SB 118-DISCLOSURE OF CUSTOMER INFORMATION   3:48:45 PM CHAIR MEYER announced the consideration of Senate Bill 118 (SB 118). 3:48:50 PM SENATOR BILL WIELECHOWSKI, Alaska State Legislature, Juneau, Alaska, sponsor of SB 118, provided an overview as follows: This bill stems from our constitutional obligation in Article I, Section 22, the constitution says, "The right of the people to privacy is recognized and shall not be infringed, the Legislature shall implement this by statute." This statute is seeking to protect personal information that internet websites collect about us on a daily basis. The internet has fundamentally changed our world but virtually every website you click on, every product that you buy, every medical illness you research, every political article you research, every religious site you visit is being recorded, collected and sold. There is little to stop data-brokers from using the information they gather from us in whatever way they please. There is a gentleman named Jeff Chester, he's a privacy advocate and director for the Center for Digital Democracy (CDD), and I think he summed it up very well, he said, "Because there are no online privacy laws in the United States, there's no stop sign, there's no slow sign, there's no crossing guard, the message is anything goes." We've seen that in recent months with the Facebook-Cambridge Analytical issue and the other things we are hearing about massive collections of information on the American citizens. Websites use up to a hundred tracking tools to collect personal information. Americans have lost jobs and have been denied mortgages when data-brokers have shared incorrect information and scammers use a data-brokerage list to target vulnerable populations like seniors. Many mobile apps show location information and phone numbers. Women and children have been hurt or killed when location data was shared with abusers. This bill seeks to make the internet more transparent, it simply requires that website owners and online services tell people what personal information they are collecting and who it is being provided to. I would point out that similar legislation has passed the Illinois state senate and my staff checked was in third reading in their state house, today. Canada and the United Kingdom both have laws that allow consumers to find out what data is being shared about them. The European Union passed regulations in 2016 which goes into effect next month which are similar to this bill and actually goes further than this bill because they have what they call "Right to Be Forgotten," which is the right for the consumer to ask websites and the data-brokerage firms to actually delete the data that they have collected on them; we are not going quite that far but this would put us among the leaders in the nation in protecting Alaskans' internet privacy. 3:52:34 PM ELISE SORUM-BIRK, Staff, Senator Wielechowski, Alaska State Legislature, Juneau, Alaska, provided a sectional analysis on SB 118 as follows: Section 1:  Titles the legislation, the "Right to Know Act." Section 2:  Enumerates legislative findings relating to Alaska's constitutional right of privacy and detailing the importance of transparency and security for consumers, and business practices related to personal digital data. Section 3:  AS 45.48.800, requires the owner of a commercial internet website or commercial online service to notify customers of their information sharing practices, it outlines what information the owner must include in the notification. [AS 45.48.810] requires the owner of a commercial internet website or commercial online service, if requested by the customer, to provide the customer any information shared about them in the previous 12 months and outlines which information the owner must provide to the customer. [AS 45.48.820] identifies the categories of personal information that the owner needs to disclose. [AS 45.48.830] outlines different exceptions to the disclosure requirement. [AS 45.48.840] allows the customer to recover damages if an owner violates the right to know. [AS 45.48.850] outlines how the right to know interacts with existing privacy regulations on the state and federal level. The last section in section 3 provides definitions. Section 4:  Establishes that this is only applicable to data collected after the effective date. 3:55:14 PM SENATOR COGHILL asked if SB 118 was modeled after some "model legislation" or from states that were considering internet privacy. He explained that he was thinking about the difference between Alaska and other states on constitutional privacy. SENATOR WIELECHOWSKI replied that he did not know if there was model legislation regarding internet privacy but noted that SB 118 is like what is being done in Illinois. 3:55:35 PM SENATOR GIESSEL joined the committee meeting. SENATOR COGHILL addressed the bill's application and asked if he has heard of any struggles on applying; for example, the need for a regulatory agency, how it would be housed in Alaska and how an individual would contact the agency. SENATOR WIELECHOWSKI answered as follows: We are not contemplating at this point a regulatory agency that would oversee this. We are contemplating that individuals would have a cause of action, a legal right to sue, it's in page 5, lines 26-30. So, if there was a violation there would be a monetary penalty of $5,000 or whatever the actual damage where, whatever is greater plus attorney's fees. It's not something that we would anticipate would have a fiscal note. It's not something that we would anticipate the government would be overseeing and enforcing, but it would have that private right to action which we think would lead to enforcement. SENATOR COGHILL surmised that the civil issue would have to be taken to court. SENATOR WIELECHOWSKI answered yes. SENATOR COGHILL remarked that the scenario Senator Wielechowski described would be a "David versus Goliath" situation. 