An Act To Amend the Laws Governing Privacy of Consumer Financial Information
Maine Legislature, Session 121, LD 0661
Committee: Insurance and Financial Services
Sponsors: DUDLEY, DOUGLASS, CANAVAN, CLOUGH, MURPHY, SIMPSON, SMITH, EDMONDS, HALL
Amends: 9-A MRSA §3, 9-A MRSA §9, 9-A MRSA §11, 8 MRSA §161, 9-B MRSA §241, 24-A MRSA §2215, 30-A MRSA §3964-A, 32 MRSA §6146, 32 MRSA §6, 32 MRSA §10206, 32 MRSA §110

Legislative Document 
No. 661 
H.P.491 
House of Representati ves, February 11, 2003 
An Act To Amend the Laws Governing Privacy of Consumer 
Financial Information 
Reference to the Committee on Insurance and Financial Services suggested and ordered 
printed. 
Presented by Representative DUDLEY of Portland. 
Cosponsored by Senator DOUGLASS of Androscoggin and 
/Jf~ 
/h.17ld£~ 
MILLICENT M. MacFARLAND 
Clerk 
Representatives: CANAVAN of Waterville, CLOUGH of Scarborough, MURPHY of 
Kennebunk, SIMPSON of Auburn, SMITH of Van Buren, Senators: EDMONDS of 
Cumberland, HALL of Lincoln. 
Printed on recycled paper 
Be it enacted by the People of the State of Maine as follows: 
PART A 
Sec. A-I. 9-A MRSA §3-314. as enacted by PL 200L c. 262, Pt. 
A, §1, is repealed and the following enacted in its place: 
§3-3l4. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, 
a 
creditor 
shall 
comply 
with 
the 
provisions 
of 
the 
federal 
Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et 
seq. 
(1999) 
and the applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 
(2001); the Board of Governors of the Federal Reserve System, 
Code of Federal Regulations, Part 216 
(2001); 
the Federal 
Deposi t 
Insurance Corporation, 
Code of Federal Regulations, 
Part 332 
(2001); the Office of Thrift Supervision, 
Code of 
Federal Regulations, Part 573 (2001); the National Credit Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); 
the Federal Trade Commission, 
Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 
Code of Federal Regulations, Part 248 (2001), if the creditor is 
a financial institution as defined in those regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section l71l-C or 
Title 24-A, 
chapter 24. 
This subsection does not apply to 
a 
supervised financial organization. 
2. 
Opt 
in: 
disclosure to nonaffiliated 
3rd party. 
A 
creditor required to comply with subsection 1 may not disclose, 
directly or through an affiliate, to a nonaffiliated 3rd party 
any nonpublic personal information unless the person to whom the 
information 
pertains 
has 
affirmatively 
consented 
to 
the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by a creditor to a nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm Leach Bliley Act, 
United States 
Code, 
Section 6802, 
subsection b, paragraph 2 and subsection e. 
3. 
Use of terms. 
As 
used in this section, 
unless the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate, " 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
Sec. A-2. 9-A MRSA §9-310~ as corrected by RR 
200L c. 
L 
§14, is repealed and the following enacted in its place: 
• 
§9-3l0. 
PrivacY of consumer financial information 
1. 
COIPPliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, 
a creditor 
shall 
comply 
with 
the 
provisions 
of 
the 
federal 
Gramm-Leach-Bliley Act. 
United States Code, Section 6801 et 
seq. 
(1999) and the applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 
(2001); the Board of Governors of the Federal Reserve System, 
Code of Federal Regulations, Part 216 
(2001); 
the Federal 
Deposit Insurance Corporation. 
Code of Federal Regulations, 
Part 332 (2001); the Office of Thrift Supervision, 12 Code of 
Federal Regulations, Part 573 (2001); the National Credit Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); 
the Federal Trade Commission, 
Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 17 
Code of Federal Regulations, Part 248 (2001), if the creditor is 
a financial institution as defined in those regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section 1711-C or 
Title 24-A, chapter 24. 
2. 
Opt 
in: 
disclosure to nonaffiliated 
3rd party. 
