Nebraska Is State 17 to Pass Privacy Law; House Holds Hearing on APRA

In a recent Perspectives from FSF Scholars summarizing the American Privacy Rights Act (APRA) Discussion Draft, I added New Hampshire (number fifteen) and Kentucky (number sixteen) to the Free State Foundation's running list of states that have passed a comprehensive data privacy statute. The Cornhusker State in the interim has joined their ranks, upping that total to seventeen. Meanwhile, at a House Commerce Committee hearing on the APRA, more than one representative indicated that they are "fired up" (subscription required) to turn that bill into preempting federal law.

New Jersey was the first state in 2024 (and the fourteenth overall) to enact privacy legislation, a development I noted in a January post to the FSF Blog. The New Hampshire Privacy Act followed in March, the Kentucky Consumer Data Protection Act in early April. (Two days later the Maryland Online Data Privacy Act of 2024, about which I blogged here and here, cleared both legislative houses. Should it be signed by Governor Wes Moore, it will bring the tally to eighteen. That is, assuming another state – Pennsylvania, perhaps? – doesn't beat it to the punch.)

And on April 12, Governor Jim Pillen enacted the Nebraska Data Privacy Act, a statute very similar in substance to the Texas Data Privacy and Security Act, a bill that I summarized in July 2023's aptly titled "More States Compound the Dreaded Privacy 'Patchwork' Problem."

Of course, one of the aspects of the APRA Discussion Draft that I praised in "Congressional Leaders Return Privacy to the Front Burner," the Perspectives referenced above, is its language preempting state comprehensive data privacy laws: "no State or political subdivision thereof may adopt, maintain, enforce, or continue in effect any law, regulation, rule, or requirement covered by the provisions of this Act or a rule, regulation, or requirement promulgated under this Act."

As such, passage of the APRA – by no means a foregone conclusion – would eliminate the chaos and compliance contradictions created by the expanding number of state laws.

At an April 17 hearing held by the House Commerce Committee's Subcommittee on Innovation, Data, and Commerce, APRA co-author and Committee Chair Cathy McMorris Rodgers (R-WA) acknowledged that "Congress has been trying to develop and pass comprehensive data privacy and security legislation for decades" and argued that "[w]ith the American Privacy Rights Act, we are at a unique moment in history where we finally have the opportunity to imagine the internet as a force for prosperity and good."

In response, Subcommittee Chair Gus Bilirakis (R-FL) reportedly stated that he is "fired up" – and Representative Frank Pallone (D-NJ) indicated that he is "fired up too."

New Jersey Passes 2024's First State Privacy Law

The privacy plot thickens: New Jersey just became the first state in 2024 – and (by my count) the fourteenth overall – to enact a comprehensive data privacy law. Bill S332, formally titled "An Act concerning online services, consumers, and personal data and supplementing Title 56 of the Revised Statutes" (the Act), was signed on Tuesday by Governor Phil Murphy.

At the federal level, sadly, there has been little news to report in well over a year. Consequently, each additional state that forges its own unique path further muddies the waters, creating more chaos for consumers and more compliance nightmares for companies.

The Act establishes a number of familiar consumer rights with respect to personal data: to confirm its collection and processing, to correct, to delete, to receive a portable copy, to opt out of its processing for targeted advertising as well as its sale, and to opt in to the processing of "sensitive data."

Not surprisingly, however, the Act includes several provisions that distinguish it from other state privacy statutes – and thereby unduly complicate nationwide compliance efforts. For one, it does not set a minimum-revenue threshold for covered companies. For another, its definition of "sensitive data" includes certain types of financial information.

The New Jersey Department of Law and Public Safety's Division of Consumer Affairs is tasked with adopting regulations implementing the Act. The New Jersey Attorney General has exclusive enforcement authority. For the first year and a half, companies will enjoy a 30-day cure period.

The Act does not create a private right of action, However, an eleventh-hour amendment deleting the phrase "under any other law" did prompt Governor Murphy to note in his Statement Upon Signing that:

I understand that concerns have been raised that removing that language thereby establishes a private right of action under other laws for violations of this bill. However, nothing in this bill expressly establishes such a private right of action, and the provision as amended states that the bill shall not be "construed as providing the basis for … a private right of action for violations of [the bill]."

The bulk of the Act will go into effect on January 15, 2025. The obligation to abide universal opt-out mechanisms (such as web browser-based privacy signals) will kick in six months later.

The Latest on State Cable Bill Prorating Requirements

There have been two recent developments of note regarding legal challenges to state-level requirements that cable operators prorate customers' last-month bills – obligations that, as I argued in "State Cable Bills Prorating Requirements Clearly Are Preempted," an April 2021 Perspectives from FSF Scholars, constitute a form of rate regulation preempted by the 1984 Cable Act, not an otherwise permissible customer service standard or consumer protection law.

