An Act Concerning the Regulation of Certain Information to Protect Privacy
Maine Legislature, Session 122, LD 1638
Committee: Insurance and Financial Services
Sponsors: DUDLEY, BRENNAN, BRAUTIGAM, CANAVAN, CRA YEN, EBERLE, LERMAN, SMITH, WOODBURY, DAMON
Amends: 9-A MRSA §3, 9-A MRSA §9, 9-A MRSA §10, 24-A MRSA §2215, 30-A MRSA §3964-A, 32 MRSA §6146, 32 MRSA §6162, 32 MRSA §10206, 32 MRSA §11018, 33 MRSA §528

Legislative Document 
No. 1638 
H.P.1156 
House of Representatives, May 3, 2005 
An Act Concerning the Regulation of Certain Information to 
Protect Privacy 
Reference to the Committee on Insurance and Financial Services suggested and ordered 
printed. 
Presented by Representative DUDLEY of Portland. 
Cosponsored by Senator BRENNAN of Cumberland and 
7rJ~ 
/h·17IQ£~ 
MILLICENT M. MacFARLAND 
Clerk 
Representatives: BRAUTIGAM of Falmouth, CANAVAN of Waterville, CRA YEN of 
Lewiston, EBERLE of South Portland, LERMAN of Augusta, SMITH of VanBuren, 
WOODBURY of Yarmouth, Senator: DAMON of Hancock. 
Printed on recycled paper 
Be it enacted by the People of the State of Maine as follows: 
PART A 
Sec. A-I. 9-A MRSA §3-3I4, as enacted by PL 2001, c. 262, Pt. 
A, §1, is repealed and the following enacted in its place: 
§3-314. 
Priya~ of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, 
a 
creditor 
shall 
comply 
with 
the 
provisions 
of 
the 
federal 
Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et 
seg:. 
(1999) and the applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 
(2001); the Board of Governors of the Federal Reserve System, 
Code of Federal Regulations, Part 216 
(2001); 
the Federal 
Deposit Insurance Corporation, 
Code of Federal Regulations, 
Part 332 (2001); the Office of Thrift Supervision, 12 Code of 
Federal Regulations, Part 573 (2001); the National Credit Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001): 
the Federal Trade Commission, 
Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 
Code of Federal Regulations, Part 248 (2001), if the creditor is 
a financial institution as defined in those regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section 171l-C or 
Title 24-A, chapter 24. 
This subsection does not apply to a 
supervised financial organization. 
2. 
Opt in; disclosure to nonaffiliated 3rd party. 
A 
creditor required to comply with subsection 1 may not disclose, 
directly or through an affiliate, to a nonaffiliated 3rd party 
any nonpublic personal information unless the person to whom the 
information 
pertains 
has 
affirmatively 
consented 
to 
the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by a creditor to a nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm-Leach-Bliley Act, 
United States Code, 
Section 6802, 
subsection b, paragraph 2 and subsection e. 
3. 
Use of terms. 
As 
used in this section, unless the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate," 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the Same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
Sec. A-2. 9-A MRSA §9-3IO, as corrected by RR 2001, c. l, 
§14, is repealed and the following enacted in its place: 
.. 
• 
• 
S9-3ID. 
Privacy of consumer financial infopaation 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties. 
a creditor 
shall 
comply 
with 
the 
proV1s10ns 
of 
the 
federal 
Gramm-Leach-Bliley Act. 
United States Code. Section 6801 et 
.s.eg. 
(1999) and the applicable implementing federal Privacy of 
Consumer Information regulations. as adopted by the Office of the 
Comptroller of the Currency. 12 Code of Federal Regulations. Part 
(2001); the Board of Governors of the Federal Reserve System. 
Code of Federal Regulations. Part 216 
(2001); 
the Federal 
Deposit Insurance Corporation. 
Code of Federal Regulations. 
Part 332 (2001); the Office of Thrift Supervision. 12. Code of 
Federal Regulations. Part 573 (2001); the National Credit Union 
Administration. 12 Code of Federal Regulations. Part 716 (2001); 
the Federal Trade Commission. 
Code of Federal Regulations. 
Part 313 (2001): or the Securities and Exchange Commission. 17 
Code of Federal Regulations. Part 248 (2001). if the creditor is 
a financial institution as defined in those regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22. section 1711-C or 
Title 24-A. chapter 24. 
2. 
Qpt in: disclosure to nonaffiliated 3rd party. 