A 
credi tor required to comply with subsection 1 may not disclose, 
directly or through an affiliate, to a nonaffiliated 3rd party 
any nonpublic personal information unless the person to whom the 
information 
pertains 
has 
affirmatively 
consented 
to 
the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by a creditor to a nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm-Leach-Bliley Act, 
United States Code, 
Section 6802, 
subsection b, paragraph 2 and subsection e. 
3. 
Use of 
te~s. 
As 
used in this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate, " 
"nonaffiliated 3rd party" and "nonpublic personal 
informatiQ1l'..'. 
have the same meanings as in the federal Gramm Leach Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
Sec.A-3. 9-AMRSA §10-306, as enacted by PL 2001, c. 262, 
Pt. A, §3, is repealed and the following enacted in its place: 
§10-306. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal 
information 
to 
nonaffiliated 
3rd parties, 
a 
credit 
services organization shall comply with the provJ.SJ.ons of the 
federal Gramm-Leach-Bliley Act, 
United States Code, Section 
6801 et seq. 
(1999) 
and 
the applicable 
implementing federal 
Pr i vacy of Consumer Information regulations, as adopted by the 
Office of the Comptroller of the Currency, 
Code of Federal 
Regulations, 
Part 
(2001); 
the 
Board of 
Governors 
of 
the 
Federal Reserve System, 12 Code of Federal Regulations, Part 216 
(2001); 
the Federal Deposit Insurance Corporation, 
Code of 
Federal 
Regulations, 
Part 
(2001); 
the 
Office 
of Thrift 
Supervision, 12 Code of Federal Regulations, Part 573 (2001); the 
National 
Credit 
Union 
Administration, 
Code 
of 
Federal 
Regulations, Part 716 (2001); the Federal Trade Commission, 
Code of Federal Regulations, Part 313 (2001); or the Securities 
and Exchange Commission, 17 Code of Federal Regulations, Part 248 
(2001), 
if the 
credit services 
organization is 
a 
financial 
institution as defined in those regulations. 
This subsection is 
not intended to permit the release of health care information 
except as permitted by Title 22, section 1711-C or Title 24-A, 
chapter 24. 
2. 
Opt in: disclosure to nonaffiliated 3rd party. 
A credit 
services organization reguired to comply with subsection 1 may 
not 
disclose, 
directly 
or 
through 
an 
affiliate, 
to 
a 
nonaffiliated 3rd party any nonpublic personal information unless 
the person to whom the information pertains has affirmatively 
consented to the disclosure in writing and has not withdrawn that 
consent. 
This subsection does not prohibit the disclosure of 
nonpublic personal information by a credit services organization 
to a nonaffiliated 3rd party to the extent such a disclosure is 
permitted by the federal Gramm-Leach-Bliley Act, 15 United States 
Code, Section 6802, subsection b, paragraph 2 and subsection e. 
3. 
Use of terms. 
As 
used in this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate, " 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the Same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seg. (1999). 
Sec. A-4. 9-A MRSA §11-122. as enacted by PL 2001, c. 262, 
Pt. At §4, is repealed and the following enacted in its place: 
§ll 122. 
PrivacY of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, a merchant who 
enters into a 
rental-purchase agreement with a 
consumer shall 
comply with the provisions of the federal Gramm-Leach-Bliley Act, 
United States Code, 
Section 6801 et seg. 
(1999) 
and the 
• 
,. 
applicable implementing federal Privacy of Consumer Information 
regulations, as adopted by the Office of the Comptroller of the 
Currency, 
Code of Federal Regulations, Part 40 
(2001); the 
Board of Governors of the Federal Reserve System, 
Code of 
Federal 
Regulations, 
Part 
(2001); 
the 
Federal 
Deposit 
Insurance Corporation, 12 Code of Federal Regulations, Part 332 
(2001); 
the Office of Thrift Supervision, 
Code of Federal 
Regulations, 
Part 
(2001); 
the 
National 
Credit 
Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); 
the Federal Trade Commission, 
Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 
Code of Federal Regulations, Part 248 (2001), if the merchant is 
a financial institution as defined in those regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section l7ll-C or 
Title 24-A, 
chapter 24. 
This subsection does not apply to a 
supervised financial organization. 
2. 
Opt 
in: 
disclosure 
to nonaffiliated 
3rd party. 
