Case Summary and Outcome

The U.S. District Court of Maine denied internet service providers’ (ISP) motion for judgment challenging Maine’s broadband privacy law for violation of federal laws and on grounds of First Amendment and pre-emption claims.  The plaintiffs had alleged that the privacy clause conflicted with the federal law and placed unduly burdensome restrictions on their protected speech, apart from being an unconstitutional exercise of state power. In dismissing the application of the ISPs,  the Court reasoned that commercial speech regulations such as the Privacy Statute were subjected to a lesser degree of First Amendment protection, as against the strict scrutiny criteria proposed by the plaintiffs. Since there was no satisfying material on record to prove that the Privacy Statute burdened ISPs’ protected speech by restricting how they used information obtained from consumers, or that the legislation was preempted by federal laws, the Court dismissed the plaintiffs’ case on all counts and granted the defendant’s cross motion for judgment on pleadings.

Facts

The plaintiffs – ACA Connects, CTIA, NCTA and USTelecom – are trade associations representing independent operators providing communication services. On June 6, 2019, Maine enacted an information privacy protection statute applicable to Internet Service Providers (ISPs), referred to as an Act to Protect the Privacy of Online Customer Information (‘Privacy Statute’).

Effective July 1, 2020, the law intended to reinstate the rules from an erstwhile repealed law – Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, 31 FCC Rcd. 13911 (2016) (“ISP Privacy Order”). Notably, the ISP Privacy Order, repealed by Congress in 2017, required ISPs to obtain ‘opt-in’ consent to use, disclose or permit access to “sensitive” customer proprietary information as well as to permit consumers to “opt out” of letting the ISPs use, disclose, or permit access to non-sensitive customer proprietary information. The prohibition on ISPs to use, disclose, sell or permit access to consumer’s personal information unless opted-in was replicated in the Privacy Statute.

Under the new privacy regime, ISPs were restricted from using information pertaining to a customer regardless of the sensitivity of data, if an “express, affirmative consent” was not obtained from the customer. ISPs were also prohibited from offering discounts, rewards in loyalty programs, marketing offers for other products and services, or other cost-saving benefits in exchange for their agreement to opt in.

It is important to underscore, however, that the Privacy Statute’s opt-in regime was subject to certain exceptions, such as the fact that ISPs were allowed to advertise or market the provider’s communications-related services to the customer without securing the opt-in consent. ISPs were also required to provide customer’s geolocation information to public safety officials for emergency purposes (but prohibited from using the same information to make public service announcements, minus opt-in consent).

Because of allegedly burdensome restrictions imposed by the Privacy Statute, the plaintiffs filed a suit to prevent the law from being enforced. Summarily, their arguments were based on five counts. First, the Statute burdened ISPs’ protected speech by restricting how they used information to engage in a wide variety of beneficial, pro-consumer speech (such as effective communication with customers, facilitating targeted public service announcements, etc.). Second, because the Privacy Statute defined “personally identifying information” vaguely, it left persons of average intelligence unclear about the scope of the Statute’s restrictions and was, thus, void. Third and fourth, since the Privacy Statute conflicted with two federal laws [namely, Congress’s Joint Resolution overturning FCC’s 2016 ISP Privacy Order pursuant to Congressional Review Act; and FCC’s Restoring Internet Freedom Order (RIF Order)], it was an unconstitutional exercise of state’s power. Finally, the plaintiffs also claimed that the Privacy Statute conflicted with, and was pre-empted by, the federal law requiring disclosure of information (that is, requiring ISPs to disclose certain customer information that the Privacy Statute subjects to individual customer consent, thus making compliance both impossible and void).

Decision Overview

Judge Lance Walker delivered the opinion of the United States District Court of Maine. The principal question before the District Court was whether the Privacy Statute was preempted or subject to voidability on account of several US federal laws warranting against the obligations specified in it. A threshold question also arose here, namely whether Maine’s law should be subject to heightened First Amendment scrutiny [strict vs intermediate, as laid down in Sorrell v. IMS Health Inc. (2011) and Central Hudson Gas & Elec. Corp. v. Pub. Serv. Comm’n of New York (1980) respectively].

Arguing primarily on the doctrine of preemption derived from the Supremacy Clause (which nullifies state laws that are contrary to federal laws), the plaintiffs had alleged that the Privacy Statute was void because it interfered with the execution of the Congressional Review Act. They argued that since Congress repealed the FCC’s 2016 ISP Privacy Order under the Congressional Review Act by means of a Joint Resolution, Maine’s Privacy Statute had the effect of “undoing” the act of Congress and undermined federal objectives that Congress sought to promote through the repeal of the Joint Resolution. By virtue of count four, the  plaintiffs also alleged that the Privacy Statute conflicted with the RIF Order (where it was determined by FCC that consumer’s privacy interests are best protected by pairing mandatory privacy disclosures with FTC enforcement of those orders). More specifically, without the FCC’s exception for non-sensitive information or non-identifiable information, the Privacy Statute reimposed highly prescriptive regulations as applicable through the ISP Privacy Order for broadband internet access services [p. 5].

