SB 233

This bill generally prohibits a broadband Internet access service provider

(“provider”) from using, disclosing, or permitting access to a customer's proprietary

information unless the customer grants approval to the provider to use, disclose, or

permit access to that information. The bill defines “customer” as 1) a current or

former subscriber to broadband Internet access service who resides in this state; or

2) a person who resides in this state and uses broadband Internet access service that

is provided under an agreement between a current or former subscriber who resides

in this state and a provider. With certain exceptions described below, the bill requires

different types of approval for sensitive and non-sensitive customer proprietary

information. For sensitive information, the customer must grant express,

affirmative consent after receiving a notification that is required to accompany a

provider's request to use, disclose, or permit access to that information. Sensitive

information includes the following: 1) financial information; 2) health information;

3) information pertaining to a child; 4) a social security number; 5) precise

geo-location information; 6) content of communications; and 7) web browsing history

and smart phone or tablet computer application usage history.

For non-sensitive information, the customer must object to the provider's

request to use, disclose, or permit access to that information after the customer

receives a notification that is required to accompany the provider's request. Under

the bill, non-sensitive information is the following information that is not sensitive

information: 1) information that is linked or reasonably able to be linked to an

individual or a device; or 2) information that identifies an individual and that relates

to the quantity, technical configuration, type, destination, location, or amount of use

of broadband Internet access service.

Also, under the bill, a provider is prohibited from refusing to provide broadband

Internet access service because a customer or prospective customer does not grant

approval to the provider to use, disclose, or permit access to proprietary information.

The bill allows a provider to use, disclose, or permit access to both sensitive and

non-sensitive customer proprietary information without receiving the customer's

approval only for the following purposes: 1) to provide the broadband Internet access

service from which the information is derived; 2) to initiate, render, bill, or collect for

broadband Internet access service; 3) to protect the rights or property of a provider

or to protect users against fraudulent, abusive, or unlawful use of the service; 4) to

provide certain services to a customer during a real-time interaction with the

provider initiated by the customer; 5) to provide location information or

non-sensitive information in emergencies; or 6) as otherwise required or authorized

by law.

Under the bill, when a provider requests approval to use, disclose, or permit

access to a customer's proprietary information, the provider's request must

accompany a notice that includes a specific description of the following: 1) the types