RE: Letter in Opposition to HI HB 2572 - PDF Document

Presentation Transcript

  1. February 24, 2020 Rep. Chris Lee Chair of the Committee on Judiciary Hawaii House of Representatives Hawaii State Capitol, Room 433 415 South Beretania Street Honolulu, HI 96813 Rep. Roy M. Takumi Chair of the Committee on Consumer Protection & Commerce Hawaii House of Representatives Hawaii State Capitol, Room 320 415 South Beretania Street Honolulu, HI 96813 RE: Letter in Opposition to HI HB 2572 Dear Chair Lee and Chair Takumi: As the nation’s leading advertising and marketing trade associations, we collectively represent thousands of companies in Hawaii and across the country, from small businesses to household brands, advertising agencies, and technology providers. Our combined membership includes more than 2,500 companies, is responsible for more than 85 percent of the U.S. advertising spend and drives more than 80 percent of our nation’s digital advertising spend. We and the companies we represent strongly believe consumers deserve meaningful privacy protections supported by reasonable government policies. While we fully support the legislature’s intent to provide Hawaiians with strong privacy protections, HB 2572 contains provisions that could harm consumers’ ability to access products and services and exercise choice in the marketplace. The bill also contains particularly onerous terms surrounding digital data that could upend the Internet advertising ecosystem as we know it, disrupting consumers’ online experience. Moreover, HB 2572 takes an approach that is highly inconsistent with other state privacy laws and privacy bills that are progressing through various state legislatures, while failing to develop a system that will work well for consumers or enhance a fair and competitive marketplace. In certain respects, the bill attempts to adopt definitions and structural elements of the California Consumer Privacy Act (“CCPA”). However, the CCPA is an incomplete statute, as the regulations implementing its terms have not yet been finalized. Furthermore, the CCPA contains various internal inconsistencies and ambiguities, and as such it should not be used as a basis for legislation in other states. For these reasons, we strongly oppose Hawaii’s HB 2572.1 I. The Data-Driven and Ad-Supported Online Ecosystem Benefits Consumers and Fuels Economic Growth Today, the U.S. economy is increasingly fueled by the free flow of data. One driving force in this ecosystem is data-driven advertising. Advertising has helped power the growth of the Internet for decades by delivering innovative tools and services for consumers and businesses to connect and communicate. Data-driven advertising supports and subsidizes the content and services consumers expect 1 HB 2572, 30thLegislature, Reg. Sess. (Haw. 2020) (hereinafter “HB 2572”).

  2. and rely on, including video, news, music, and more. Data-driven advertising allows consumers to access these resources at little or no cost to them, and it has created an environment where small publishers and start-up companies can enter the marketplace to compete against the Internet’s largest players. As a result of this advertising-based model, U.S. businesses of all sizes have been able to grow online and deliver widespread consumer and economic benefits. According to a March 2017 study entitled Economic Value of the Advertising-Supported Internet Ecosystem, which was conducted for the IAB by Harvard Business School Professor John Deighton, in 2016 the U.S. ad-supported Internet created 10.4 million jobs.2 Calculating against those figures, the interactive marketing industry contributed $1.121 trillion to the U.S. economy in 2016, doubling the 2012 figure and accounting for 6% of U.S. gross domestic product.3 Consumers, across income levels and geography, embrace the ad-supported Internet and use it to create value in all areas of life, whether through e-commerce, education, free access to valuable content, or the ability to create their own platforms to reach millions of other Internet users. Consumers are increasingly aware that the data collected about their interactions on the web, in mobile applications, and in-store are used to create an enhanced and tailored experience. Importantly, research demonstrates that consumers are generally not reluctant to participate online due to data-driven advertising and marketing practices. Indeed, as the Federal Trade Commission noted in its recent comments to the National Telecommunications and Information Administration, if a subscription-based model replaced the ad- based model, many consumers likely would not be able to afford access to, or would be reluctant to utilize, all of the information, products, and services they rely on today and that will become available in the future.4 It is in this spirit–preserving the ad supported digital and offline media marketplace while helping to design appropriate privacy safeguards–that we provide these comments. II. The Bill’s Definition of Personal Information for Breach Notification Purposes Extends Beyond Any State Law HB 2572 would greatly expand the definition of “personal information” subject to the state’s data breach notification law by including identifiers in its scope.5 Rendering such identifiers subject to the state’s breach notification statute represents a massive expansion of breach notification requirements far beyond what any other state has done before. Even the CCPA does not include information used to identify individuals across technology platforms in its scope of information subject to the data breach enforcement provisions in the law.6 Expanding Hawaii’s definition of “personal information” for data breach notification in this way would make Hawaii be out of step with other states and cause a vastly increased number of notices sent to consumers, thereby unnecessarily raising consumer alarm without providing any additional privacy protections. The definition of “personal information” for the purposes of Hawaii’s breach notification statute should be comprised of data elements that could enable identity theft if misappropriated. Identifiers across technologies do not pose the same risks to consumers as other data elements that should rightly be 2 John Deighton, Economic Value of the Advertising-Supported Internet Ecosystem (2017) https://www.iab.com/wp- content/uploads/2017/03/Economic-Value-Study-2017-FINAL2.pdf. 3Id. 4 Federal Trade Commission, In re Developing the Administration’s Approach to Consumer Privacy, 15 (Nov. 13, 2018) https://www.ftc.gov/system/files/documents/advocacy_documents/ftc-staff-comment-ntia-developing- administrations-approach-consumer-privacy/p195400_ftc_comment_to_ntia_112018.pdf. 5 HB 2572, Part IV, § 4. 6 Cal. Civ. Code § 1798.150(a)(1). 2