The defendant contested these submissions in absolute terms by arguing that the Joint Resolution only expressed Congress’ disapproval of the rule submitted by the FCC without giving it any force or effect. Since it was not possible to discern the intent of the Congress, it was unreasonable to claim that the Joint Resolution had a preemptive effect. Furthermore, the defendant also claimed that the RIF Order – where the FCC reinterpreted broadband internet as an information service rather than a telecommunication service thereby placing it outside of FCC’s regulatory authority – did not preempt Maine’s privacy laws as the FCC (and therefore, its RIF Order) did not possess adequate regulatory authority to preempt it.

While agreeing with the plaintiffs that the Joint Resolution vacating the ISP Privacy Order carried the preemptive effect of federal laws, the Court decided that it nevertheless had little effect, and only to the extent of returning to the status quo ante as if such rule had never taken effect [p. 6]. Consequently, by virtue of the Joint Resolution, the privacy rules that were repealed by the ISP Privacy Order were brought back in force and therefore, Maine had the freedom to protect privacy of its citizens by legislating it with the authority it had before the ISP Privacy Order went into effect.

In arriving at this conclusion, the Court relied on the Supreme Court’s interpretation in English v. General Elec. Co. and noted that preemption cannot be implied in the absence of an actual conflict [the Court explained what constituted “actual conflict” with an instance – if a local authority denies a building permit which is expressly approved by the federal commission based on the same evidence, it is preemption]. In view of the Court, the presumption against implied federal preemption of state law was strongest in cases of privacy regulation, which was violated by the plaintiffs in this case. All other evidences by the plaintiffs (such as congressional testimonies and statements from lawmakers which underscored congressional intent in preventing imposition of ISP-only rules) were perceived by the Court as an “attempt to build a federal scheme” [p. 7]. In effect, the Court concluded that the nullification of the ISP Privacy Order did not foreclose or preempt Maine’s Privacy Statute.

On the RIF Order itself, the Court countered plaintiffs’ reasoning on its preemptive effect by highlighting that there was no conflict between the FCC’s abdication of authority over ISPs in favor of the FTC and Maine’s decision to impose privacy protections at the state level.

Having catered to arguments on the grounds of preemption, the Court then moved to the plaintiffs’ First Amendment claim – which argued against the Privacy Statute as it burdened the ISPs’ protected speech by restricting how they used information obtained from consumers. Categorizing it as an argument which “shot-for-the-moon”, the Court rebuffed the plaintiffs’ demand for a strict-scrutiny standard (which the plaintiffs had claimed because the Privacy Statute imposed a burden based on both the content of the speech and the identity of the speaker). Rather, it found it more fitting to accept the defendant’s intermediate-scrutiny standard for a number of reasons.

For one, commercial speech (that is, expressions related solely to the economic interests of the speaker and its audience) is ordinarily accorded a lesser degree of protection than other forms of expressions protected by the Constitution. The plaintiffs had claimed that commercial speech, their marketing of consumer data, was protected with a heightened scrutiny under the First Amendment on account of the Supreme Court’s analysis in Sorrell which held that the creation and dissemination of information is speech protected under the First Amendment. Even though the Supreme Court in 1980 had laid down in Central Hudson that commercial speech is accorded First Amendment protection only when the tripartite test is satisfied (government interest is substantial, regulation advances that interest and the restriction is limited to serving that interest), the plaintiffs had argued that Sorrell supplanted Central Hudson and augured a new regime of strict scrutiny in commercial speech regulation. However, the Court rejected this analysis. It relied on several affirmations by other Circuits of the fact that intermediate scrutiny governed the constitutional review of commercial speech regulations.

Once the Court proceeded to analyse Maine’s Privacy Statute’s constitutionality under Central Hudson, it became easier for it to decide that the plaintiffs’ two arguments did not pass the tripartite test laid down by the Supreme Court in that case. It claimed that there was simply no material on record to evaluate the relative strengths of the arguments on each side, especially when considering a motion for judgement to assess whether Maine had a substantial interest in regulating privacy or if the government regulation was the least restrictive means of advancing its asserted interests. Consequently, the Court deemed it fit not to award final judgment on the basis of First Amendment claim.

Finally, the Court dismissed the planitiffs’ second claim that the Privacy Statute was void for vagueness on account of its unclear geographic scope and nebulous definition of “customer personal information”. It applied a less strict vagueness test to the Privacy Statute as it dealt with commercial regulation which does not carry a criminal penalty. However, even still, plaintiffs were unable to establish their case. Since the legislation applied to a clearly-defined set of businesses and applied to ISPs operating in Maine and serving customers physically located in Maine, the Court considered the Statute left no room for arbitrariness from a geographic perspective. Furthermore, it also provided a fair warning of what the term “customer personal information” contained – since it exactly mirrored the ISP Privacy Order’s definition of “sensitive customer PI” with very few new categories of information added in its opt-in protection – it identified “customer personal information” in straight forward terms. Besides, it wasn’t clear to the Court how an ill-defined opt-in opt-out regime would chill First Amendment rights as the plaintiffs claimed for example, how it
might chill them from preparing particular marketing materials for sale to customers.

Based on the claims above, the plaintiffs’ motion for judgment based on pleadings was rejected by the Court.