A 
creditor required to comply with subsection 1 may not disclose. 
directly or through an affiliate. to a nonaffiliated 3rd party 
any nonpublic personal information unless the person to whom the 
information 
pertains 
has 
affirmatively 
consented 
to 
the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by a creditor to a nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm-Leach-Bliley Act. 
United States Code. 
Section 6802. 
subsection b. paragraph 2 and subsection e. 
3. Use of terms. 
As 
used in this section. 
unless the 
context 
otherwise 
indicates. 
the 
terms 
"affiliate." 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the Same meanings as in the federal Gramm-Leach-Bliley Act. 
United States Code. Section 6801 et seg. (1999) . 
Sec. A-3. 9-A MRSA §10-306, as enacted by PL 2001, c. 262, 
Pt. A, §3, is repealed and the following enacted in its place: 
SID-3DO. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal 
information 
to 
nonaffiliated 
3rd parties, 
a 
credit 
services organization shall comply with the provisions of the 
federal Grarnm-Leach-Bliley Act, 
United States Code, Section 
6801 et seq. 
(1999) 
and the applicable 
implementing federal 
Privacy of Consumer Information regulations, as adopted by the 
Office of the Comptroller of the Currency, 12 Code of Federal 
Regulations, 
Part 
(2001); 
the 
Board of Governors 
of the 
Federal Reserve System, 12 Code of Federal Regulations, Part 216 
(2001) ; 
the Federal Deposit Insurance Corporation, 
Code of 
Federal 
Regulations, 
Part 
(2001); 
the Office 
of Thrift 
Supervision, 12 Code of Federal Regulations, Part 573 (2001); the 
National 
Credit 
Union 
Administration, 
Code 
of 
Federal 
Regulations, Part 716 (2001); the Federal Trade Commission, 
Code of Federal Regulations, Part 313 (2001); or the Securities 
and Exchange Commission, 17 Code of Federal Regulations, Part 248 
(2001), 
if the credit services 
organization is 
a 
financial 
institution as defined in those regulations. 
This subsection is 
not intended to permit the release of health care information 
except as permitted by Title 22, section 1711-C or Title 24-A, 
chapter 24. 
2. 
Opt in: disclosure to nonaffiliated 3rd party. 
A credit 
services organization required to comply with subsection 1 may 
not 
disclose, 
directly 
or 
through 
an 
affiliate, 
to 
a 
nonaffiliated 3rd party any nonpublic personal information unless 
the person to whom the information pertains has affirmatively 
consented to the disclosure in writing and has not withdrawn that 
consent. 
This subsection does not prohibit the disclosure of 
nonpublic personal information by a credit services organization 
to a nonaffiliated 3rd party to the extent such a disclosure is 
permitted by the federal Grarnm-Leach-Bliley Act, 15 United States 
Code, Section 6802, subsection b, paragraph 2 and subsection e. 
3. Use of terms. 
As 
used in this section, 
unless the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate," 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the same meanings as in the federal Grarnm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
Sec. A-4. 9-A MRS A §11-122, as enacted by PL 2001, c. 262, 
Pt. A, §4, is repealed and the following enacted in its place: 
§ll-122. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, a merchant who 
enters into a rental-purchase agreement with a 
consumer shall 
comply with the provisions of the federal Gramro-Leach-Bliley Act, 
United States Code, 
Section 6801 et seg. 
(1999) 
and the 
. Page 3-LR2052(1) 
.. 
• 
applicable implementing federal Privacy of Consumer Information 
regulations, as adopted by the Office of the Comptroller of the 
Currency, 
Code of Federal Regulations, Part 40 (2001); the 
Board of Governors of the Federal Reserve System, 
Code of 
Federal 
Regulations, 
Part 
(2001); 
the 
Federal 
Deposit 
Insurance Corporation, 12 Code of Federal Regulations, Part 332 
(2001); 
the Office of Thrift Supervision, 
Code of Federal 
Regulations, 
Part 
(2001); 
the 
National 
Credit 
Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); 
the Federal Trade Commission, 
Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 17 
Code of Federal Regulations, Part 248 (2001), if the merchant is 
a financial institution as defined in those regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section 1711-C or 
Title 24 A, 
chapter 24. 
This subsection does not apply to a 
supervised financial organization. 
2. 
Opt in: disclosure to nonaffiliated 3rd party. 
