An Act To
Maine Legislature, Session 122, LD 2017
Committee Amendment CA_A_H925 (House)
Amends: 10 MRSA §1347, 10 MRSA §1349, 10 MRSA §1350-A

COMMITTEE AMENDMENT ,A, to H.P. 1417, L.D. 2017, Bill, "An Act To 
Amend the Notice of Risk to Personal Data Act" 
Amend the bill by striking out all of section 1. 
Further amend the bill in section 4 by striking out all of subsection 5 (page 1, lines 35 
to 41 in L.D.) and inserting in its place the following: 
'5. Person. "Person" means an individual, partnership, corporation, limited liability 
company, trust, estate, cooperative, association or other entity, including agencies of State 
Government, the University of Maine System, the Maine Community College System, 
Maine Maritime Academy and private colleges and universities. "Person" as used in this 
chapter may not be construed to require duplicative notice by more than one individual, 
corporation, trust, estate, cooperative, association or other entity involved in the same 
transaction. ' 
Further amend the bill by inserting after section 4 the following: 
'Sec. 5. 10 MRSA §1347, sub-§6, as enacted by PL 2005, c. 379, § 1 and affected 
by §4, is amended to read: 
6. Personal information. "Personal information" means an individual's first name, 
or first initial, and last name in combination with anyone or more of the following data 
elements, when either the name or the data elements are not encrypted or redacted: 
A. 
Social security number; 
B. 
Driver's license number or state identification card number; 
C. 
Account number, credit card number or debit card number, if circumstances 
exist wherein such a number could be used without additional identifying 
1 
information, access codes or passwords; 
D. 
Account passwords or personal identification numbers or other access codes; or 
E. 
Any of the data elements contained in paragraphs A to D when not in connection 
with the individual's first name, or first initial, and last name, if the information if 
COMMITTEE AMENDMENT 
a 
~~~~ ~,~ 
COMMITTEE AMENDMENT ,~, to H.P. 1417, L.D. 2017 
compromised would be sufficient to permit a person to fraudulently assume or 
attempt to assume the identity of the person whose information was compromised. 
"Personal information" does not include information from 3rd-party claims databases 
maintained by property and casualty insurers or publicly available information that is 
lawfully made available to the general public from federal, state or local government 
records or widely distributed media.' 
Further amend the bill in section 8 by striking out all of subsection 4 (page 2, lines 41 
and 42 and page 3, lines 1 to 3 in L.D.) and inserting in its place the following: 
'4. 
Notification to consumer reporting agencies. If an infonnation broker ~ 
person discovers a breach of the security of the system that requires notification to more 
than 1,000 persons at a single time, the infonnation broker person shall also notify, 
without unreasonable delay, consumer reporting agencies that compile and maintain files 
on consumers on a nationwide basis, as defined in 15 United States Code, Section 
1681a(p). Notification must include the date of the breach, an estimate of the number of 
persons affected by the breach, if known, and the actual or anticipated date that persons 
were or will be notified of the breach.' 
Further amend the bill in section 11 in subsection 2 in paragraph A in the 2nd line 
(page 3, line 22 in L.D.) by inserting after the following: "chapter" the following: 
'~ 
except that this paragraph does not apply to State Government, the University of Maine 
System, the Maine Community College System or Maine Maritime Academy' 
Further amend the bill by inserting after section 11 the following: 
'Sec. 12. 10 MRSA §1349, suh-§4 is enacted to read: 
4. 
Exceptions. 
A person that complies with the security breach notification 
requirements of rules, regulations, procedures or guidelines established pursuant to 
federal law or the law of this State is deemed to be in compliance with the requirements 
of this chapter as long as the law, rules, regulations or guidelines provide for notification 
procedures at least as protective as the notification requirements of this chapter.' 
Further amend the bill by striking out all of section 12. 
Further amend the bill by striking out all of section 13 and inserting in its place the 
following: 
'Sec. 13. 10 MRSA §1350-A is enacted to read: 
§1350-A. Rules; education and compliance 
The following provisions govern rules and education and compliance. 
1. Rules. With respect to persons under the jurisdiction of the regulatory agencies of 
the Department of Professional and Financial Regulation, the appropriate state regulators 
within that department may adopt rules as necessary for the administration and 
implementation of this chapter. With respect to all other persons, the Attorney General 
may adopt rules as necessary for the administration and implementation of this chapter. 
Rules adopted pursuant to this subsection are routine technical rules as defined in Title 5, 
chapter 375, subchapter 2-A. 
COMMITTEE AMENDMENT 
,;.;N' 
"'" 
~. :J.-<; 
!.':-
COMMITTEE AMENDMENT ,A" to H.P. 1417, L.D. 2017 
2. 
Education and compliance. 
The appropriate state regulators within the 
Department of Professional and Financial Regulation shall undertake reasonable efforts to 
inform persons under the department's jurisdiction of their responsibilities under this 
chapter. 
With respect to all other persons, the Attorney General shall undertake 
reasonable efforts to inform such persons of their responsibilities under this chapter. 
Sec. 14. Effective date. This Act takes effect January 31, 2007.' 
Further amend the bill by relettering or renumbering any nonconsecutive Part letter or 
section number to read consecutively. 
SUMMARY 
This amendment is the majority report of the committee. The amendment makes the 
following changes to the bill. 
1. It removes the section that permits persons to bring a private cause of action for 
violations of the notice provisions. 
2. It adds language to clarify that if an entity complies with file breach notification 
requirements established pursuant to federal or Maine law, and if those requirements are 
at least as protective as the protections granted by this legislation, that entity is deemed to 
be in compliance with the notification requirements of the bill. 
3. It specifies that when a person is required to notify consumer reporting agencies of 
a security breach, the agencies must be informed of the date of the breach, an estimate of 
the number of individuals affected by the breach, if known, and the actual or anticipated 
date that the individuals were or will be notified of the breach. 
4. It amends the definition of "person" to include State Government, the University 
of Maine System, the Maine Community College System and Maine Maritime Academy 
so that those entities are subject to the notification requirements of the bill. 
The 
amendment also exempts those parties from the civil fine provisions of the Maine 
Revised Statutes, Title 10, section 1349, subsection 2 but leaves them subject to equitable 
and injunctive remedies. 
5. 
It clarifies that the definition of personal information subject to the notice 
requirements of the bill after a security breach does not apply to information maintained 
in 3rd-party claims databases of property and casualty insurance companies. 
6. It extends authority to the Attorney General's office with respect to persons not 
under the jurisdiction of the regulatory agencies within the Department of Professional 
and Financial Regulation. 
7. It requires the Department of Professional and Financial Regulation and the 
Attorney General to undertake reasonable efforts to inform persons of their 
responsibilities under this legislation. 
8. It delays the effective date of this legislation until January 31, 2007. 
FISCAL \OTE REQUIRED 
(See attached) 
COMMITTEE AMENDMENT 
Fiscal Detail and Notes 
Approved: 03/27 /06 ~ac:... 
LD 2017 
LR3151(02) 
An Act To Amend the Notice of Risk to Personal Data Act 
Fiscal Note for Bill as Amended by Committee Amendment ,~" 
Committee: Insurance and Financial Services 
Fiscal Note Required: Yes 
Fiscal Note 
Minor cost increase - General Fund 
Additional costs to the Office of the Attorney General, the Department of Professional and Financial Regulation, the 
University of Maine System, the Maine Community College System, Maine Maritime Academy and the Office of 
Information Technology within the Department of Administrative and Financial Services can be absorbed utilizing 
existing budgeted resources. 
LR3151(2) - Fiscal Note - Page 1 of 1