3:57:41 PM SENATOR WIELECHOWSKI concurred and noted that his office printed out terms of service for companies like Google. He pointed out that Google does not tell customers exactly what they do and speculated what they would say as follows: Well, we may sell your data, we may take it, we are not going to tell you exactly what we are going to take, we are not going to tell you who we are going to provide this to, but we may go ahead and do it. So, it would require more specificity. SENATOR COGHILL commented that he would ponder Senator Wielechowski's reply. SENATOR WILSON noted Senator Coghill's enforcement comments and asked if the bill is strictly for Alaska-based internet transactions versus a federal issue with all internet transactions. MS. SORUM-BIRK replied as follows: This is specific to commercial internet websites or commercial online services, that would be any commercial internet website or commercial online service. So, a commercial online service would be something that you would subscribe to like Netflix or Amazon Prime. She summarized that the legislation was going where things were heading anyway because the internet was an international medium. She explained that websites operating in Europe will have to provide a lot of the information required under the new European Union regulations. She said the bill's sponsor wants to make sure that Alaskans have privacy protection and the ability to know what data is being stored and collected. 4:00:02 PM SENATOR WILSON remarked that he questioned enforcement for companies in other countries. SENATOR WIELECHOWSKI responded as follows: There may be companies that you can't get ahold of, there may be websites where that is true, that would be up to the person who wants to enforce that, the lawyers. I think if you come in to the State of Alaska with your website you are subjecting yourself to the jurisdiction of the State of Alaska, but I do think it is important to remember that this is something that is going to be done in the European Union, something that is going to be done in Canada, very similar, something is already being done in the United Kingdom. I think the vast majority of the websites that are out there are probably the ones that people go to on a regular basis are large, are things like CNN, MSNBC, Fox News, Yahoo, they are Unites States based. If there is a website that is collecting your information in some country that we don't have any sort of treaties with, yes, you probably aren't going to be able to sue them, that is probably accurate. CHAIR MEYER asked if the legislation should be done on the federal level rather than on the state level. SENATOR WIELECHOWSKI answered yes. He conceded that the legislation is evolving at the state level because it is not happening at the federal level. He opined that Alaska has a very strong and explicit right to privacy with an obligation for enforcement by statute. SENATOR COGHILL agreed with Senator Wielechowski's intent and opined that if enough states were to pass similar legislation a combined effort for a class action was possible if big industry was not to respond. He said he saw the value of putting the proposed legislation into statute to show the industry that they must respect the consumers. He conceded that he had not looked at the language in the bill and would have to review and ponder. He asked Senator Wielechowski if he concurred with his remarks. 4:03:48 PM SENATOR WIELECHOWSKI answered absolutely. He asserted that the bill would be groundbreaking legislation that has not passed in any other state; however, he noted that Illinois would probably pass similar legislation within the next few days. He continued as follows: It's one of those things where if you pass it in one state, I think from my understanding how this works it will not be hard for these companies to comply with. The ones that collect this data, the data-brokers, I think are pretty easily going to provide this information; but absolutely, if one state passes this I think you will see a ripple effect, a domino effect all across the other states because if you've got to do it for one state, you are setting up that infrastructure, you are really going to be able to provide it for every other state in the country. SENATOR COGHILL noted that Senator Wielechowski quoted a privacy advocate and asked if the individual has been used in other places and if he can be approached as a resource. He inquired if the issue was an international discussion. 4:05:12 PM SENATOR WIELECHOWSKI replied that the privacy advocate was quoted from a National Public Radio (NPR) article. He reiterated that the individual was an advocate for the Center for Digital Democracy. He noted that a number of people and organizations were concerned about privacy and added that a lot of libertarian organizations were concerned as well. He continued as follows: This is something that people all across the country when you start talking about getting into their private information and selling it and accessing all sorts of things, that concerns people and there are definitely organizations; but, we can reach out to this person if you'd like and try to put him in touch with you or the committee. SENATOR COGHILL asked that contact with the individual would be appreciated at least for himself or maybe the committee as well. He noted that he has not reviewed the research that Senator Wielechowski submitted with his legislation but added that the topic may be new but the subject is not. CHAIR MEYER asked that Senator Wielechowski provide the information to his office for distribution to committee members. He asked if the state runs the risk of companies bypassing Alaska if the state is the only one that has the privacy law. SENATOR WIELECHOWSKI answered that he did not think so and questioned whether a company could block a specific state. He opined that the information required in the legislation would not be difficult for companies to provide. He said like Senator Coghill said, the intent is to start a domino effect with a good law that other states can look at. He conceded that a law at the federal level would be ideal, but legislation just has not happened yet. CHAIR MEYER noted that Senator Wielechowski had someone scheduled to testify on SB 118. MS. SORUM-BIRK replied that the testifier was not available, but a written testimony was submitted. CHAIR MEYER announced that public testimony would be left open. 4:08:25 PM CHAIR MEYER held HB 118 in committee.