A 
merchant reguired to comply with subsection 1 may not disclose, 
directly or through an affiliate, to a nonaffiliated 3rd party 
any nonpublic personal information unless the person to whom the 
information 
pertains 
has 
affirmatively 
consented 
to 
the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by a merchant to a nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm Leach Bliley Act, 
United States Code, 
Section 
6802, 
SUbsection b, paragraph 2 and subsection e. 
3. Use of terms. 
As 
used in this section, 
unless the 
context 
otherwise 
indicates, 
the 
terms 
"affilia~ 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the same meanings as in the federal Gramm Leach Bliley Act, 
United States Code, Section 6801 et seg. (1999). 
Sec. A-5. 9-8 MRS A §161, sub-§2,~, as enacted by PL 2001, c. 
262, Pt. B, §3, is amended to read: 
M. 
~he Except as provided in section 16Z-A, the sharing of 
information to the extent 
permitted by the provisions of 
the federal Gramm-Leach-Bli1ey Act, 15 United States Code, 
Section 6801 et seq. (1999) and the applicable implementing 
federal 
Privacy of 
Consumer 
Information 
regulations, 
as 
adopted by the Office of the Comptroller of the Currency, 12 
Code of Federal Regulations, Part 40 (2001); the Board of 
Governors of the Federal Reserve System, 12 Code of Federal 
Regulations, Part 216 (ZOOl); the Federal Deposit Insurance 
Corporation, 
Code 
of 
Federal 
Regulations, 
Part 
(2001); the Office of Thrift Supervision, 12 Code of Federal 
Regulations, 
Part 
(2001); 
the National Credit Union 
Administration, 
Code of Federal Regulations, Part 716 
(2001); the Federal Trade Commission, 
Code of Federal 
Regulations, Part 313 (2001); or the Securities and Exchange 
Commission, 
Code 
of 
Federal 
Regulations, 
Part 
(2001). 
This 
paragraph is 
not 
intended 
to 
permit 
the 
release of health care information except as permitted by 
Title 22, section 1711-C or Title 24-A, chapter 24; or 
Sec. A-6. 9·B MRSA §162·A is enacted to read: 
§162-A. 
Disclosure of nonpublic personal information to 
nonaffiliated 3rd party 
1. 
Opt 
in: 
disclosure to 
DODaffiliated 
3rd party. 
A 
financial institution authorized to do business in this State or 
credit union authorized to do business in this State may not 
disclose, directly or through an affiliate, to a nonaffiliated 
3rd party any nonpublic personal information unless the person to 
whom the information pertains has affirmatively consented to the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by a financial institution authorized to do business 
in this State or credit union authorized to do business in this 
State 
to 
a 
nonaffiliated 
3rd 
party 
to 
the 
extent 
such 
a 
disclosure is otherwise permitted by this chapter or the federal 
Grarnm-Leach-Bliley Act, 
United States 
Code, 
Section 
6802. 
subsection b, paragraph 2 and subsection e. 
2. Use of terms. 
As 
used in this section, 
unless the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate," 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the same meanings as in the federal Gramm-Leach-Bliley Act. 
United States Code, Section 6801 et seg. (1999). 
Sec. A·7. 9·B MRSA §241, sub·§13, as reallocated by RR 200l, 
c. 1, §15, is amended to read: 
13. 
Privacy 
of 
consumer 
information. 
A 
financial 
institution authorized to do business in this State or a credit 
union authorized to do business in this State shall comply with 
the 
prov~s~ons 
of 
section 
162-A 
and 
the 
federal 
Gramm-Leach-BUley Act, 15 United States Code, Section 6801 et 
seq. 
(1999) and the applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 
(2001); the Board of Governors of the Federal Reserve System, 
Code of Federal Regulations, Part 216 
(2001); 
the Federal 
Deposit Insurance Corporation, 
Code of Federal Regulations, 
Part 332 (2001); the Office of Thrift Supervision, 12 Code of 
• 
.. 
• 
Federal Regulations, 
Part 573 
(2001); or the National Credit 
Union Administration, 12 Code of Federal Regulations, Part 716 
(2001). 
This subsection is not intended to permit the release of 
health care information except as permitted by Title 22, section 
1711-C or Title 24-A, chapter 24. 
Any 
violation 
of 
this 
subsection 
is 
an 
anticompetitive 
or 
deceptive practice for 
the 
purposes of this chapter and is 
subject to the remedies provided in this chapter in addition to 
remedies otherwise provided by law . 
