Exemptions are, again, a key sticking point of Maine’s attempt to pass a comprehensive data privacy law. 

The Maine House of Representatives removed a Senate-backed exemption for political organizations on Thursday, though the two-hour debate still centered on the other carve-outs in the legislation — echoing the disputes heard in the final hours of the Legislature two years ago, when lawmakers failed to pass earlier iterations of such a plan.

What was new Thursday was discussion of recent revelations about implications of the current lack of consumer privacy online, including an admission that the FBI is buying data to track people’s movement and location history and landmark rulings that Big Tech companies have put children in harm’s way on their social media platforms. 

“I really think that if we don’t do this, we’re going to look back in a couple of years and regret that moment,” said Rep. Amy Kuhn (D-Falmouth), the sponsor of the data privacy legislation, LD 1822. 

The narrow passage of the amended bill in the House on Thursday bounces the proposal back to the Senate, where debate is expected to continue on the right path forward. 

Much can be gleaned, however, from a look back. 

For the past several years, the Maine Legislature has debated how aggressive the state should be in protecting consumer privacy online. But competing proposals, along with sizable behind-the-scenes influence from lobbyists, have left the state without a comprehensive policy. 

“I feel like the debate on this bill has for years been a game of whac-a-mole, where we solve one problem and a new one unrelated to the previous problem pops back up,” Rep. Adam Lee (D-Auburn) said on Thursday. 

Or in other words, it’s like “death by a thousand cuts” as Maryland Sen. Sara Love described to Maine Morning Star the process in her state of Big Tech lobbyists requesting for more and more amendments to the data privacy proposal she helped lead. Maryland drew the line. That state’s law, which offers some of the strictest consumer protections in the country, took effect this fall and is very similar to the plan being considered in Maine. 

Overall, there is currently a patchwork of state and federal laws governing internet privacy, as there remains no one overarching federal statute.

The Maryland model relies on a data minimization standard, which broadly means limiting the collection of personal information to only what is necessary to fulfill the consumer service. 

That diverges from the version favored by industry groups that’s been adopted by most states so far, which uses what’s referred to as an opt-in model, allowing companies to collect data as long as consumers agree to it. This is commonly called the Connecticut model, a Republican-sponsored, industry-favored version of which was rejected by the Maine Legislature last year. 

On the floor on Thursday, Rep. Laurel Libby (R-Auburn) characterized the bill currently being considered as “a swiss cheese of consumer protection.” She added, “I would support a bill that had no carve-outs whatsoever.”

That’s never been on the table. 

Both the industry-backed version and LD 1822 offer exemptions. However, their diverging overall approaches to data minimization influence how each bill handles exemptions. With more data minimization, there’s generally more exemptions, whereas with less minimization, there’s fewer exemptions. 

Exemptions are dealt with largely in two ways: Data-level exemptions that apply only to specific information, and entity-level exemptions that offer a total exemption for a specific business.

The political organization exemption backed by the Senate earlier this month — which drew the ire of Maine Republicans and some Democrats, including Gov. Janet Mills — was an entity-level one. (Notably, Connecticut added an entity-level exemption for political committees, along with a host of other changes, to its law last year.)  

Sen. Anne Carney (D-Cumberland), who introduced the amendment, and Kuhn said the entity exemption was an attempt to shore up data-level exemptions already in LD 1822, as well as the Republican version. 

Both contain stipulations that the legislation may not be interpreted as infringing on First Amendment rights. “The only thing that a political party is going to do is engage in First Amendment activity, so that’s kind of what qualifies you for an entity-level exemption,” Kuhn told Maine Morning Star.

That’s why she had been comfortable with the political carve-out. “It’s not a policy change,” she said. “The policy is the same.” 

While Kuhn ultimately decided to remove it on Thursday, she didn’t think the switch to an entity-level exemption did harm, other than giving the opposition fuel.

“I would say it’s not a coincidence that at the 11th hour we have yet another controversy that we need to overcome,” she said. 

While that controversy has seemingly been put to rest, objections to other exemptions remain, along with concern about inter-operability between states. 

“People should know how their data is being used. They should have control over it. That’s not the debate,” Rep. Tiffany Roberts (D-Berwick) said on the floor Thursday. “The debate is whether we’re going to build a policy that actually works in the real economy that Maine operates in.”

Roberts and other opponents argue the bill would make an enemy of business, repeating long-standing apprehension about whether the bill would hinder businesses’ ability to do targeted advertising. Kuhn maintains that it wouldn’t. 

“There’s no reason why we can’t have targeted advertising and meaningful protections for consumers at the same time,” Kuhn said.