Blackburn's Broadband Privacy Legislation Surprises, Intrigues Stakeholders

“We're still evaluating the bill but it does seem to do a few things right,” said Free Press Policy Counsel Gaurav Laroia. “It acknowledges that web-browsing history, content, and geo-location information are sensitive and that companies should get their customer's affirmative opt-in consent before using, disclosing, or permitting access to that information.”

Blackburn’s 13-page Balancing the Rights of Web Surfers Equally and Responsibly Act would specify the FTC as the regulator. The FTC currently can't address ISPs due to its common carrier exemption and broadband’s status as a Communications Act Title II service. The FCC approved 2-1 an NPRM last week beginning a process that could undo that classification. The bill’s privacy requirements would apply to “providers of broadband internet access service, notwithstanding the exception in such section for common carriers subject to the Communications Act of 1934,” the text said. The bill has two co-sponsors: Reps. Brian Fitzpatrick, R-Pa., and Bill Flores, R-Texas.

Jurisdiction falls to House Commerce’s Digital Commerce and Consumer Protection Subcommittee, led by Chairman Bob Latta, R-Ohio, Blackburn told us when asked about markup timing. “We are currently reviewing the legislation and will determine how and if it fits into the subcommittee’s larger agenda,” a Latta committee spokeswoman said. Latta is leading his own legislation this year to ensure FTC authority over ISP privacy (see 1704270006). Blackburn told us the measure likely has some bipartisan interest. "We look forward to working with Chairman Blackburn and Congress on this important issue," an FTC spokesman said.

Some Positives

“I am glad that Congresswoman Blackburn recognizes that people deserve to be offered a choice over how their sensitive information is collected and used,” FTC Commissioner Terrell McSweeny told us in a statement Friday. “I am reviewing the specifics of the legislation.” She slammed the “gaping hole in the protection of consumers' privacy” following GOP repeal of the FCC rules. McSweeny, speaking during an episode of C-SPAN’s The Communicators that was to be shown over the weekend, said she "would like to see Congress step in and give the FTC jurisdiction very clearly, which they could do by passing legislation."

“This bill would increase privacy protections above the current status quo,” said R Street Institute analyst Tom Struble, citing its elevation of web browsing data to sensitive, opt-in status for all entities. “It would be a win for the privacy community.” But edge companies have never faced such a requirement and pushback would be likely, Struble added: “I think they would be unhappy.” He also questioned the bill’s lack of data security components and believes they would need to be addressed if it were to move. It seems "somewhat incomplete," he said.

The legislation seems unlikely to pass and may be more of a marker, said an industry lobbyist with ties to both the tech and telecom industries. The lobbyist pointed to likely tech industry opposition due to the higher bar for opt-in protections and other ambiguities in terms of the bill substance. The lobbyist suggested the bill may seem broader in its application of privacy rules but have a narrower effect of what sensitive information is, given its circumscribed list of such data. The lobbyist welcomed the conversation the bill may begin.

“We support strong consumer privacy protections, such as requiring opt-in consent for the use and sharing of browsing history, but there are a lot of questions about the scope and enforcement of this bill that need to be answered,” said Center for Democracy & Technology analyst Natasha Duarte.

CRA Response

Blackburn helped lead the Congressional Review Act resolution of disapproval effort this year, which in March became a law abolishing the FCC’s ISP privacy rules and preventing similar ones from being reinstated absent congressional authorization, which spurred backlash for various congressional Republicans. Her home district features a billboard accusing her of voting to let ISPs “sell your web history without your permission.” There were similar attacks in the home state of Sen. Jeff Flake, R-Ariz., who led the Senate version (see 1705050027). Free Press is pleased Blackburn “may have finally heard the voices of the thousands of Americans that spoke out in town halls and called their members of Congress, outraged over almost all of the Republican members voting for nullification of the FCC's common-sense broadband privacy rules,” Laroia said. After enactment of the CRA measure, no formal privacy rules were in effect. The FCC still has enforcement jurisdiction under Communications Act Section 222 but no specific regulations in place.

The recent rash of state privacy laws following the CRA vote may have been the “genesis” for Blackburn’s bill and its pre-emption of those laws would “generally be a good thing,” said R Street's Struble. That type of pre-emption would help with industry compliance, he said. There’s “no need to reinvent the wheel here: The FCC still has a statutory mandate to protect internet users' privacy, and pre-empting state efforts to fill the void left by the CRA seems premature at this stage,” Laroia said.

“Opt in on that PII [personally identifiable information],” Blackburn said Friday. She believes in “one regulator in the privacy space,” the FTC, Blackburn said. “It makes sense to leave privacy regulation with them. I also have held the belief that what you needed to do was allow people the opportunity to opt in on their private information if there were things they wanted to have shared. And some people do.”

Senate Commerce Committee Chairman John Thune, R-S.D., “is open to discussing privacy protections through the negotiation of open internet legislation,” a spokesman said. “He welcomes member input but has no plans to introduce separate legislation.” Spokespeople for Flake didn't comment.