Both Maine and New Jersey require that cable operators – but not any of the countless other distributors of video programming, whether facilities-based (such as the two Direct Broadcast Satellite operators, DIRECTV and DISH Network, or telco TV providers, like Verizon FiOS) or streamed over the Internet (Netflix, Hulu, Amazon Prime Video, Disney+, and so on) – bill canceling customers on a per-day basis during their final month of service.

In "Maine Cable Law, Ignoring Competition, Is 'Unambiguously Preempted'," an October 2020 Perspectives, I reported that the U.S. District Court for the District of Maine had found the Maine statute to be "unambiguously preempted." The Court of Appeals for the First Circuit, however, reversed that decision on January 4, 2022. For more information, please see "First Circuit Wrongly Concludes Maine's Prorated Billing Requirement Is Not Unlawful."

And last week, on January 9, 2023, the U.S. Supreme Court announced that it had denied Charter Communications' petition for certiorari.

New Jersey's "virtually identical" rule likewise, and for similar reasons, was deemed preempted by the Superior Court of New Jersey, Appellate Division, in an October 15, 2021, unpublished opinion. I discussed this decision in "NJ State Court Concurs: Requirement to Prorate Cable Bills Equals Preempted Rate Regulation," a contemporaneous post to the Free State Foundation blog.

The New Jersey Board of Public Utilities and Division of Rate Counsel appealed to the New Jersey Supreme Court, which held oral arguments on Tuesday (subscription required). Should the lower court decision be reversed, this case potentially could make its way to the Supreme Court.

A decision is expected as early as late next month.

NJ State Court Concurs: Requirement to Prorate Cable Bills Equals Preempted Rate Regulation

Last week, a New Jersey state appellate court, wisely siding with two federal district courts, held that requiring cable operators to prorate last-month bills constitutes a form of rate regulation that is preempted by federal law.

Section 623(a)(2) of the 1984 Cable Act unambiguously states that, upon a determination by the FCC that a cable operator is subject to effective competition, "the rates for the provision of cable service by such system shall not be subject to regulation." Section 636(c), meanwhile, expressly preempts any provision of law that is inconsistent with Section 623(a)(2) (as well as with Section 623(a)(1), which states that "[n]o Federal Agency or State may regulate the rates for the provision of cable service except to the extent provided under this section.").

Nevertheless, and as I wrote in an April 2021 Perspectives from FSF Scholars, "State Cable Bills Prorating Requirements Clearly Are Preempted," two states – Maine and New Jersey – have attempted to require cable operators, and cable operators alone, to charge customers for service on a per-day basis.

Fortunately, in both cases a federal district court intervened.

In March 2020, Maine passed Public Law Ch. 657, "An Act To Require a Cable System Operator To Provide a Pro Rata Credit When Service Is Cancelled by a Subscriber." It states that a cable operator "shall grant a subscriber a pro rata credit or rebate for the days of the monthly billing period after the cancellation of service if that subscriber requests cancellation of service 3 or more working days before the end of the monthly billing period."

In an October 2020 opinion, the U.S. District Court of Maine held that obligation to be "unambiguously preempted" by the 1984 Cable Act. Specifically, the court concluded that a mandate to prorate last-month bills effectively requires cable operators to bill on a per-day basis, and therefore is a form of rate regulation preempted by Section 623(a)(1) – not a consumer protection law or customer service standard for which Section 632 creates an exception to the general rule.

For additional information on that decision, please read "Maine Cable Law, Ignoring Competition, Is 'Unambiguously Preempted'," a Perspectives from FSF Scholars published later that same month.

In March 2021, the District Court of New Jersey considered a challenge by Altice to Section 14:18-3.8 of the New Jersey Board of Public Utilities' (BPU) rules, a provision that that court found to be "virtually identical" to Maine Public Law Ch. 657. In an opinion that quoted extensively from the Maine District Court's decision, it not surprisingly reached the identical conclusion.

In addition to filing suit in federal district court, Altice also appealed the cease-and-desist order issued by the New Jersey BPU to the Superior Court of New Jersey, Appellate Division. On October 15, 2021, in an unpublished opinion, that court embraced the reasoning of the New Jersey District Court (and, by extension, the Maine District Court) and invalidated the BPU's cease-and desist order.

Notably, in both of these instances the prorated billing requirement applies exclusively to cable systems. Rival Multichannel Video Programming Distributors (MVPDs), including satellite operators, telco TV providers, and "virtual" MVPDs that distribute content over the Internet, a growing category that includes YouTube TV, Sling TV, and Hulu + Live TV, are free to bill on a monthly basis – a practice that many in fact have embraced.

As such, these court decisions, at the federal and now state levels, don't merely affirm the intent of Congress. They also serve to remove arbitrary barriers that impact only one segment of the video distribution marketplace.

Given the ever-growing prominence of streaming services (Netflix, Hulu, Amazon Prime Video, Disney+, Apple TV+, HBO MAX, and countless others), it is appropriate that regulations premised upon (at best) outdated assumptions be eliminated at every opportunity.