Sec. A-S. 24-A MRSA §2215, sub-§1, tJ, as enacted by PL 1997, 
c. 677, §3 and affected by §5, is repealed. 
Sec. A-9. 24-A MRSA §2215, sub-§1, tp, as amended by PL 2001, 
c. 457, §21, is further amended to read: 
P. 
To an affiliate whose only use of the information will 
be in connection with an audit of the regulated insurance 
entity or the marketing of a product or service of the 
affiliate, 
if 
the 
information 
disclosed 
for 
marketing 
purposes does not include health care information and if the 
affiliate agrees not to disclose the information for any 
other purpose or to unaffiliated persons; 9~ 
Sec. A-10. 24-A MRSA §2215, sub-§l, tQ, as enacted by PL 2001, 
c. 457, §22, is amended to read: 
Q. 
In order to protect the public health and welfare, to 
state governmental entities only insofar as necessary to 
enable those entities to perform their duties when reporting 
is required or authorized by lawT~ 
Sec. A-II. 24-A MRSA §2215, sub-§I, tR is enacted to read: 
R. 
To 
the 
extent 
permitted 
by 
the 
federal 
Gramrn-Leach-Bliley Act. 15 United States Code. Section 6802. 
subsection b. parag-raph 2 and subsection e as long-
as the 
information 
disclosed 
does 
not 
include 
health 
care 
information. 
Sec. A-12. 24-A MRSA §2215, sub-§2 is enacted to read: 
2. 
Qpt 
in: 
disclosure to nonaffiliated 3rd party. 
A 
reg-u1ated insurance entity or insurance support org-anization may 
not 
disclose. 
directly 
or 
through 
an 
affiliate. 
to 
a 
nonaffiliated 3rd party any nonpub1ic personal information unless 
the person to whom the information pertains has affirmatively 
consented to the disclosure in writing and has not withdrawn that 
consent. 
This subsection does not prohibit the disclosure of 
nonpublic personal information by a regulated insurance entity or 
insurance support organization to a nonaffiliated 3rd party to 
the extent such a disclosure is permitted by subsection 1 or the 
Jederal Gramrn-Leach-Bliley Act. 
United States Code, Section 
6802, subsection b, paragraph 2 and subsection e. 
As used in 
this subsection, 
unless the context otherwise indicates, 
the 
terms 
"affiliate," 
"nonaffiliated 
3rd 
party" 
and 
"nonpubli~ 
personal information" have the sarne meanings as in the federal 
Gramm-Leach-Bliley Act. 15 United States Code, Section 6801 et 
seg. (1999), 
Sec. A-I3. 30-A MRSA §3964-A, sub-§4, as enacted by PL 2001, 
c. 262, Pt. E, §1, is repealed and the following enacted in its 
place: 
4. 
Privacy of CO.A§.YQ!er financial information. 
The privacy 
of consumer financial information is subject to the following. 
A. 
Except 
as 
provided in paragraph 
B with respect to 
disclosure 
of 
nonpublic 
personal 
information 
to 
nonaffiliated 3rd parties, a pawnbroker shall comply with 
the provisions of the federal Gramro-Leach-Bliley Act. 
United States Code, 
Section 6801 et seg. 
(1999) 
and the 
applicable 
implementing 
federal 
Privacy 
of 
Consumer 
Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations. 
Part 40 
(2001); 
the 
Board of 
Governors 
of the Federal 
Reserve System. 
Code of Federal Regulations, Part 216 
(2001); the Federal Deposit Insurance Corporation, 12 Code 
of Federal Regulations. 
Part 
(2001); 
the Office of 
Thrift Supervision, 12 Code of Federal Regulations, Part 573 
(2001); the National Credit Union Administration, 12 Code of 
Federal Regulations, 
Part 
(2001); 
the Federal Trade 
Commission, 16 Code of Federal Regulations, Part 313 (2001); 
or 
the Securities 
and 
Exchange 
Commission. 
Code 
of 
Federal Regulations, Part 248 (2001). if the pawnbroker is a 
financial institution as defined in those regulations. 
This 
paragraph is not intended to permit the release of health 
care information except as permitted by Title 22, section 
1711-C or Title 24-A. chapter 24. 
B. 
A pawnbroker reguired to comply with paragraph A may not 
disclose. 
directly 
or 
through 
an 
affiliate, 
to 
a 
nonaffiliated 3rd party any nonpublic personal information 
unless 
the person to whom 
the 
information pertains has 
affirmatively consented to the disclosure in writing and has 
not 
withdrawn 
that 
consent. 
