An Act To Protect Maine Citizens from Identity Theft (AFTER DEADLINE)
Maine Legislature, Session 122, LD 1671
Committee: Business, Research and Economic Development
Sponsors: PELLETIER-SIMPSON, HOBBINS, BRAUTIGAM, CANAVAN, FAIRCLOTH, SULLIVAN

Legislative Document 
No. 1671 
H.P.1180 
House of Representatives, May 12, 2005 
An Act To Protect Maine Citizens from Identity Theft 
(AFTER DEADLINE) 
Approved for introduction by a majority of the Legislative Council pursuant to Joint Rule 
205. 
Reference to the Committee on Business, Research and Economic Development suggested 
and ordered printed. 
J11~/J1.~ 
MILUCENT M. MacFARLAND 
Clerk 
Presented by Representative PELLETIER-SIMPSON of Auburn. 
Cosponsored by Senator HOBBINS of York and 
Representatives: BRAUTIGAM of Falmouth, CANAVAN of Waterville, FAIRCLOTH of 
Bangor, Senator: SULLIVAN of York. 
Printed on recycled paper 
Be it enacted by the People of the State of Maine as follows: 
Sec. I. 10 MRSA c. 210-B is enacted to read: 
CHAPTER ;nO-B 
NOTICE OF RISK TO PERSQRAL DATA 
S1346. 
Short title 
This cha,pter ma,y be known a,nd cited as "the Notice of Risk 
to Persona,l Da,ta, Act. " 
S1347. 
Definitions 
As 
used 
in this 
cha,pter. 
unless 
the 
context otherwise 
indicates. the following terms ha,ye the following meanings. 
1. 
Business. 
"Business" 
means 
a 
person. 
including 
a 
corpora,tion. doing business in the Sta,te. 
2. 
Encryption. 
"Encryption" means the disguising of data 
using generally accepted pra,ctices. 
3. 
PersonA] information. 
"Persona,l informa,tion" mea,ns an 
indiyidua,l's la,st name in combination with one or more of the 
following 
data elements. 
when either 
the 
name 
or 
the 
da,ta 
elements are not encrypted; 
A. 
Social security number: 
B. 
Driyer' s license number or state identifica,tion number: 
~ 
c. 
Account 
number 
or credit or debit 
ca,rd 
number 
in 
combination with any required security code. access code or 
password that would permit a,ccess to a,n indiyidua,l's account 
or financial records as defined in Title 9-B. section 161. 
4. 
Reasonable 
notification 
procedures. 
"Rea,sona,ble 
notification procedures." with respect to 
a, 
security brea,ch. 
mea,ns procedures that: 
A. 
Use 
a 
security program reasona,bly designed to block 
una,uthorized 
tra,nsa,ctions 
before 
they 
a,re 
charged to 
a 
customer's a,ccount; 
B. 
Provide for notice to be giyen to a, subject person by 
the owner or licensee of a, databa,se or a,n agent of the owner 
or 
licensee 
after 
the 
security 
program 
required 
under 
Page l-LR2362(1) 
Qaragraph A indicat~hat the security breach has resulted 
in 
fraud 
or 
unauthorized 
transactions, 
but 
do 
not 
necessarily require notice in other circumstances; and 
C. 
Are 
subject to examination for 
compliance with the 
requirements 
of 
this 
chapter 
by 
one 
or 
more 
federal 
function~l 
regulators, 
as 
defined 
in 
the 
federal 
Gramm-Leach-Bliley 
Act, 
United 
States 
Code, 
Section 
6809(2), or by the Department of Professional and Financial 
Regulation, 
Office 
of 
Consumer 
Credit 
Regulation 
with 
respect to the operation of the security program and the 
notification procedures. 
5. 
Security breach. 
"Security breach" means the compromise 
of the security, confidentiality or integrity of computerized 
~a.t~e.s.ylts in una.uthorized acquisition of and access to 
personal information maintained by a business or that creates a 
reasonable basis for the conclusion that such acquisition has 
occurred. 
"Security breach" does not include the good faith 
acquisition of personal information by an employee or agent of a 
business 
for 
the purposes of that business if the personal 
information is 
not 
used 
or 
subject 
to 
further 
unauthorized 
disclosure. 