  3. included in the scope of breach notification requirements. We therefore recommend that you not alter the definition of personal information for breach notification purposes. III. The Bill Would Severely Impede Internet Commerce The bill would also require opt-in consent for any sale of geolocation information and “internet browser information,” defined as “information from a person’s use of the internet,” including web browsing history, application usage history, origin and destination IP addresses, device identifiers, and the content of communications comprising Internet activity.7 This right to opt in to personal information sale is far different from other states’ approaches to personal information in the context of consumer privacy laws. If left uncorrected, HB 2752 would undermine the ad-supported Internet, crippling the online marketplace and resulting in a fractured experience for Hawaiian consumes. Requiring opt-in consent for the sale of geolocation information and internet browser information would fundamentally change Hawaiians’ ability to access products and services they enjoy and expect through the Internet. Moreover, this approach is far out of step with other states’ consumer privacy proposals, such as the CCPA and others that impose an opt out regime to data sales rather than an opt in regime. HB 2572 defines “sale” broadly as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.”8 As a result, any transfer of consumer data is likely a “sale” under the bill, which provides no customary exemptions for service providers or other entities that businesses rely on for various processing activities, and which a consumer would reasonably expect to receive personal information. Additionally, consumers would be inundated with requests for their consent to transfer internet browser information, thereby overwhelming them with a variety of notices and requests and causing significant consumer frustration. Transfers of data over the Internet enable modern digital advertising, which subsidizes and supports the broader economy and helps to expose consumers to products, services, and offerings they want to receive. In a survey commissioned by the Digital Advertising Alliance, 90% of consumers stated that free content was important to the overall value of the Internet and 85% surveyed stated they prefer the existing ad-supported model, where most content is free, rather than a non-ad supported Internet where consumers must pay for most content.9 The survey also found that consumers value the ad- supported content and services at almost $1,200 a year.10 The opt-in requirements of HB 2572 could destroy this model, which consumers have expressed that they value and would not want to see replaced. We therefore respectfully ask you to remove the opt in consent requirements for “sales” of geolocation information and internet browser information. IV. The Bill Could Cause Companies to Stop Offering Loyalty Programs in Hawaii The bill states that a business may charge a consumer a different price or rate or provide a different level or quality of goods or services if that difference is “reasonably related to the value provided to the business by the consumer’s personal information.” 11 The bill also states that a business may offer a different price, rate, level, or quality of goods or services to a consumer if the difference is 7 HB 2572, Part IV, § 4. 8Id. at Part III, § -1. 9 Zogby Analytics, Public Opinion Survey on Value of the Ad-Supported Internet (May 2016). 10 Digital Advertising Alliance, Zogby Poll: Americans Say Free, Ad-Supported Online Services Worth $1,200/Year; 85% Prefer Ad-Supported Internet to Paid, PR Newswire (May 11, 2016). 11 HB 2572, Part III, §§ -13(b), -26(b). 3