This 
paragraph 
does 
not 
prohibit the disclosure of nonpublic personal information by 
a pawnbroker to a nonaffiliated 3rd party to the extent such 
a disclosure is permitted by the federal Gramrn-Leach-Bliley 
.. 
• 
Act, 
United States Code, 
Section 6802, 
subsection b, 
paragraph 2 and subsection e. 
C. 
As used in this subsection, unless the context otherwise 
indicates, the terms "affiliate," "nonaffiliated 3rd party" 
and "nonpublic personal information" have the same meanings 
as in the federal Gramm-Leach-Bliley Act, 15 United States 
Code, Section 6801 et seg. (1999). 
Sec. A-14. 32 MRSA §6146, as enacted by PL 2001, c. 262, Pt. 
E, §2, is repealed and the following enacted in its place: 
§6146. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal 
information 
to 
nonaffiliated 
3rd parties, 
a 
check 
cashing business or foreign currency exchange business shall 
comply with the provisions of the federal Gramm-Leach-Bliley Act, 
United States Code, 
Section 6801 et seg. 
(1999) 
and the 
applicable implementing federal Privacy of Consumer Information 
regulations, as adopted by the Office of the Comptroller of the 
Currency, 
Code of Federal Regulations, Part 40 
(2001); the 
Board of Governors of the Federal Reserve System, 
Code of 
Federal 
Regulations, 
Part 
(2001); 
the 
Federal 
Deposit 
Insurance Corporation, 12 Code of Federal Regulations, Part 332 
(2001); the Office of Thrift Supervision, 
Code of Federal 
Regulations, 
Part 
(2001); 
the 
National 
Credit 
Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); 
the Federal Trade Commission, 
Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 17 
Code 
of Federal Regulations, 
Part 
(2001), 
if the 
check 
cashing business or 
foreign currency exchange business is 
a 
financial institution as defined in those regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section l7ll-C or 
Title 24-A, chapter 24. 
2. 
Qpt in: disclosure to nonaffiliated 3rd party. 
A check 
cashing business or foreign currency exchange business reguired 
to comply with subsection 1 may not disclose, directly or through 
an affiliate, to a nonaffiliated 3rd party any nonpublic personal 
information unless the person to whom the information pertains 
has affirmatively consented to the disclosure in writing and has 
not withdrawn that consent. 
This subsection does not prohibit 
the disclosure of nonpublic personal 
information by 
a 
check 
cashing business or foreign currency exchange business 
to 
a 
nonaffiliated 3rd party to 
the extent such 
a 
disclosure is 
permitted by the federal G~-Leach-Bliley Act, 15 United States 
Code, Section 6802, subsection b, paragraph 2 and subsection e. 
3. Use of terms. 
As 
used in this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate---'-'-
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the Same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999). 
Sec. A·IS. 32 MRSA §6162, as enacted by PL 2001, c. 262, Pt. 
E, §3, is repealed and the following enacted in its place: 
§6l62. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, an operator 
shall 
comply 
with 
the 
prov~s~ons 
of 
the 
federal 
Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et. 
seq. 
(1999) and t.he applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 
(2001); the Board of Governors of the Federal Reserve System, 
Code of Federal Regulations, Part 216 
(2001); 
the Federal 
Deposit Insurance Corporation, 
Code of Federal Regulations, 
Part 332 (2001); the Office of Thrift Supervision, 12 Code of 
Federal Regulations, Part 573 (2001); the National Credit Union 
Administration, 12 Code of Federal Regulations, Part 712 (2001); 
the Federal Trade 
Commissi.o~6 Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 17 
Code of Federal Regulations, Part 248 (2001), if the operat.or is 
a financial institution as defined in those regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section 1711-C or 
Title 24-A, chapter 24. 
2. 
Opt 
in; 
disclosure to nonaffiliated 3rd party. 
An 
operat.or required to comply with subsection 1 may not disclose, 
directly or through an affiliate, to a nonaffiliated 3rd party 
any nonpublic personal information unless the person to whom the 
information 
pertains 
has 
affirmatively 
consented 
to 
the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by an operator to a nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm Leach-Bliley Act, 
United States Code, 
Section 6802, 
subsection b, paragraph 2 and subsection e. 
3. 
Use of terms. 