A 
merchant reguired to comply with subsection 1 may not disclose, 
directly or through an affiliate, to a nonaffiliated 3rd party 
any nonpublic personal information unless the person to whom the 
information 
pertains 
has 
affirmatively 
consented 
to 
the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by a merchant to a nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm-Leach-Bliley Act, 
United States 
Code, 
Section 
6802, 
subsection b, paragraph 2 and subsection e. 
3. 
Use of terms. 
As 
used in this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate, " 
"nonaffiliated 3rd party" 
and "nonpublic personal information" 
have the same meanings as in the federal Gramm Leach Bliley Act, 
United States Code, Section 6801 et seg:. (1999). 
Sec. A·5. 9·8 MRSA §161. sub·§2, ,M. as enacted by PL 2001, c. 
262, Pt. B, §3, is.amended to read: 
M. 
~ae Except as provided in section l62-A, the sharing of 
information to the extent 
permitted by the provisions of 
the federal Gramm-Leach-Bliley Act, 
United States Code, 
Section 6801 et seq. (1999) and the applicable implementing 
federal 
Privacy 
of 
Consumer 
Information 
regulations, 
as 
adopted by the Office of the Comptroller of the Currency, 12 
Code of Federal Regulations, Part 40 (2001); the Board of 
Governors of the Federal Reserve System, 12 Code of Federal 
Regulations, Part 216 (2001); the Federal Deposit Insurance 
Corporation, 
Code 
of 
Federal 
Regulations, 
Part 
(2001); the Office of Thrift Supervision, 12 Code of Federal 
Regulations, 
Part 
(2001); 
the National Credit Union 
Administration, 
Code of Federal Regulations, Part 716 
(2001); the Federal Trade Commission, 
Code of Federal 
Regulations, Part 313 (2001); or the Securities and Exchange 
Commission, 
Code 
of 
Federal 
Regulations, 
Part 
(2001). 
This 
paragraph is 
not 
intended 
to 
permit 
the 
release of health care information except as permitted by 
Title 22, section 1711-C or Title 24-A, chapter 24; or 
Sec. A·6. 9·B MRSA §162.A is enacted to read: 
§162-A. 
Disclosure of nonpublic personal information to 
nonaffiliated 3rd party 
1. 
Qpt 
in; 
disclosure 
to 
nonaffiliated 
3rd 
party. 
A 
financial institution authorized to do business in this State or 
credit union authorized to do business in this State may not 
disclose, directly or through an affiliate, to a nonaffiliated 
3rd party any nonpublic personal information unless the person to 
whom the information pertains has affirmatively consented to the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic persona~ 
information by a financial institution authorized to do business 
in this State or credit union authorized to do business in this 
State 
to 
a 
nonaffiliated 
3rd 
party 
to 
the 
extent 
such 
a 
disclosure is otherwise permitted by this chapter or the federal 
Gramm-Leach-Bliley Act, 
United States 
Code, 
Section 6802, 
subsection b, paragraph 2 and subsection e. 
2. 
Use of terms. 
As 
used in this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliatJL_" 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seg. (1999). 
Sec. A·7. 9-B MRSA §241, sub-§13, as reallocated by RR 2001, 
c. 1, §15, is amended to read: 
13. 
Privacy 
of 
consumer 
information. 
A 
financial 
institution authorized to do business in this State or a credit 
union authorized to do business in this State shall comply with 
the 
provisions 
of 
section 
l62-A 
and 
the 
federal 
Gramm-Leach-B1iley Act, 
United States Code, Section 6801 et 
seq. 
(1999) and the applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 
(2001); the Board of Governors of the Federal Reserve System, 
Code of Federal Regulations, Part 216 
(2001); 
the Federal 
Deposit Insurance Corporation, 
Code of Federal Regulations, 
Part 332 (2001); the Office of Thrift Supervision, 
Code of 
• 
• 
Federal Regulations, 
Part 
(2001); 
or the National Credit 
Union Administration, 
Code of Federal Regulations, Part 716 
(2001). 
This subsection is not intended to permit the release of 
health care information except as permitted by Title 22, section 
1711-C or Title 24-A, chapter 24. 
