Key Takeaways
- Maine’s LD 1822 is one of the most comprehensive state-level data privacy bills in the country, introducing data minimization requirements, protections for sensitive data, and a ban on unnecessary biometric collection.
- The bill shifts the burden of data protection from consumers to companies and requires them to justify what they collect, rather than relying on individuals to opt out, resulting in ongoing tensions with business interests concerned about potential limitations on their competitive reach.
- Without federal data privacy protections, states are increasingly filling a regulatory void.
What Happened
The Maine State Senate passed legislation (LD 1822) on March 5th of this year to help protect personal data by limiting sweeping digital surveillance. The inspiration for this legislation comes from the growing acknowledgement that private companies regularly collect massive amounts of personal data about people’s everyday activities and then sell that information to anyone willing to pay, including the government.
This bill would limit data collection and storage through data minimization requirements, which restrict companies to collecting only the information necessary to provide a good or service, ensure that technology is not used to discriminate through automated decisions, and safeguard biometrics by prohibiting their collection unless necessary to provide a good or service. The introduction of this policy is one of the most comprehensive of its kind to come out of state legislatures, “encouraging privacy- protective business practices.”
Privacy and Governance Concerns
The restriction the bill places on companies to collect only the information needed to provide a specific service or product places the burden on the company, rather than on the consumer, to opt out. The act would also ban the use of “sensitive data” like race, ethnicity, and health information, as well as any data belonging to minors.
Proponents of the bill argue that it is needed to close the current regulatory gap that leaves the sensitive data of millions of people at risk. The policy director of the ACLU of Maine argues that this conversation around data privacy is about autonomy, and that personal information shouldn’t just be sold to the highest bidder, especially when it can be used to track people’s locations relating to protests, political rallies, places of worship, etc. He is pushing that leaving the policy landscape as-is “threatens our most deeply held freedoms as Americans.” However, many of Maine’s business groups oppose the bill, stating that it complicates companies’ efforts to reach new customers and strips away competitive advantages in marketing.
Why It Matters / Policy Considerations
As frustration grows over the federal government’s inaction on putting guardrails in place for data privacy, more and more states are stepping up to have a stronger say in controlling where their personal data goes. Companies face little to no meaningful restrictions on the amount and type of information they can collect or the ways they can profit from it. Without federal regulation, state-level efforts like Maine’s Data Privacy and Protection Act may represent the most meaningful check on corporate data practices that are focused on profit rather than safety.