As 
used in this section, 
unless the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate, " 
"nonaffiliated 3rd party" and "nonpublic personal information" 
• 
• 
" 
have the same meanin~~ in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seg. (1999). 
Sec. A·16. 32 MRSA §10206 is enacted to read: 
§l0206. 
Disclosure of nonpublic personal information to 
nonaffiliated 3rd party 
1. Opt in; disclo&u~EL~2-~QPaffiliated 3rd party. 
A person 
subject to this chapter may not disclose, directly or through an 
affiliate, to a nonaffiliated 3rd party any nonpublic personal 
information unless the person to whom the information pertains 
has affirmatively consented to the disclosure in writing and has 
not withdrawn that consent. 
This subsection does not prohibit 
the disclosure of nonpublic personal information by 
a 
person 
subject to this chapter to a nonaffiliated 3rd party to the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Gramm-Leach-Bliley Act, 
United States 
Code, 
Section 
6802, 
subsection b, paragraph 2 and subsection e. 
2. 
Use of terms. 
As 
used in this section, 
unless the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate," 
"nona(filiated 3rd party" and "nonpublic personal information" 
have the same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seg. (1999), 
Sec. A·17. 32 MRSA §I0313, sub·§l, ~L, as enacted by PL 2001, 
c. 262, Pt. D, §3, is amended to read: 
L. 
Has failed to comply with the reguirements of section 
10206 
or 
the 
privacy 
provisions 
of 
the 
federal 
Gramm-Leach-Bliley Act, 15 United States Code, Section 6801 
et seq. (1999) and the implementing Regulation S-P, federal 
Privacy 
of 
Consumer 
Financial 
Information, 
Code 
of 
Federal Regulations, Part 248 (2001) adopted by the United 
States Securities and Exchange Commission. 
This paragraph 
is 
not 
intended 
to 
permit 
the 
release 
of health care 
information except as permitted by Title 22, section 1711-C 
or Title 24-A, chapter 24. 
Sec. A·18. 32 MRSA §11018, as enacted by PL 2001, c. 262, Pt. 
E, §4, is repealed and the following enacted in its place: 
§11018. 
Privacy of consumer financial information 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3 rd parties, a collection 
agency or repossession company shall comply with the provisions 
of the federal Gramm-Leach-Bliley Act, 
United States Code, 
Section 
6801 et seg. 
(1999) 
and the applicable 
implementing 
federal Privacy of Consumer Information regulations, as adopted 
by the Office of the Comptroller of the Currency, 
Code of 
Federal Regulations, Part 40 (2001); the Board of Governors of 
the Federal Reserve System, 12 Code of Federal Regulations, Part 
(2001); the Federal Deposit Insurance Corporation, 12 Code of 
Federal 
Regulations, 
Part 
(2001); 
the 
Office 
of Thrift 
Supervision, 12 Code of Federal Regulations, Part 573 (2001); the 
National 
Credit 
Union 
Administration, 
Code 
of 
Federal 
Regulations, Part 716 (2001); the Federal Trade Commis:ilon, 
Code of Federal Regulations, Part 313 (2001); or the Securities 
and Exchange Commission, 17 Code of Federal Regulations, Part 248 
(2001), if the collection agency or repossession company is a 
financial institution as 
defined in those 
regulations. 
This 
subsection is not intended to permit the release of health care 
information except as permitted by Title 22, section 1711-C or 
Title 24-A, chapter 24. 
2. 
Qpt 
in; 
disclos~re to nonaffiliated 3rd party. 
A 
collection agency or repossession company reguired to comply with 
subsection 1 may not disclose, directly or through an affiliate, 
to a nonaffiliated 3rd party any nonpublic personal information 
unless 
the 
person 
to 
whom 
the 
information 
pertains 
has 
affirmatively consented to the disclosure in writing and has not 
withdrawn that consent. 
This subsection does not prohibit the 
disclosure of nonpublic personal 
information by 
a 
collection 
agency or repossession company to a nonaffiliated 3rd party to 
the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the ~~ 
Gramm-Leach-Bli1ey Act, 
United States Code, 
Section 6802, 
subsection b, paragraph 2 and subsection e. 
3. Use of terms. 
As 
used in this section, 
unless 
the 
context 
otherwise 
indicates, 
the 
terms 
"affiliate," 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the same meanings as in the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seg. (1999). 
Sec. A·19. 33 MRSA §528, as enacted by PL 2001, c. 262, Pt. 
