Is Your Browser History Private? Resolution Would Allow ISPs To Collect Information From Customers Without Permission

Republican Senator Jeff Flake of Arizona revealed on Wednesday that he intends to introduce a resolution to roll back privacy rules that restrict what internet service providers can do with customer data, according to a report from Politico.

Flake said he intended to eliminate the Broadband Consumer Privacy Rules by using the Congressional Review Act, which allows Congress to undo rules set by federal agencies with a simple majority vote.

The rules that Flake is taking aim at were first passed by the FCC in October 2016 and were aimed at giving consumers more control over their data by requiring internet service providers to ask for permission before using sensitive information.

"We like to say it makes [consumers] the king or queen of their information," Dallas Harris, a policy fellow at open internet advocacy group Public Knowledge, told International Business Times. "The way the order does that is by saying, 'Okay internet service provider, if you would like to use sensitive information, you have to ask your consumers first.' We're requiring an opt-in."

The order defines sensitive information as information regarding a user’s finances, health, information from children, precise geolocation data, web browsing history, and app usage history. It also includes any unencrypted message content that may be accessible to the service provider.

Information deemed to be non-sensitive can be collected by default requires an option to opt-out.

Internet service providers oppose the rules and lobbied for the FCC to undo them —a very real possibility under the leadership of Ajit Pai, who was appointed to the head of the FCC by President Donald Trump.

Commissioner Pai opposed the rules when they were passed last year, arguing at the time, “if the FCC truly believes that these new rules are necessary to protect consumer privacy, then the government now must move forward to ensure uniform regulation of all companies in the Internet ecosystem at the new baseline the FCC has set.”

Pai’s argument is essentially that if the FCC wants to make handing over consumer data require an opt-in for ISPs, it should for edge providers like Facebook and Google as well. It’s unlikely Pai would extend the rules as he suggested, but he could modify them.

"The agency is free to change its mind” on the ruling, Harris explained, “It just can't do so in an arbitrary and capricious manner...they can't just willy-nilly with no reason decide to rescind them.” Doing so would require opening the rules up to public comment and would require the agency to change the rules based on new facts.

Pai and the FCC also have the option to make changes by reviewing petitions for reconsideration, which allows the commission to change a rule without opening the process up to public comment.

Both options are preferable to using the Congressional Review Act, which Harris calls “entirely too blunt of an instrument” to handle such a rule.

"There really is no benefit to using the CRA here. It would prevent the agency from even amending the rules in the way internet service providers have asked them to do so because it prohibits them from promulgating any rules that are substantially similar," she explained.

When the CRA is used to undo a regulation, it bars the agency that issued the rule from ever issuing it again. That means the Broadband Consumer Privacy Rules, which weren’t set to go into effect until December 2017, would be gone for good.

“They would strip consumers of privacy protection even before they get a chance to enjoy them," Harris said.

Flake reportedly has 12 co-sponsors for the move lined up, and a party line vote would be enough to do away with the protections unless another option is taken to change the regulations.