  4. “directly related to the value provided to the business by the consumer’s personal information.”12 These two requirements pose different standards, which will leave entities confused as to which one applies. Furthermore, these requirements are extremely ambiguous; business confusion regarding how to operationalize these requirements could cause many entities to forego offering loyalty programs in the state. Hawaiians greatly benefit from loyalty and rewards programs and the price differences and discounts they receive for participating in those programs. The viability of loyalty programs is based on consumers’ participation in the aggregate. Consumer data powers loyalty programs and makes them worth it for the businesses that offer these programs. HB 2572’s terms limiting different price or service differences could impact businesses in their efforts to provide consumers with the loyalty and rewards programs they enjoy and expect. The bill does not provide any needed guidance regarding how a business may justify that a price or service difference is reasonably or directly related to the value of a consumer’s data. The bill also does not address how businesses may reasonably quantify nontangible value they receive from offering price or service differences through loyalty programs in terms of fostering consumer loyalty and goodwill. The lack of clarity on this issue could cause many businesses to decline to continue offering loyalty programs to Hawaiian residents. For the foregoing reasons, we respectfully ask you to remove the unreasonable financial incentive requirements in the bill. In particular, we urge you to clarify or remove the provisions requiring businesses to ensure that financial incentives offered through loyalty programs are reasonably related or directly related to the value of the consumer’s data. These requirements are particularly unclear and therefore could be impossible to implement. Without additional clarity, HB 2572 could inhibit or drastically reduce the availability of loyalty programs offered in Hawaii. V. The Bill’s Data Broker Requirements Are Broadly Applicable and Would Burden the State Government The bill proposes the creation of a data broker registry and provides consumers with rights to opt out from data brokers’ “sale” of personal information.13However, the term “data broker” is defined so broadly that it could encompass virtually any business that maintains data about Hawaiian consumers. “Data broker” under the bill means “a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the personal information of a consumer with whom the business does not have a direct relationship.”Combined with the definition of “sale,” a vast number of Hawaiian entities will be swept up in the scope of this definition and thus be subject to registration and other requirements. It was likely not the intent of the legislature to encompass virtually any entity doing business in Hawaii within the scope of the data broker requirements. We therefore encourage you to closely examine and limit the breadth of this definition. Additionally, the data broker registration requirement provides little tangible protection for consumers. The disclosures required of data brokers pursuant to the bill are disclosures those data brokers already must make in privacy notices that are available to the general public. Obligating data brokers to provide a separate annual statement in regard to similar information could lead to confusing and outdated information in the market. Moreover, a data broker registry would create enormous new responsibilities for the Hawaiian government at a time when it is already considering taking on additional enforcement responsibilities in the context of passing omnibus privacy legislation. The data broker registration requirement in HB 2572 would add to these responsibilities by directing the office of consumer protection to create and manage a new registration system, complete with fee collection. This 12Id. at Part III, §§ -13(c), -26(c). 13Id. at Part III, §§ -21, -24. 4

  5. would be a significant undertaking at a time when the government is considering broadly expanding its other responsibilities. We encourage you to carefully consider these impacts and update the bill so it does not contain a registration requirement. * * * We and our members support Hawaii’s commitment to provide consumers with enhanced privacy protections. However, we believe HB 2572 takes an approach that will severely harm the online economy without providing helpful privacy protections for consumers. We therefore respectfully ask you to reconsider the bill and update it to remove the terms we discussed in this letter so Hawaiians can continue to receive products, services, and offerings they value and expect over the Internet. Thank you in advance for consideration of this letter. Sincerely, Dan Jaffe Alison Pepper Group EVP, Government Relations Senior Vice President Association of National Advertisers American Association of Advertising Agencies, 4A's 202-269-2359 202-355-4564 Christopher Oswald David Grimaldi SVP, Government Relations Executive Vice President, Public Policy Association of National Advertisers Interactive Advertising Bureau 202-269-2359 202-800-0771 David LeDuc Clark Rector Vice President, Public Policy Executive VP-Government Affairs Network Advertising Initiative American Advertising Federation 703-220-5943 202-898-0089 5