Privacy & Information Security Law Blog

On October 27, 2016, the Federal Communications Commission (“FCC”) will vote on whether to finalize proposed rules (the "Proposed Rules”) concerning new privacy restrictions for Internet Service Providers (“ISPs”). The Proposed Rules, which revise previous versions introduced earlier this year, would require customers’ explicit (or “opt-in”) consent before an ISP can use or share a customer’s personal data, including web browsing and app usage history, geolocation data, children’s information, health information, financial information, email and other message contents and Social Security numbers.

In addition to the opt-in requirement, the Proposed Rules address whether ISPs may charge more for their services, or refuse service altogether, if a customer does not consent to the use and sharing of his or her personal information. The Proposed Rules allow an ISP to offer a discount or incentive to a customer who consents, but forbid the ISP from refusing to provide service to a customer who withholds consent. Under the Proposed Rules, the FCC will evaluate discounts and incentives exchanged for customer’s personal data on a case-by-case basis. Additionally, the Proposed Rules require ISPs to inform customers of how their data will be collected, for what purposes it might be used and the entities with whom it is shared. In the event of a breach, the ISP would be required to notify the FCC within seven business days of the breach and customers within 30 days. Breaches affecting more than 5,000 customers would also require notification to the FBI and U.S. Secret Service within seven business days.

In a blog post about the Proposed Rules, FCC Chairman Tom Wheeler noted that they would not apply to websites or apps subject to FTC jurisdiction, even if those websites or apps are owned by an ISP that is subject to the Proposed Rules. Chairman Wheeler wrote, “It’s also important to note that the proposed rules would not prohibit ISPs from using or sharing their customers’ information – they would simply require ISPs to put their customers in the driver’s seat when it comes to those decisions.”