CSHB 273(L&C): "An Act relating to the disclosure of subscriber information by Internet service providers."
00CS FOR HOUSE BILL NO. 273(L&C) 01 "An Act relating to the disclosure of subscriber information by Internet service 02 providers." 03 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF ALASKA: 04 * Section 1. AS 45.50.471(b) is amended by adding a new paragraph to read: 05 (43) violating AS 45.50.479 (disclosure of information by Internet 06 service provider). 07 * Sec. 2. AS 45.50 is amended by adding a new section to read: 08 Sec. 45.50.479. Disclosure of information by Internet service provider. (a) 09 Except as provided in (b) of this section, an Internet service provider or an employee 10 of an Internet service provider may not disclose subscriber information about a 11 subscriber of the Internet service provider, or about another person who uses the 12 provided Internet access services, to a third party for any purpose, including marketing, 13 without the affirmative consent of the subscriber. 14 (b) An Internet service provider may disclose subscriber information without
01 the affirmative consent of the subscriber to an agency of the state, the federal 02 government, or a municipality for the investigation of a criminal offense or an 03 investigation related to a civil or administrative proceeding if, with regard to an 04 investigation 05 (1) of a criminal offense, a court, upon application of the agency 06 seeking information that is relevant to the investigation, has issued an order authorizing 07 the disclosure of the subscriber information without the affirmative consent of the 08 subscriber; or 09 (2) related to a civil or administrative proceeding, the agency makes 10 a written request to the Internet service provider to disclose the subscriber information. 11 (c) When an Internet service provider activates a new account for a subscriber, 12 the Internet service provider shall directly notify the subscriber that, except for certain 13 disclosures to governmental agencies, the Internet service provider or an employee of 14 an Internet service provider may not disclose subscriber information about a subscriber 15 of the Internet service provider, or about another person who uses the provided Internet 16 access services, to a third party for any purpose, including marketing, without the 17 affirmative consent of the subscriber. The Internet service provider may provide the 18 notification by mail or by electronic mail, addressed to the subscriber's address and 19 to the subscriber's personal attention. The notification must also include 20 (1) a statement whether or not the subscriber has given the subscriber's 21 affirmative consent to disclosure; 22 (2) if the subscriber has not given the subscriber's affirmative consent 23 to disclosure, a statement 24 (A) that the Internet service provider will not disclose subscriber 25 information about the subscriber, or about another person who uses the 26 provided Internet access services, to a third party for any purpose, including 27 marketing; and 28 (B) that the Internet service provider may disclose subscriber 29 information to an agency of the state, the federal government, or a municipality 30 for the investigation of a criminal offense or an investigation related to a civil 31 or administrative proceeding if, with regard to an investigation
01 (i) of a criminal offense, a court, upon application of the 02 agency seeking information that is relevant to the investigation, has 03 issued an order authorizing the disclosure of the subscriber information 04 without the affirmative consent of the subscriber; or 05 (ii) related to a civil or administrative proceeding, the 06 agency makes a written request to the Internet service provider to 07 disclose the subscriber information; 08 (3) if the subscriber has given the subscriber's affirmative consent to 09 disclosure, 10 (A) a description of the personal identifying information 11 concerning the subscriber in the possession of the service provider to which 12 access will be 13 (i) available without restriction to users of the Internet; 14 (ii) restricted by the service provider; 15 (B) a statement that the Internet service provider may disclose 16 subscriber information to an agency of the state, the federal government, or a 17 municipality for the investigation of a criminal offense or an investigation 18 related to a civil or administrative proceeding if, with regard to an investigation 19 (i) of a criminal offense, a court, upon application of the 20 agency seeking information that is relevant to the investigation, has 21 issued an order authorizing the disclosure of the subscriber information 22 without the affirmative consent of the subscriber; or 23 (ii) related to a civil or administrative proceeding, the 24 agency makes a written request to the Internet service provider to 25 disclose the subscriber information; 26 (C) the circumstances in addition to (B) of this paragraph under 27 which the Internet service provider will disclose contents of a subscriber's 28 electronic mail or web site traffic to law enforcement officials; 29 (D) the circumstances under which the network administrator 30 or network contractor of the Internet service provider is permitted to review the 31 contents of the subscriber's electronic mail or web site traffic; in this
01 subparagraph, "network contractor" means the person or entity paid directly by 02 the Internet service provider to supply and maintain bandwidth, server space, 03 and network support software; 04 (E) the Internet service provider's policy with regard to the sale 05 or redistribution of subscriber information. 06 (d) Notwithstanding AS 45.50.531(a), if an Internet service provider or an 07 employee of the Internet service provider discloses subscriber information in violation 08 of this section, the subscriber, or the state on the subscriber's behalf, may bring a civil 09 action against the Internet service provider to recover $500 as damages for each 10 disclosure. Each item of subscriber information that is disclosed is considered a 11 separate disclosure for which $500 may be awarded as damages. The $500 award 12 constitutes the value under this subsection of damages for the violation, and the 13 subscriber or the state is not required to prove actual damages. An action under this 14 subsection is in addition to any other remedy allowed under AS 45.50.471 - 45.50.561. 15 (e) This section does not apply to disclosure of subscriber information by an 16 Internet service provider if the application of it would violate 15 U.S.C. 6502(d) 17 (Children's Online Privacy Protection Act of 1998). 18 (f) In this section, 19 (1) "affirmative consent" means a written statement signed by a 20 subscriber authorizing an Internet service provider to distribute personal subscriber 21 information to third parties for marketing or other purposes; 22 (2) "criminal offense" has the meaning given to "offense" in 23 AS 11.81.900(b); 24 (3) "direct Internet access services" means direct transmission control 25 protocol/Internet protocol (TCP/IP) services if the services 26 (A) include access to a domain name server and an electronic 27 mail server; and 28 (B) are provided by dial-up modem connections using a 29 telephone, the Integrated Services Digital Network, a digital subscriber line, or 30 a coaxial cable, or by other means; 31 (4) "Internet service provider" means a person that engages in the
01 business of providing direct Internet access services to other persons; 02 (5) "subscriber" means a person who contracts with an Internet service 03 provider to receive direct Internet access services if the person's address provided to 04 the Internet service provider is located in this state; 05 (6) "subscriber information" means information obtained from or as a 06 result of the contract between an Internet service provider and a subscriber; the term 07 (A) includes 08 (i) social security number, date of birth, occupation, 09 credit card information, debit card information, current address, prior 10 addresses, telephone number, mother's maiden name, and income 11 information; and 12 (ii) information gathered by means of tracking Internet 13 usage, Internet protocol connection history, Internet preferences, 14 computer equipment, computer software, or subscriber profiles; 15 (B) does not include aggregated data that cannot be used to 16 identify a subscriber; 17 (7) "third party" 18 (A) means a person who is not the Internet service provider, an 19 employee of the Internet service provider, or the subscriber; 20 (B) includes an organization that controls, is controlled by, or 21 is under common control with the Internet service provider. 22 * Sec. 3. The uncodified law of the State of Alaska is amended by adding a new section 23 to read: 24 APPLICABILITY. AS 45.50.479, enacted by sec. 2 of this Act, applies to contracts 25 between Internet service providers and subscribers if the contracts are in existence when this 26 Act takes effect or are entered into on or after the effective date of this Act.