Any 
violation 
of 
this 
subsection 
is 
an 
anticompetitive 
or 
deceptive practice for 
the 
purposes 
of this chapter 
and is 
subject to the remedies provided in this chapter in addition to 
remedies otherwise provided by law . 
Sec. A-S. 24-A MRSA §2215, sub-§l, ~J, as enacted by PL 1997, 
c. 677, §3 and affected by §5, is repealed. 
Sec. A-9. 24-A MRSA §2215, sub-§I, ~P, as amended by PL 2001, 
c. 457, §21, is further amended to read: 
P. 
To an affiliate whose only use of the information will 
be in connection with an audit of the regulated insurance 
entity or the marketing of a 
product or service of the 
affiliate, 
if 
the 
information 
disclosed 
for 
marketing 
purposes does not include health care information and if the 
affiliate agrees not to disclose the information for any 
other purpose or to unaffiliated persons; at 
Sec. A-I0. 24-A MRSA §2215, sub-§I, ~Q, as enacted by PL 200l, 
c. 457, §22, is amended to read: 
Q. 
In order to protect the public health and welfare, to 
state governmental entities only insofar as necessary to 
enable those entities to perform their duties when reporting 
is required or authorized by lawTL-Q£ 
Sec. A-II. 24-A MRSA §2215, sub-§l. ~R is enacted to read: 
R. 
To 
the 
extent 
permitted 
by 
the 
federal 
Gramm-Leach-Bliley Act, 15 United States Code, Section 6802, 
subsection b, paragraph 2 and subsection e as long as the 
information 
disclosed 
does 
not 
include 
health 
care 
information. 
Sec. A-12. 24-A MRS A §2215. sub-§2 is enacted to read: 
2. 
Qpt 
in; 
disclosure 
to nonaffiliated 
3rd party. 
A 
regulated insurance entity or insurance support organization may 
not 
disclose, 
directly 
or 
through 
an 
affiliate, 
to 
a 
nonaffiliated 3rd party any nonpublic personal information unless 
the person to whom the information pertains has affirmatively 
consented to the disclosure in writing and has not withdrawn that 
consent. 
This subsection does not prohibit the disclosure of 
nonpublic personal information by a regulated insurance entity or 
insurance support organization to a nonaffiliated 3 rd party to 
the extent such a disclosure is permitted by subsection 1 or the 
federal Gramm-Leach-Bliley Act, 
United States Code, Section 
6802, subsection b, paragraph 2 and subsection e. 
As used in 
this subsection, 
unless 
the context otherwise indicates, 
the 
terms 
"affiliate," 
"nonaffiliated 
3rd 
party" 
and 
"nonpublic 
personal information" have the same meanings as in the federal 
Gramm-Leach-Bliley Act, 
Uni ted States Code, Section 6801 et 
seq. (1999). 
Sec. A-13. 30-A MRSA §3964-A. sub-§4. as enacted by PL 2001, 
c. 262, Pt. E, §L is repealed and the following enacted in its 
place: 
4. 
Privacy of consumer financial information. 
The privacy 
of consumer financial information is subject to the following. 
A. 
Except 
as 
provided in paragraph 
B with respect 
to 
disclosure 
of 
nonpublic 
personal 
information 
to 
nonaffiliated 3rd parties, 
a pawnbroker shall comply with 
the provisions of the federal Gramm-Leach-Bliley Act, 
United States Code, 
Section 6801 et seq. 
(1999) 
and the 
applicable 
implementing 
federal 
Privacy 
of 
Consumer 
Information regulations, 
as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations. 
Part 
(2001); 
the 
Board of 
Governors 
of 
the 
Federal 
Reserve System, 
Code of Federal Regulations, Part 216 
(2001); the Federal Deposit Insurance Corporation, 12 Code 
of Federal Regulations, 
Part 
(2001); 
the Office of 
Thrift Supervision, 12 Code of Federal Regulations, Part 573 
(2001); the National Credit Union Administration, 12 Code of 
Federal Regulations, 
Part 
(2001); 
the 
Federal 
Trade 
Commission, 16 Code of Federal Regulations, Part 313 (2001); 
or 
the 
Securities 
and 
Exchange 
Commission, 
Code 
ot 
Federal Regulations, Part 248 (2001), if the pawnbroker is a 
financial institution as defined in those regulations. 
