An Act To Protect the Privacy of Consumer Financial Information -.
Maine Legislature, Session 124, LD 0783
Committee: Insurance and Financial Services
Sponsors: LEGG, BARTLETT, ADAMS, AYOTTE, BEAUDETTE, BERRY, CONNOR, CROCKETT, DILL, DOSTIE, EBERLE, EVES, FLAHERTY, FLEMINGS, FOSSEL, GOODE, HARLOW, HINCK, WALSH INNES, JONES, MORRISON, NELSON, O'BRIEN, PENDLETON, PERCY, PRESCOTT, RUSSELL, SANBORN, TREAT, VALENTINO, VAN WIE, WAGNER, WEBSTER, ALFOND, BRYANT, GERZOFSKY, SCHNEIDER
Amends: 9-A MRSA §9, 9-A MRSA §10, 9-A MRSA §11, 9-B MRSA §161, 9-B MRSA §241, 24-A MRSA §2215, 30-A MRSA §3964-A, 32 MRSA §6146, 32 MRSA §6162, 32 MRSA §11018, 32 MRSA §16411, 33 MRSA §528

.Legislative Document 
No. 783 
H.P.534 
House of Representatives, February 26,2009 
An Act To Protect the Privacy of Consumer Financial Information 
-. 
Reference to the Committee on Insurance and Financial Services suggested and ordered 
pl1.nted. , 
Presented by Representative LEGG of Kennebunk. 
Cosponsored by Senator BARTLETT of Cumberland and 
'7Y4~ 1/7. 77l1LC~{ 
MILLICENT M. MacFARLAND 
Clerk 
Representatives: ADAMS of Portland, AYOTTE of Caswell, BEAUDETTE of Biddeford, 
BERRY of Bowdoinham, CONNOR of Kennebtmk, CROCKETT of Augusta, DILL of Cape 
Elizabeth, DOSTIE of Sabattus, EBERLE of South Portland, EVES of North Berwick, 
FLAHERTY of Scarborough, FLEMINGS of Bar Harbor, FOSSEL of Alna, GOODE of 
Bangor, HARLOW of Portland, HINCK of Portland, WALSH INNES of Yarmouth, JONES of 
Mount Vernon, MacDONALD of Boothbay, McCABE of Skowhegan, MORRISON of South 
Portland, NELSON of Falmouth, O'BRIEN of Lincolnville, PENDLETON of Scarborough, 
PERCY of Phippsburg; PETERSON of Rumford, PRESCOTT of Topsham, RICHARDSON 'of 
Warren, RUSSELL of Portland, SANBORN of Gorham, SMITHofMonmouth, TREAT of 
Hallowell, VALENTINO of Sa co, VAN WIE of New Gloucester, WAGNER of Lyman, 
WEBSTER of Freeport, Senators: ALFOND of Cumberland, BRYANT of Oxford, 
GERZOFSKY of Cumberland, SCHNEIDER of Penobscot, SIMPSON. of Androscoggin. 
Printed on recycled paper 
Be it enacted by the People of the State of Maine as follows: 
PART A 
,Sec. A-t. 9·:AMRSA §3-314, as enacted by PL 2001, c. 262, Pt. A, §1,lS 
repealed and the following enacted in its place: 
§3-314. Privacy of consumer financial information 
1. Compliance with federal law and regulations. Except as provided in subsection 
7' 
with respect to disclosure of nonpublic personal information to nonaffiliated 3rd parties, 
a creditor shall comply with the provisions of the federal Gramm-Leach-Bliley Act, 15 
United States Code, Section 6801 et seq. (1999) and the applicable implementing federal 
Privacy of Consumer Information regulations,' as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part.40 (2001); the Board 
of Governors of the Federal Reserve System, 12 Code of Federal Regulations, Part 216 
(2001); the Federal Deposit Insurance Corporation, 12 Code of Federal Regulations, Part 
(2001); the Office of Thrift Supervision, 12 Code of Federal Regulations, Part 573 
(2001); the National Credit Union Administration, 12 Code of Federal Regulations, Part 
(2001); the Federal Trade Commission, 16 Code of Federal Regulations, Part 313 
(2001); or the Securities' and Exchange Commission, 17 Code of Federal' Regulatiods, 
Part 248 (2001), if the creditor is a financial institution as defined in those regulations. 
This subsection is' not intended to permit the release of health care information except as 
permitted by ,Title 22, section 1711-C or Title 24-A, chapter 24. This subsection does not 
apply to a supervised financial organization. 
28, 
2. Opt in; disclosure to nonaffiliated 3rd party. A creditor required to comply 
with subsection 1 may not disclose, directly or through an affiliate, to a nonaffiliated 3rd 
party anynonpublic personal information unless the person to whom the information 
. pertains has affirmatively consented to the disclosure in writing and has not withdrawn 
that consent. This subsection does not prohibit the disclosure of nonpublic personal 
information by a creditor to a nonaffiliated 3rd party to the extent such a disclosure is 
permitted by the federal Grainm-Leach-Bliley Act, 15 United States Code, Section 
6802Cb)(2) and (e). 
3. Use ofterms. As used in this section, unless the context otherwise indicates, the 
terms "affiliate," "nonaffiliated 3rd party" and "nonpublic personal information" have the 
same meanings as in the federal Grarnm-Leach-Bliley Act, 15 United States Code, 
Section 6801 et seq. (1999). 
