SB 3017: Privacy; Geolocation Information; Eavesdropping; Internet Browser Information

A BILL FOR AN ACT

relating to privacy.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

     SECTION 1.  The legislature finds that the unregulated and unfettered sale of mobile device users' geolocation information, particularly data pertaining to sensitive locations like reproductive health clinics, poses significant implications with respect to the civil rights and liberties of residents and visitors to the State.  Additionally, these sales may infringe upon citizens' right to an accessible, safe abortion by allowing purchasers to surveil mobile device users' activities in relation to reproductive health clinics.

     In August 2022, the Federal Trade Commission sued a data broker corporation for the sale of hundreds of millions of mobile device users' geolocation information, finding that these sales identified and exposed individuals to dangers regarding discrimination, stigma, job loss, and physical violence.  Central to their lawsuit are complaints about the role that geolocation information sales could play in disclosing users' private medical decisions, especially their protected use of abortion services.  By tracking individuals' movements around reproductive health clinics, the Federal Trade Commission alleges that data brokers put the identity and safety of those seeking abortion services at risk.  Additionally, the Federal Trade Commission found that these sales could endanger those employed by reproductive health clinics, including medical professionals, social workers, and administrative staff.  Nonconsensual sales of geolocation information can divulge home addresses and daily routines by monitoring users' physical movements, creating dangerous situations for citizens that the legislature finds unacceptable.

     The legislature further finds that this is especially problematic for citizens seeking or providing abortion care in the State.  The legislature believes that these sales not only infringe on citizens' privacy rights, but also may inhibit access to safe abortion care.  The legislature believes that the State's citizens should not be subject to such violations of their civil rights and liberties.  The legislature has determined that comprehensive regulatory action on geolocation data is necessary to prevent the uncontrolled sale of geolocation information.

     Accordingly, the purpose of this Act is to prohibit the sale of:

     (1)  Geolocation information without consent;

     (2)  Data collected through eavesdropping or through an application operating in the background of a device that uses the device's microphone; and

     (3)  Internet browser information without consent.

     SECTION 2.  Chapter 481B, Hawaii Revised Statutes, is amended by adding two new sections to part I to be appropriately designated and to read as follows:

     "§481B-    Sale of geolocation information without consent or data collected through eavesdropping; prohibited.  (a)  No person, in any manner, or by any means, shall sell or offer for sale:

     (1)  Geolocation information that is recorded or collected through any means by a mobile device or location-based application without the explicit consent of the individual who is the primary user of the device or application; or

     (2)  Data that is recorded or collected through:

          (A)  Eavesdropping; or

          (B)  An application operating in the background of a device that uses the device's microphone.

     (b)  For the purposes of this section:

     "Consent" means prior express opt-in authorization that may be revoked by the user at any time.

     "Emergency" means the imminent or actual occurrence of an event that is likely to cause extensive injury, death, or property damage.

     "Geolocation information" means information that is:

     (1)  Not the contents of a communication;

     (2)  Generated by or derived, in whole or in part, from the operation of a mobile device, including but not limited to a smart phone, tablet, fitness tracker, e‑reader, or laptop computer; and

     (3)  Sufficient to determine or infer the precise location of the user of the device.

     "Location-based application" means a software application that is downloaded or installed onto a device or accessed via a web browser that collects, uses, or stores geolocation information.

     "Precise location" means any data that locates a user within a geographic area that is equal to or less than the area of a circle having a radius of one mile.

     "Sale" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a user's geolocation information to another business or a third party for monetary or other valuable consideration.  "Sale" does not include the releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a user's geolocation information for the purpose of responding to an emergency.

     "User" means a person who purchases or leases a device or installs or uses an application on a mobile device.

     §481B-    Sale of internet browser information without consent; prohibited.  (a)  No person, in any manner, or by any means, shall sell or offer for sale internet browser information without the explicit consent of the subscriber of the internet service.

     (b)  For the purposes of this section:

     "Consent" means prior express opt-in authorization that may be revoked by the subscriber at any time.

     "Internet browser information" means information from a person's use of the Internet, including:

     (1)  Web browsing history;

     (2)  Application usage history;

     (3)  The origin and destination internet protocol addresses;

     (4)  A device identifier, such as a media access control address, international mobile equipment identity, or internet protocol addresses; and

     (5)  The content of the communications comprising the internet activity.

     "Internet service" means a retail service that provides the capability to transmit data to and receive data through the Internet using a dial-up service, a digital subscriber line, cable modem, fiber optics, wireless radio, satellite, powerline, or other technology used for a similar purpose.

     "Sale" means the selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, of internet browser information to another business or a third party for monetary or other valuable consideration.

     "Subscriber" means an applicant for or a current or former customer of an internet service."

     SECTION 3.  New statutory material is underscored.

     SECTION 4.  This Act shall take effect upon its approval.

Report Title:

Privacy; Geolocation Information; Eavesdropping; Internet Browser Information

Description:

Prohibits the sale of geolocation information and internet browser information without consent.  Prohibits the sale of data collected through eavesdropping or through an application operating in the background of a device that uses the device's microphone.

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.