This 
paragraph is not intended to permit the release of heal th 
care information except as permitted by Title 22, section 
l7ll-C or Title 24-A, chapter 24. 
B. 
A pawnbroker required to comply with paragraph A may not 
disclose, 
directly 
or 
through 
an 
affiliate, 
to 
a 
nonaffiliated 3rd party any nonpublic personal information 
unless 
the person to 
whom 
the 
information pertains 
has 
affirmatively consented to the disclosure in writing and has 
not 
withdrawn 
that 
consent. 
This 
paragraph 
does 
not 
prohibit the disclosure of nonpublic personal information by 
a pawnbroker to a nonaffiliated 3rd party to the extent such 
a disclosure is permitted by the federal Gramm-Leach-Bliley 
., 
Act, 
United States Code, 
Section 6802, 
subsection b, 
paragraph 2 and subsection e. 
C. 
As used in this subsection, unless the context otherwise 
indicates, the terms "affiliate," "nonaffiliated 3rd party" 
and "nonpublic personal information" have the same meanings 
as in the federal Gramm-Leach-Bliley Act, 15 United States 
Code, Section 6801 et seq. (1999). 
Sec. A-14. 32 MRSA §6146. as enacted by PL 200L c. 262, Pt. 
E, §2, is repealed and the following enacted in its place: 
§6146. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal 
information 
to 
nonaffiliated 
3rd 
parties, 
a 
check 
cashing business 
or 
foreign 
currency exchange 
business 
shall 
comply with the provisions of the federal Gramm-Leach-Bliley Ac~ 
United States 
Code, 
Section 6801 et seq. 
(1999) 
and 
the 
applicable implementing federal Privacy of Consumer Information 
regulations, as adopted by the Office of the Comptroller of the 
Currency, 
Code of Federal Regulations, Part 40 
(2001); 
the 
Board of Governors of the Federal Reserve System, 
Code of 
Federal 
Regulations, 
Part 
(2001) ; 
the 
Federal 
Deposit 
Insurance Corporation, 12 Code of Federal Regulations, Part 332 
(2001); 
the Office of Thrift Supervision, 
Code of Federal 
Regulations, 
Part 
(2001); 
the 
National 
Credit 
Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); 
the Federal Trade Commission, 
Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 
Code 
of 
Federal 
Regulations, 
Part 
(ZOOl), 
if the 
check 
cashing business 
or 
foreign currency 
eXChange 
business 
is 
a 
financial 
institution as 
defined in those 
regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, 
section 1711-C or 
Title 24-A, chapter 24. 
2. 
Opt in; disclosure to nonaffiliated 3rd party. 
A check 
cashing business or foreign currency exchange business required 
to comply with subsection 1 may not disclose, directly or through 
an affiliate, to a nonaffiliated 3rd party any nonpublic personal 
information unless the person to whom the information pertains 
has affirmatively consented to the disclosure in writing and has 
not withdrawn that consent. 
This subsection does not prohibi t 
the 
disclosure of 
nonpublic personal 
information by 
a 
check 
cashing business 
or 
foreign 
currency 
exchange 
business 
to 
a 
nonaffiliated 3rd party to 
the 
extent 
such 
a 
disclosure is 
permitted by the federal Gramm-Leach-Bliley Act, 15 United States 
Code, Section 6802, subsection b, paragraph 2 and subsection e. 
3. 
Use of terms. 
As 
used in this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate, " 
"nonaffiliated 3rd party" 
and "nonpublic personal information" 
have the same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
Sec. A-IS. 32 MRSA §6I62. as enacted by PL 2001, c. 262, Pt. 
E, §3, is repealed and the following enacted in its place: 
§6162. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, an operator 
shall 
comply 
with 
the 
provisions 
of 
the 
federal 
Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et 
seq. 
(1999) 
and the applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 
(200l); the Board of Governors of the Federal Reserve System, 
Code of Federal Regulations, 
Part 216 
(2001); 
the Federal 
Deposit Insurance Corporation, 
Code of Federal Regulations, 
Part 332 
(2001); the Office of Thrift Supervision, 
Code of 
Federal Regulations, Part 573 (2001); the National Credit Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); 
the Federal Trade Commission, 
Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 
Code of Federal Regulations, Part 248 (2001), if the operator is 
a financial institution as defined in those regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section 1711 C or 
Title 24-A, chapter 24. 
