Who Is Covered?

1. Any person who maintains computerized data that includes personal information.
2. An information broker that maintains computerized data that includes personal information. Me. Rev. Stat. tit. 10, § 1348(1)(A), (B).

“Information broker” means a person who, for monetary fees or dues, engages in whole or in part in the business of collecting, assembling, evaluating, compiling, reporting, transmitting, transferring or communicating information concerning individuals for the primary purpose of furnishing personal information to nonaffiliated third parties. “Information broker” does not include a governmental agency whose records are maintained primarily for traffic safety, law enforcement or licensing purposes. Me. Rev. Stat. tit. 10, § 1347(3).

What Information Is Protected?

“Personal information” means an individual’s first name, or first initial, and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted: Me. Rev. Stat. tit. 10, § 1347(6).

1. Social security number;
2. Driver’s license number or state identification card number;
3. Account number, credit card number or debit card number, if circumstances exist wherein such a number could be used without additional identifying information, access codes or passwords;
4. Account passwords or personal identification numbers or other access codes; or
5. Any of the data elements contained in paragraphs 1 to 4 when not in connection with the individual’s first name, or first initial, and last name, if the information if compromised would be sufficient to permit a person to fraudulently assume or attempt to assume the identity of the person whose information was compromised.

What Is A “Breach”?

“Breach of the security of the system” or “security breach” means unauthorized acquisition, release or use of an individual’s computerized data that includes personal information that compromises the security, confidentiality or integrity of personal information of the individual maintained by a person. Good faith acquisition, release or use of personal information by an employee or agent of a person on behalf of the person is not a breach of the security of the system if the personal information is not used for or subject to further unauthorized disclosure to another person. Me. Rev. Stat. tit. 10, § 1347(1).

What Triggers Notification?

Information Broker: Discovery or notification of a security breach involving the personal information of a Maine resident whose personal information has been, or is reasonably believed to have been, acquired by an unauthorized person. Me. Rev. Stat. tit. 10, § 1348(1)(A).

Other Persons: Discovery or notification of a security breach involving the personal information of a Maine resident if misuse of the personal information has occurred or if it is reasonably possible that misuse will occur. Me. Rev. Stat. tit. 10, § 1348(1)(B).

How Is Notice Provided To Individuals?

Timing: Notice must be provided as expediently as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or with measures necessary to determine the scope of the security breach and restore the reasonable integrity, security and confidentiality of the data in the system. Me. Rev. Stat. tit. 10, § 1348(1).

Delivery: Notification may be made by:

1. Written notice;
2. Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001; or
3. Substitute notice, if the person maintaining personal information demonstrates that the cost of providing notice would exceed $5,000, that the affected class of individuals to be notified exceeds 1,000 or that the person maintaining personal information does not have sufficient contact information to provide written or electronic notice to those individuals. Me. Rev. Stat. tit. 10, § 1347(4).

Content: None specified.

Is Notice To The Government Required?

Yes. When notice of a breach of the security of the system is required under subsection 1, the person shall notify the appropriate state regulators within the Department of Professional and Financial Regulation, or if the person is not regulated by the department, the Attorney General. Me. Rev. Stat. tit. 10, § 1348(4).

Is Notice To Credit Reporting Agencies Required?

Yes. If a person discovers a breach of the security of the system that requires notification to more than 1,000 persons at a single time, the person shall also notify, without unreasonable delay, consumer reporting agencies that compile and maintain files on consumers on a nationwide basis. Notification must include the date of the breach, an estimate of the number of persons affected by the breach, if known, and the actual or anticipated date that persons were or will be notified of the breach. Me. Rev. Stat. tit. 10, § 1348(4).

Are There Security Measure Standards?

No.

What Are The Possible Consequences Of A Violation?

A violation can result in one or more of the following:

1. A fine of not more than $500 per violation, up to a maximum of $2,500 for each day the person is in violation of this chapter, except that this paragraph does not apply to state government, municipalities, school administrative units, the University of Maine System, the Maine Community College System or Maine Maritime Academy
2. Equitable relief; or
3. Enjoinment from further violations of this chapter. Me. Rev. Stat. tit. 10, § 1349(2).

Are There Any Exemptions/Exceptions?

Yes. A person that complies with the security breach notification requirements of rules, regulations, procedures or guidelines established pursuant to federal law or the law of this state is deemed to be in compliance with the requirements of section 1348 as long as the law, rules, regulations or guidelines provide for notification procedures at least as protective as the notification requirements of section 1348. Me. Rev. Stat. tit. 10, § 1349(4).