E, §5, is repealed and the following enacted in its place: 
§528. 
privacy duties of settlement agents 
1. 
Compliance with federal law and regulations. 
Except as 
provided in subsection 2 with respect to disclosure of nonpublic 
personal information to nonaffiliated 3rd parties, a settlement 
~gent 
shall 
comply 
with 
th~rovisions 
of 
the 
federal 
Gramm-Leach-Bliley Act, 
Uni ted States Code, Section 6801 et 
.lirul. 
(1999) and the applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 
• 
• 
(2001); the Board of Governors of the Federal Reserve System. 
Code of Federal Regulations. Part 216 
(2001); 
the Federal 
Deposit Insurance Corporation. 
Code of Federal Regulations. 
Part 332 (2001); the Office of Thrift Supervision. 
Code of 
Federal Regulations. Part 573 (2001); the National Credit Union 
Administration. 12 Code of Federal Regulations. Part 716 (2001); 
the Federal Trade Commission. 
Code of Federal Regulations. 
Part 313 (2001); or the Securities and Exchange Commission. 17 
Code of Federal Regulations. Part 248 (2001). if the settlement 
agent 
is 
a 
financial 
institution 
as 
defined 
in 
those 
regulations. 
This 
subsection is not 
intended to permit the 
release of health care information except as permitted by Title 
22, section 1711-C or Title 24-A, chapter 24 . 
z. 
Qpt in: di§closure to nonaffiliated 3rd party. 
A 
settlement agent required to comply with subsection 1 may not 
disclose. directly or through an affiliate. to a nonaffiliated 
3rd party any nonpublic personal information unless the person to 
whom the information pertains has affirmatively consented to the 
disclosure in writing and has not withdrawn that consent. 
This 
subsection does not prohibit the disclosure of nonpublic personal 
information by a settlement agent to a nonaffiliated 3rd party to 
the 
extent 
such 
a 
disclosure 
is 
permitted 
by 
the 
federal 
Qramrn-Leach-Bliley Act. 
IS United States Code. 
Section 6802, 
subsection b. paragraph 2 and subsection e. 
3. Use of terms. 
As 
used in this section. 
unless the 
context 
otherwise 
indicates. 
the 
terms 
"affiliate." 
"nonaffiliated 3rd party" and "nonpublic personal information" 
have the Same meanings as in the federal Gramrn-Leach-Bliley Act. 
IS United States Code. Section 6801 et seq. (1999). 
PARTB 
Sec. B·l. Statutory referendum procedure; submission at statewide 
election; form of question; effective date. 
This Act takes effect when 
approved only for the purpose of permitting its submission to the 
legal voters of the State at a statewide election held on the 
Tuesday following the first Monday of November following passage 
of this Act. 
The municipal officers of this State shall notify 
the inhabitants of their respective cities, towns and plantations 
to meet, in the manner prescribed by law for holding a statewide 
election, to vote on the acceptance or rejection of this Act by 
voting on the following question: 
"Do 
you 
favor 
requiring financial services providers 
to 
obtain 
permission 
from 
individuals 
before 
disclosing 
nonpublic personal information to nonaffiliated 3rd parties?" 
The legal voters of each city, town and plantation shall 
vote by ballot on this question and designate their choice by a 
cross or check mark placed within a corresponding square below 
the word "Yes" or "No." 
The ballots must be received, sorted, 
counted and declared in open ward, town and plantation meetings 
and returns made to the Secretary of State in the same manner as 
votes for members of the Legislature. 
The Governor shall review 
the returns and, if it appears that a majority of the legal votes 
are cast in favor of the Act, the Governor shall proclaim that 
fact without delay, and the Act takes effect 30 days after the 
date of the proclamation. 
The Secretary of State shall prepare and furnish to each 
city, town and plantation all ballots, returns and copies of this 
Act necessary to carry out the purposes of this referendum. 
SUMMARY 
Currently, state law conforms to the opt-out provisions of 
the federal Gramm-Leach-Bliley Act regarding the disclosure of 
nonpublic personal information. 
This bill puts in place 
an 
opt-in 
requirement 
so 
that 
financial 
services 
providers, 
including banks, 
credit unions, 
securities firms 
and mortgage 
companies, 
must 
have 
permission 
from 
individuals 
before 
disclosing nonpublic personal information to nonaffiliated 3rd 
parties, 
but 
only 
upon 
approval 
by 
voters 
at 
a 
statewide 
referendum. 
•