2. 
Opt 
in; 
disclosure to nonaffiliated 3rd party. 
An 
operator required to comply with subsection 1 may not disclose, 
directly or through an affiliate, to a nonaffiliated 3rd party 
any nonpublic personal information unless the person to whom the 
information 
pertains 
has 
affirmatively 
consented 
to 
the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by an operator to a nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm-Leach-Bliley Act, 
United States 
Code, 
Section 
6802, 
subsection b, paragraph 2 and subsection e. 
3. 
Use of terms. 
As 
used 
~n this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate," 
"nonaffiliated 3rd party" and "nonpublic personal information" 
• 
have the same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
Sec. A-16. 32 MRSA §10206 is enacted to read: 
§l0206. 
Disclosure of no~public personal information to 
nonaffiliated 3rd party 
1. Opt in; disclosure to nonaffiliated 3rd party. 
A person 
subject to this chapter may not disclose, directly or through an 
affiliate, to a nonaffiliated 3rd party any nonpublic personal 
information unless the person to whom the information pertains 
has affirmatively consented to the disclosure in writing and has 
not withdrawn that consent. 
This subsection does not prohibi t 
the disclosure of nonpublic personal information by 
a 
person 
subject to this chapter to a 
nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm-Leach-Bliley Act, 
United States 
Code, 
Section 
6802, 
subsection b, paragraph 2 and subsection e. 
2. 
Use of terms. 
As 
used in this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate, " 
"nonaffiliated 3rd party" and "nonj?ublic j?ersonal information" 
have the same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
Sec. A-17. 32 MRSA §I0313, sub-§l, ~L, as enacted by PL 2001, 
c. 262, Pt. D, §3, is amended to read: 
L. 
Has failed to comply with the requirements of section 
10206 
or 
the 
privacy 
provisions 
of 
the 
federal 
Gramm-Leach-Bliley Act, 15 United States Code, Section 6801 
et seq. (1999) and the implementing Regulation S-P, federal 
Privacy 
of 
Consumer 
Financial 
Information, 
Code 
of 
Federal Regulations, Part 248 (2001) adopted by the United 
States Securities and Exchange Commission. 
This paragraph 
is 
not 
intended 
to 
permit 
the 
release 
of 
health 
care 
information except as permitted by Title 22, section l7ll-C 
or Title 24-A, chapter 24. 
Sec. A-IS. 32 MRSA §110IS. as enacted by PL 2001, c. 262, Pt. 
E, §4, is repealed and the following enacted in its place: 
§11018. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Excej?t as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, a collection 
agency or repossession company shall comply with the provisions 
of the federal Gramm-Leach-Bliley Act, 
United States Code L 
Section 
6801 et seg. 
(1999) 
and the 
applicable 
implementing 
federal Privacy of Consumer Information regulations, as adopted 
Qy the Office of the Comptroller of the Currency, 
Code of 
Federal Regulations, Part 40 
(2001); the Board of Governors of 
the Federal Reserve System, 12 Code of Federal Regulations, Part 
(2001); the Federal Deposit Insurance Corporation, 12 Code of 
Federal 
Regulations, 
Part 
(2001); 
the 
Office 
of 
Thrift 
Supervision, 12 Code of Federal Regulations, Part 573 (2001): the 
National 
Credit 
Union 
Administration, 
Code 
of 
Federal 
Regulations, Part 716 (2001); the Federal Trade Commission, 
Code of Federal Regulations, Part 313 (2001); or the Securities 
and Exchange Commission, 17 Code of Federal Regulations, Part 248 
(2001), if the collection agency or repossession company is a 
financial institution as 
defined in those 
regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section l7l1-C or 
Title 24-A, chapter 24. 
2. 
Opt 
in: 
disclosure 
to nonaffiliated 
3rd party. 
A 
collection agency or repossession company reguired to comply with 
subsection 1 may not disclose, directly or through an affiliate, 
to a nonaffiliated 3rd party any nonpublic personal information 
unless 
the 
person 
to 
whom 
the 
information 
pertains 
has 
affirmatively consented to the disclosure in writing and has not 
wi thdrawn that consent. 
