An Act To Amend the Notice of Risk to Personal Data Act
Sec. 1. 5 MRSA §1973, sub-§7 is enacted to read:
Sec. 2. 10 MRSA §1347, sub-§1, as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
Sec. 3. 10 MRSA §1347, sub-§4, ¶C, as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
C. Substitute notice, if the person maintaining personal information broker demonstrates that the cost of providing notice would exceed $5,000, that the affected class of individuals to be notified exceeds 1,000 or that the person maintaining personal information broker does not have sufficient contact information to provide written or electronic notice to those individuals. Substitute notice must consist of all of the following:
(1) E-mail notice, if the information broker person has e-mail addresses for the individuals to be notified;
(2) Conspicuous posting of the notice on the information broker's person's publicly accessible website, if the information broker person maintains one; and
(3) Notification to major statewide media.
Sec. 4. 10 MRSA §1347, sub-§5, as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
Sec. 5. 10 MRSA §1347, sub-§8, as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
Sec. 6. 10 MRSA §1348, sub-§1, as enacted by PL 2005, c. 379, §1 and affected by §4, is repealed and the following enacted in its place:
A. If an information broker that maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the information broker shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State whose personal information has been, or is reasonably believed to have been, acquired by an unauthorized person.
B. If any other person who maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the person shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State if misuse of the personal information has occurred or if it is reasonably possible that misuse will occur.
The notices required under paragraphs A and B must be made as expediently as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement pursuant to subsection 3 or with measures necessary to determine the scope of the security breach and restore the reasonable integrity, security and confidentiality of the data in the system.
Sec. 7. 10 MRSA §1348, sub-§2, as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
Sec. 8. 10 MRSA §1348, sub-§4, as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
Sec. 9. 10 MRSA §1348, sub-§5, as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
Sec. 10. 10 MRSA §1349, sub-§1, as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
Sec. 11. 10 MRSA §1349, sub-§2, as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
A. A fine of not more than $500 per violation, up to a maximum of $2,500 for each day the information broker person is in violation of this chapter;
B. Equitable relief; or
C. Enjoinment from further violations of this chapter.
Sec. 12. 10 MRSA §1350 is enacted to read:
§ 1350. Private remedy
A person may bring a civil action and recover actual damages together with costs and reasonable attorney's fees if the person is injured by any of the following actions taken by a person subject to the provisions of this chapter:
Sec. 13. 10 MRSA §1350-A is enacted to read:
§ 1350-A. Rulemaking
The appropriate state regulators within the Department of Professional and Financial Regulation may adopt rules as necessary for the administration and implementation of this chapter. Rules adopted pursuant to this section are routine technical rules as defined in Title 5, chapter 375, subchapter 2-A.
summary
This bill expands to other types of persons and businesses, including colleges and universities, the current requirement that information brokers notify consumers upon a security breach of the consumers' personal information. The bill also establishes a private cause of action for certain violations of the obligation to notify consumers.
The bill also requires the State's Chief Information Officer to develop standards and policies requiring notification by state agencies to Maine residents upon a security breach of personal information.