An Act To Protect Confidential Consumer Records in Self-service Storage Facilities
Be it enacted by the People of the State of Maine as follows:
Sec. 1. 10 MRSA §1372, sub-§1-A is enacted to read:
1-A. Bureau. "Bureau" means the Department of Professional and Financial Regulation, Bureau of Consumer Credit Protection.
Sec. 2. 10 MRSA §1372, sub-§1-B is enacted to read:
1-B. Facility. "Facility" means a self-service storage facility.
Sec. 3. 10 MRSA §1372, sub-§6-A is enacted to read:
6-A. Personal record. "Personal record" means a document, piece of computer hardware, computer disc or information storage device or any other medium on which personal information is stored or able to be copied or read. "Personal record" does not include a record of an owner or operator of a facility.
Sec. 4. 10 MRSA §1375, sub-§1, as enacted by PL 1989, c. 62, is amended to read:
1. Sale; use of proceeds. If the occupant is in default for a period of more than 45 days, the operator may enforce a lien by selling the property , except a personal record, stored in the leased space at a public or private sale for cash. Proceeds shall must then be applied to satisfy the lien, with any surplus disbursed as provided in subsection 5.
Sec. 5. 10 MRSA §1377 is enacted to read:
This section involves a facility's treatment of personal records.
1. Registration with bureau. A facility must register annually with the bureau. The registration must be on a form provided by the bureau and include a copy of the facility's personal records disposal policy as required by subsection 3. Notwithstanding the provisions of section 1375, the registration and personal records disposal policy must be approved by the bureau before the facility can dispose of property in any manner.
2. Registration form. The bureau shall provide a registration form for a facility under subsection 1 to record all necessary information to identify the facility, its ownership and physical location. The bureau shall provide guidelines sufficient for a facility to adopt a personal records disposal policy under subsection 3. A registered facility must inform the bureau if any registration information changes.
3. Personal records disposal policy. A facility must adopt a personal records disposal policy for the treatment of a personal record located at the facility. Pursuant to subsection 2, the policy must conform to bureau guidelines and be approved by the bureau.
4. Release of records. A facility may not auction, sell, give, dispose of or otherwise allow a personal record located at the facility to be released other than to the occupant of the leased space who placed the record at the facility or pursuant to the facility's personal records disposal policy that has been approved by the bureau. If there has been a security breach or other unintentional release of a personal record located at the facility, the facility must notify the bureau and otherwise follow the procedures pursuant to section 1348.
5. Fee. The bureau may charge a registration fee that is reasonable and necessary for the administration of this section.
Sec. 6. 10 MRSA §1378 is enacted to read:
The provisions of Title 9-A, article 6 apply to the administration of this chapter. The bureau may adopt rules to carry out the purposes of this section. Rules adopted pursuant to this section are routine technical rules pursuant to Title 5, chapter 375, subchapter 2-A.
summary
This bill requires self-service storage facilities to register with the Department of Professional and Financial Regulation, Bureau of Consumer Credit Protection. As part of this registration, self-service storage facilities must give identifying information and submit a personal records disposal plan subject to the Bureau of Consumer Credit Protection's approval. Self-service storage facilities may not dispose of property left by an occupant in any manner that does not comply with their personal records disposal plan. Self-service storage facilities are required to notify the bureau and follow the security breach notification laws if there is a security breach or if personal records are otherwise unintentionally released to the public. This bill gives the Bureau of Consumer Credit Protection administrative authority over self-service storage facilities.