This subsection does not prohibit the 
disclosure of 
nonpublic 
personal 
information by 
a 
collection 
agency or repossession company to a nonaffiliated 3rd party to 
the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm-Leach-Bliley Act, 
United States 
Code, 
Section 
6802, 
subsection b, paragraph 2 and subsection e. 
3. 
Use of terms. 
As 
used in this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate, " 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
Sec.A·19. 33MRSA§528. as enacted by PL 2001, c. 262, Pt. 
E, §5, is repealed and the following enacted in its place: 
§528. 
Privacy duties of settlement agents 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, a settlement 
agent 
shall 
comply 
with 
the 
provisions 
of 
the 
federal 
Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et 
seg. 
(1999) 
and the applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 
Page ll-LR0214(1) 
.. 
.. 
.. 
(2001); the Board of Governors of the Federal Reserve System, 
Code of Federal Regulations, Part 216 
(2001); 
the Federal 
Deposit Insurance Corporation, 
Code of Federal Regulations, 
Part 332 (2001); the Office of Thrift Supervision, 
Code of 
Federal Regulations, Part 573 (2001); the National Credit Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); 
the Federal Trade Commission, 
Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 
Code of Federal Regulations, Part 248 (2001), if the settlement 
agent 
is 
a 
financial 
institution 
as 
defined 
in 
those 
regulations. 
This 
subsection is not 
intended to permit 
the 
release of health care information except as permitted by Title 
22, section 1711-C or Title 24-A, chapter 24. 
2. 
Opt 
in; 
disclosure to nonaffiliated 
3rd party. 
A 
settlement agent required to comply with subsection 1 may not 
disclose, directly or through an affiliate, to a nonaffiliated 
3rd party any nonpublic personal information unless the person to 
whom the information pertains has affirmatively consented to the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by a settlement agent to a nonaffiliated 3rd party to 
the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm Leach Bliley Act, 
United States 
Code, 
Section 6802, 
subsection b, paragraph 2 and subsection e. 
3. 
Use of terms. 
As 
used in this section, 
unless the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate, " 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
PARTB 
Sec. B·1. Statutory referendum procedure; submission at statewide 
election; form of question; effective date. 
This Act takes effect when 
approved only for the purpose of permitting its submission to the 
legal voters of the State at a statewide election held on the 
Tuesday following the first Monday of November following passage 
of this Act. 
The municipal officers of this State shall notify 
the inhabitants of their respective cities, towns and plantations 
to meet, in the manner prescribed by law for holding a statewide 
election, to vote on the acceptance or rejection of this Act by 
voting on the following question: 
"Do 
you 
favor 
requiring financial 
services providers 
to 
obtain 
permission 
from 
individuals 
before 
disclosing 
nonpublic personal information to nonaffiliated 3rd parties?" 
The legal voters of each city, town and plantation shall 
vote by ballot on this question and designate their choice by a 
cross or check mark placed wi thin a corresponding square below 
the word "Yes" or "No." 
The ballots must be received, sorted, 
counted and declared in open ward, town and plantation meetings 
and returns made to the Secretary of State in the same manner as 
votes for members of the Legislature. 
The Governor shall review 
the returns and, if it appears that a majority of the legal votes 
are cast in favor of the Act, the Governor shall proclaim that 
fact without delay, and the Act takes effect 30 days after the 
date of the proclamation. 
The Secretary of State shall prepare and furnish to 
city, town and plantation all ballots, returns and copies of 
Act necessary to carry out the purposes of this referendum. 
SUMMARY 
each 
this 
Currently, state law conforms to the opt-out provisions of 
the federal Gramm-Leach-Bliley Act regarding the disclosure of 
nonpublic personal 
information. 
This bill puts 
in place 
an 
opt-in 
requirement 
so 
that 
financial 
services 
providers, 
including banks, 
credit unions, 
securities firms 
and mortgage 
companies, 
must 
have 
permission 
from 
individuals 
before 
disclosing nonpublic personal information to nonaffiliated 3rd 
parties, 
but 
only 
upon 
approval 
by 
voters 
at 
a 
statewide 
referendum. 
Page l3-LR02l4(1) 
..