|
REFERENCE TITLE: internet providers; personal information |
|
State of Arizona House of Representatives Fifty-first Legislature First Regular Session 2013
|
|
HB 2454 |
|
|
|
Introduced by Representatives Mach, Orr: Borrelli, Cardenas, Carter, Otondo, Quezada
|
AN ACT
Changing the designation of title 44, chapter 34, Arizona Revised Statutes, to "use of identification information"; changing the designation of title 44, chapter 34, article 1, Arizona Revised Statutes, to "Retailers"; amending title 44, chapter 34, Arizona Revised Statutes, by adding article 2; relating to the use of identification information.
(TEXT OF BILL BEGINS ON NEXT PAGE)
Be it enacted by the Legislature of the State of Arizona:
Section 1. Heading change
A. The chapter heading of title 44, chapter 34, Arizona Revised Statutes, is changed from "RETAILER USE OF IDENTIFICATION INFORMATION" to "USE OF IDENTIFICATION INFORMATION".
B. The article heading of title 44, chapter 34, article 1, Arizona Revised Statutes, is changed from "GENERAL PROVISIONS" to "RETAILERS".
Sec. 2. Title 44, chapter 34, Arizona Revised Statutes, is amended by adding article 2, to read:
ARTICLE 2. INTERNET SERVICE PROVIDERS
44-7721. Definitions
In this article, unless the context otherwise requires:
1. "Consumer" means a person who agrees to pay a fee to an Internet service provider for access to the Internet for personal, family or household purposes and who does not resell access.
2. "Internet service provider":
(a) Means a person who provides consumers authenticated access to, or presence on, the Internet by means of a switched or dedicated telecommunications channel on which the provider provides transit routing of Internet Protocol packets for and on behalf of the consumer.
(b) Does not include the offering, on a common carrier basis, of telecommunications facilities or of telecommunications by means of these facilities.
3. "Ordinary course of business" means debt collection activities, order fulfillment, request processing or the transfer of ownership.
4. "Personally identifiable information" means information that identifies any of the following:
(a) A consumer by physical or electronic address or telephone number.
(b) A consumer as having requested or obtained specific materials or services from an Internet service provider.
(c) Internet or online sites visited by a consumer.
(d) The contents of a consumer's data storage devices.
44-7722. Disclosure; prohibitions; requirements; authorization
A. Except as provided in subsections B and C of this section, an Internet service provider may not knowingly disclose a consumer's personally identifiable information.
B. An Internet service provider shall disclose a consumer's personally identifiable information as follows:
1. Pursuant to a grand jury subpoena.
2. To a law enforcement officer who acts in an official capacity.
3. Pursuant to a court order in a civil proceeding on a showing of compelling need for the information that cannot be accommodated by other means.
4. To a court in a civil action for conversion commenced by the Internet service provider or in a civil action to enforce collection of unpaid subscription fees or purchase amounts, and then only to the extent that is necessary to establish the fact of the subscription delinquency or purchase agreement and with appropriate safeguards against unauthorized disclosure.
5. To the consumer who is the subject of the information, on written or electronic request and on payment of a fee not to exceed the actual cost of retrieving the information.
6. Pursuant to a subpoena, including an administrative subpoena, that is issued under the authority of a law of this state or another state or the United States.
7. Pursuant to a warrant or court order.
C. An Internet service provider may disclose a consumer's personally identifiable information as provided in section 13‑3006 and to:
1. Any person if the disclosure is incident to the provider's ordinary course of business.
2. Another Internet service provider for the purposes of reporting or preventing violations of the provider's published acceptable use policy or customer service agreement except that the recipient may further disclose the personally identifiable information only as provided by this article.
3. Any person if the internet service provider obtains the consumer's authorization in writing or by electronic means. The request for authorization must reasonably describe the types of persons to whom personally identifiable information may be disclosed and the anticipated uses of the information. For an authorization to be effective, a contract between an Internet service provider and the consumer must state conspicuously either that the authorization will be obtained by an affirmative act of the consumer or that failure of the consumer to object after the request has been made constitutes authorization of disclosure. Authorization may be obtained in a manner consistent with self-regulating guidelines issued by representatives of the Internet service provider or online industries or in any other manner reasonably designed to comply with this paragraph.
44-7723. Security of information
The Internet service provider shall take reasonable steps to maintain the security and privacy of a consumer's personally identifiable information. The Internet service provider is not liable for actions that would constitute a violation of section 13‑2316 or 13‑2316.02, if the Internet service provider does not participate in, authorize or approve the actions.
44-7724. Exclusion from evidence
Except for the purposes of establishing a violation of this article, personally identifiable information that is obtained in any manner other than as provided in this article may not be received in evidence in a civil action.
44-7725. Civil action; enforcement; defense
A. A consumer who prevails or substantially prevails in an action brought under this article is entitled to the greater of five hundred dollars or actual damages. Costs, disbursements and reasonable attorney fees may be awarded to a party who is awarded damages for a violation of this article. A class action shall not be brought under this article.
B. In an action under this article, it is a defense that the defendant has established and implemented reasonable practices and procedures to prevent violations of this article.
44-7726. Other laws
A. This article does not limit:
1. Any greater protection of the privacy of information under other law.
2. The authority under other state or federal law of a law enforcement or prosecuting attorney to obtain information.
B. If federal law is enacted that regulates the release of personally identifiable information by Internet service providers but that does not preempt state law on the subject, the federal law supersedes any conflicting provisions of this article.