~rJiQn. "Subject person" means a resident of 
this State whose personal information is stored by a business 
that has suffered a security breach resulting in the disclosure 
or possible disclosure of the resident's personal information. 
7. 
Substitute notice. 
"Substitute notice" means: 
A. 
An 
e-mail 
notice, 
if the 
business 
has 
the 
e-mail 
addresses of its customers; 
B. 
A conspicuous posting of the notice 
on 
a 
publicly 
accessible website of the business; or 
=C~. __ ~Pyblication in major media, 
including newspapers of 
general circulation. 
8. 
System. 
"System" 
means 
a 
computerized data storage 
system containing personal information. 
§1348. 
1. 
business 
personal 
1Lreach, 
personal 
acquired 
Database security 
Disclosure of security breach to subject person. 
A 
that 
owns 
or 
licenses 
electronic 
data 
containing 
information, 
following 
the 
discovery of 
a 
security 
shall 
notify 
the 
subject 
person 
whose 
unencrypted 
information was, or is reasonably believed to have been, 
by an unauthorized person. 
2. 
Rotification to owner or licensee. 
A business 
in 
possession of electronic data containing personal information 
that the business does not own or license shall notify the owner 
or 
licensee 
of 
the 
personal 
information if the 
personal 
information was, or is reasonably believed to have been, acquired 
by an unauthorized person through a security breach. 
J. 
Timeliness of notification. 
Except 
as 
provided in 
subsection 4, notification required pursuant to subsections 1 and 
must 
be 
made 
as 
expediently 
as 
possible 
and 
without 
unreasonable delay following: 
A. 
The discovery by the business of a security breach: and 
B. 
Any measures necessary to determine the scope of the 
security breach. prevent further disclosures and restore the 
reasonable integrity of the system. 
4. 
DelAY of notification for law enforcement purposes. 
Notwithstanding subsections 1 and 2, if a law enforcement agency 
determines that the notification required under this section 
would 
impede 
a 
criminal 
investigation, 
notification 
may 
be 
delayed until that law enforcement agency determines that the 
notification will no longer compromise the investigation. 
5. 
Metb~cU; of nQ!;,.i_c.e... 
A bu~s is consJ..de.red to be in 
compliance with this section if the business provides the subject 
person with; 
A. 
Written notice by regular. first-class mail: or 
B. 
Substitute notice, if; 
(1) 
The business demonstrates to the Director of the 
Qffice 
of 
Consumer 
Credit 
Regulation 
within 
tile 
Department of 
Professional 
and Financial 
Regulation 
that the cost of providing direct notice would exceed 
$250,000: 
(2) 
The 
number 
of subject persons to be notified 
exceeds 500,000: or 
(3) 
The business does 
not have sufficient contact 
information to notify the subject persons. 
6. 
Alternative notification procedures. 
Notwithstanding 
the 
requirements of subsections 
and 
2, 
a 
business is in 
compliance with the requirements of this chapter if the business 
maintains its own reasonable notification procedures as part of a 
security policy for personal information and notifies subject 
persons in accordance with that security policy in the event of a 
security breach. 
§1349. 
Enforcement; pena1ties 
1. 
EnfQ~~nt. 
The 
Depgrtmen~t~-=o~f __ ~P~r~o~f~e~s~s~i~o~n~a~l~~a~n~d 
Financial Regulation. Office of Consumer Credit Regulation is 
responsible for enforcement of this chapter. 
2. 
Civil viQl~~i~~. 
A busin~s~~~violates this chapter 
commits a civil violation and is subject to the following: 
A. 
A fine of not more than $5.000 per violation. up to a 
maximum of $25.000 per each day the business is in violation 
of this chapter: 
B. 
Eguitable relief: or 
C. 
Enjoinment from further violations of this chapter. 
3. 
Other rights and remedies. 
In addition to 
a civil 
penalty assessed or relief provided pursuant to subsection 2. a 
subject person injured by a violation of this chapter may bring a 
civil action against the business to recover damages. 
4. 
Cumulative effect. 
The rights and remedies available 
under this section are cumulative and do not affect or prevent 
rights and remedies available under federal or state law. 
SUMMARY 
This bill requires an entity engaged in business in Maine 
that is in possession of electronic data containing personal 
information to disclose any unauthorized acquisition or suspected 
unauthorized acquisition of that personal information to a person 
whose personal information may have been acquired.