AB 807

This bill generally prohibits a broadband Internet access service provider

(“provider”) from using, disclosing, or permitting access to a customer's proprietary

information unless the customer grants approval to the provider to use, disclose, or

permit access to that information. The bill defines “customer” as 1) a current or

former subscriber to broadband Internet access service who resides in this state; or

2) a person who resides in this state and uses broadband Internet access service that

is provided under an agreement between a current or former subscriber who resides

in this state and a provider. With certain exceptions described below, the bill requires

different types of approval for sensitive and nonsensitive customer proprietary

information. For sensitive information, the customer must grant express,

affirmative consent after receiving a notification that is required to accompany a

provider's request to use, disclose, or permit access to that information. Sensitive

information includes the following: 1) financial information; 2) health information;

3) information pertaining to a child; 4) a social security number; 5) precise

geolocation information; 6) content of communications; and 7) web browsing history

and smart phone or tablet computer application usage history.

For nonsensitive information, the customer must object to the provider's

request to use, disclose, or permit access to that information after the customer

receives a notification that is required to accompany the provider's request. Under

the bill, nonsensitive information is the following information that is not sensitive

information: 1) information that is linked or reasonably able to be linked to an

individual or a device; or 2) information that identifies an individual and that relates

to the quantity, technical configuration, type, destination, location, or amount of use

of broadband Internet access service.

Also, under the bill, a provider is prohibited from refusing to provide broadband

Internet access service because a customer or prospective customer does not grant

approval to the provider to use, disclose, or permit access to proprietary information.

The bill allows a provider to use, disclose, or permit access to both sensitive and

nonsensitive customer proprietary information without receiving the customer's

approval only for the following purposes: 1) to provide the broadband Internet access

service from which the information is derived; 2) to initiate, render, bill, or collect for

broadband Internet access service; 3) to protect the rights or property of a provider

or to protect users against fraudulent, abusive, or unlawful use of the service; 4) to

provide certain services to a customer during a real-time interaction with the

provider initiated by the customer; 5) to provide location information or nonsensitive

information in emergencies; or 6) as otherwise required or authorized by law.

Under the bill, when a provider requests approval to use, disclose, or permit

access to a customer's proprietary information, the provider's request must

accompany a notice that includes a specific description of the following: 1) the types

of customer proprietary information that the provider will collect from providing