‘Sec. 1. 5 MRSA c. 8 is enacted to read:
PRIVACY OF PERSONAL DATA
§ 171. Definitions
As used in this chapter, unless the context otherwise indicates, the following terms have the following meanings.
(1) That has been modified to a degree that the risk of reidentification of a known natural person is small;
(2) That is subject to a public commitment by the controller not to attempt to reidentify the data; and
(3) To which has been applied one or more enforceable controls to prevent reidentification. Enforceable controls to prevent reidentification may include legal, administrative, technical or contractual controls.
§ 172. Consumer rights
§ 173. Risk assessments for use of personal data
The controller shall make the results of a risk assessment available to the Attorney General upon request. A risk assessment conducted under this subsection is confidential and not a public record pursuant to Title 1, section 402, subsection 3.
§ 174. Response to verified requests
A controller that receives a verified request from a consumer through a designated request address under this chapter shall provide a response to the consumer within 60 days of the controller's authentication of the request. Upon an authenticated verified request from a consumer for information pertaining to sales of personal data, a controller shall provide the consumer information pertaining to all sales of the consumer's personal data pursuant to this chapter that occurred in the 12 months prior to the date of the consumer's verified request. This section does not apply to personal data disclosed or sold prior to July 1, 2021.
§ 175. Exemptions and limitations
§ 176. Enforcement
The Attorney General has exclusive authority to enforce this chapter. Whenever the Attorney General has reason to believe that a controller is not complying with any requirement of this chapter, the Attorney General may provide written notice of the alleged violation to the controller. If the controller fails to cure the alleged violation within 30 days of receipt of the notice, the Attorney General may bring an action in the name of the State against the controller to restrain by temporary or permanent injunction any failure to comply with this chapter, and the court may make such other orders or judgments as may be necessary to restore to any person who has suffered any ascertainable loss by reason of the failure to comply any money or property, real or personal, that may have been acquired by means of the failure to comply. Nothing in this chapter serves as the basis or grounds for a private right of action under this or any other law.
Sec. 2. Appropriations and allocations. The following appropriations and allocations are made.
ATTORNEY GENERAL, DEPARTMENT OF THE
Administration - Attorney General 0310
Initiative: Establishes one Assistant Attorney General position and one Cyber Investigator position and provides funding for related All Other costs.
POSITIONS - LEGISLATIVE COUNT
|GENERAL FUND TOTAL||$201,714||$276,736|
Sec. 3. Effective date. This Act takes effect July 1, 2021.’