ISPs Must Ask Before Collecting Personal Data

Internet service providers such as cable companies will no longer be allowed to use or sell personal data about customers without permission. The ban includes details about the sites and apps that a customer uses.

It's part of a new set of rules issued by the Federal Communications Commission (FCC) after a 3-2 vote in favor by commissioners. The rules will be formally published soon, at which point ISPs will have a year to comply, though smaller providers will have a further 12 months after that.

Providers will have to tell customers what data they collect, how they use it, and who if anyone they pass it on to. There's also a new "opt-in" category of particularly sensitive information which providers can't collect or pass on unless customers actively give permission for them to do so.

Finance And Health Data Protected

This opt-in category includes a customer's precise location; information about children, health, finance or social security numbers; details of the sites or apps a customer uses; and the content of any online communication such as emails. (Source: fcc.gov)

Providers can't force customers to give permission by threatening to not accept their business unless they do. However, they could put clauses in their terms and conditions that say the customer gives permission, leaving it up to the customer to read the fine print and ask for such clauses to be removed. (Source: computerworld.com)

Most other data will fall into an opt-out category which means providers can use and share the data unless the customers tells them not to. There's also a limited category of data which companies can always collect and use such as keeping a record of a customer's contact details to send them bills or market relevant services.

Website Owners Unaffected

The rules don't affect companies that run websites and other online services such as search engines or social media. That's because the FCC only governs Internet service providers, with content providers instead being an issue for the Federal Trade Commission.

Other rules taking effect mean Internet service providers must develop and maintain policies to protect the data they collect against hacking and other breaches. If a breach happens, they'll have a maximum of 30 days to tell customers. If a breach affects at least 5,000 customers, the provider must tell the FCC, the FBI and the Secret Service within seven days.

What's Your Opinion?

Do the rules go far enough? Did the FCC pick the right types of data for the "opt-in" category? Will the rules make much difference considering they don't affect the likes of Facebook and Google?