since the federal privacy protections rollback in early April.

“Mostly everything that we do these days, we do online, from organizing our households to personal shopping,¨ said Moriarty (D-Camden, Gloucester). “This information should be private and not for sale. A consumer deserves their right to privacy online.¨

“Securing a person’s online privacy beyond their financial information is extremely important to protecting their online presence in this digital age,¨ said Downey (D-Monmouth). “There’s only so much a consumer can do on their end to protect their personal information online. By requiring websites and online providers to strengthen their privacy policies, we strengthen protections for online consumers.¨
“Many consumers are unaware that their information is being sold to other companies for marketing purposes,¨ said DeAngelo (Mercer/Middlesex). “Sharing or selling this information makes it susceptible to online hacking allowing this information to land in the wrong hands in general. Prohibiting internet service providers from selling this information protects consumers.”

The measure defines “personally identifiable information¨ as any information that personally identifies, describes or is able to be associated with a subscriber or users of a subscriber’s account, including, but not limited to:

  • name, address, precise geolocation, Social Security number or telephone number;
  • requests for specific materials or services from an ISP;
  • Internet protocol (IP) addresses or information concerning the access or use of online services;
  • information identifying a device used primarily or exclusively by the subscriber or users of the subscriber’s account;
  • financial or billing information;
  • demographic data;
  • medical information;
  • browser cache or history;
  • the contents of a subscriber’s communications or data-storage devices; or
  • any information pertaining to children.

Under the legislation, subscribers who wish to disclose their information must declare so using a form separate from their contract for Internet service. An ISP would be required to provide written notice of this requirement to each subscriber upon his or her first applying for service and when the subscriber renews a contract for service. The subscriber may revoke, in writing, the authorization at any time.

The measure states that there shall be no penalty, either financially or in the quality or speed of delivery of service, for a subscriber prohibiting an ISP from disclosing his or her information.

A second bill (A-3923) sponsored by Zwicker – requires commercial Internet website and online service operators to conspicuously post their privacy policy. This includes but is not limited to:

1) the categories of personally identifiable information that the operator collects through the Internet website or online service about individual customers who visit its commercial Internet website or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.

2) If offered by an operator, a description of the process by which a customer who uses or visits a commercial Internet website or online service may review and request changes to any of the customer’s personally identifiable information that is collected through the commercial Internet website or online service;

3) a description of the process by which the operator notifies customers who use or visit its commercial Internet website or online service of material changes to the operator’s privacy policy for that commercial Internet website or online service;

4) the effective date of the privacy policy;

5) disclosure of how the operator responds to Internet web browser “do not track” settings or other mechanisms that provide customers the ability to exercise choice concerning the collection of personally identifiable information about an individual customer’s online activities over time and across third-party Internet websites or online services; and

6) disclosure of whether third parties may collect, purchase, or access personally identifiable information about an individual customer’s online activities over time and across different Internet websites when a customer uses the operator’s commercial Internet website or online service.

“In recent months, we’ve seen how our personal data can be harvested, sold, and even used against us, or to subvert our public discourse, all without our knowledge. In the wake of the shocking revelations about how Facebook and Cambridge Analytica misused our personal data, many people, myself included, have decided to change their privacy settings and take back control over how websites use our information,¨ Zwicker said. “But what we’ve learned is that it’s not an easy, user-friendly process. In fact, just finding a website’s privacy policy is like searching for buried treasure.¨

Zwicker said his bill is an important step towards fixing that. By requiring that online providers’ privacy policies are clear and easy to find for any consumer, the bill will protect internet users, and allow consumers to make informed choices about safeguarding their personal data.

Both bills were approved by the Assembly Science, Innovation and Technology Committee and are now poised for an Assembly floor vote.