Sec. A-2. 9-A MRSA §9-310, as corrected by RR 2001, c. 1, §14, is repealed and 
the following enacted in its place: 
§9-310. ,Privacy of consumer financial information 
1. Compliance with federal law and regulations. Except as provided in subsection 
with respect to disclosure of nonpublic personal information to nonaffiliated 3rd parties, 
a creditor shall comply with the provisions of the federal Grarnm-Leach-Bliley Act, 15 
United States Code, Section 6801 et seq. (1999) and the applicable implementing federal 
) 
)' 
) 
() 
~ 
" 
(-~ 
L) 
Privacy of Consumer Information regulations, as adopted by the. Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 40 (2001); the Board 
of Governors of the Federal Reserve System, 12 Code of Federal Regulations, Part 216 
(2001); the Federal Deposit Insurance Corporation, 12 Code of Federal Regulations, Part 
(2001); the Office of Thrift Supervision, 12 Code of Federal Regulations, Part 573 
(2001); the National Credit Union Administration, 12 Code of Federal Regulations, Part 
(2001); the Federal Trade Commission, 16 Code of Federal Regulations, Part 313 
(2001); or the Securities and Exchange Commission, 17 Code of Federal Regulations, 
Part 248 (2001), if the creditor is a financial institution as dermed in those regulations. 
This subsection is not intended to permit the release of health care information except as 
permitted by Title 22, section 1711-C or Title 24-A, chapter 24. 
2. Opt in; disclosure to nonaffiliated 3rd party. A creditor required to comply 
with subsection 1 may not disclose, directly or tmough an affiliate, to a nonaffiliated 3rd 
party any nonpublic personal information unless the person to whom the information 
. 
pertains has affirmatively consented to the disclosure in writing and has not withdrawn 
that consent. This subsection does not prohibit the disclosure of nonpubiic personal 
information by a creditor to a nonaffiliated 3rd party to the extent such a disclosure is 
permitted by the federal ·Gramm-Leach-Bliley Act, 15 United States Code, Section 
6802(b)(2) and (e). 
3. Use of terms. As used in this section, unless the context otherwise indicates, the 
terms "affiliate," "nonaffiliated 3rd party" and "nonpublic personal information" have the 
same meanings as in the federal Gramm-Leach-Bliley Act, 15 United States Code, 
Section 6801 et seq. (1999). 
Sec. A-3. 9-A MRSA §10-306, as amended by PL 2005, c. 274, §13, is repealed 
and the following enacted in its place: 
§10-306. Privacy of consumer financial information 
1. Compliance with federal law and regulations. Except as provided in subsection 
with respect to disclosure of nonpublic personal infoimation to nonaffiliated 3rd parties, 
a loan broker shall comply with the provisions of the federal Gramm-Leach-Bliley' Act, 
United States Code, Section 6801 et seq. (1999) and the applicable implementing 
federal Privacy of Conswner Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 40 (2001); the Board 
33. 
of Governors of the Federal Reserve System, 12 Code of Federal Regulations, Part 216 
(2001); the Federal Deposit Insurance Corporation, 12 Code of Federal Regulations, Part 
(2001); the Office of Thrift Supervision, 12 Code of Federal Regulations, Part 573 
(2001); the National Credit Union Administration, 12 Code of Federal Regulations, Part 
(2001); the Federal Trade Commission, 16 Code of Federal Regulations, Part 313 
(2001); or the Securities and Exchange Commission, 17 Code of Federal Regulations, 
Part 248 (2001), if the loan broker is a rmancial institution as dermed in those regulations. 
This subsection is not intended to peimit the release of health care information except as 
permitted by Title 22, section 1711-C or Title 24-A, chapter 24. 
2. Opt in; disclosure to nonaffiliated 3rd party. A credit services organization 
required to comply with subsection 1 may not disclose, directly or through an affiliate, to 
a nonaffiliated 3rd party any nonpublic personal information unless the person to whom 
the information pertains has affirmatively consented to the disclosure in writing and has 
not withdrawn that consent. This subsection does not prohibit the disclosure of nonpublic 
personal information by a credit services organization toa nonaffiliated 3rd party to the 
extent such a disclosure is permitted by the federal Gramri:t-Leach-Bliley Act, 15 United 
States Code, Section 6802(b)(2) and (e). 
3. Use of terms. As used in this section, unless the context otherwise indicates, the 
terms "affiliate," "nonaffiliated 3rd party" and "nonpublic personal information" have the 
same meanings as in the federal Gramm-Leach-Bli1ey Act, 15 United States Code, 
Section6801 et seq. (1999). 
Sec. A-4. 9-A MRSA §11-122, as enacted by PL 2001, c. 262, Pt. A, §4, is 
repealed and the following enacted in its place: 
§11-122. Privacy of consumer financial information 
1. Compliance with federal law and regulations. Except as provided in subsection 
with respect to disclosure of nonpublic personal information to nonaffiliated 3rd parties, 
a merchant who enters into a rental-purchase agreement with a consumer shall comply 
with the provisions of the federal Granim-Leach-Bliley Act, 15 United States Code, 
Section 6801 et seq. (1999) and the applicable implementing federal Privacy of 
Consumer Information regulations, as adopted by the Office of the Comptroller of the 
Currency, 12 Code of Federal Regulations, Part 40 (2001); the Board cifGovemors of the 
Federal Reserve System, 12 Code of Federal Regulations, Part 216 (2001); the Federal 
Deposit Insurance Corporation, 12 Code of Federal Regulations, Part 332 (2001); the 
. Office of Thrift Supervision, 12 Code of Federal Regulations, Part 573 (2001); the 
National Credit Union Administration, 12 Code of Federal Regulations, Part 716 (2001); 
the Federal Trade Commission, 16 Code of Federal Regulations, Part 313 (2001); or the 
Securities and Exchange Commission, 17 Code of Federal Regulations, Part 248 (2001), 
if the merchant is a [mandaI institution as defined in those regulations. This subsection is 
not intended to permit the release of health care information except as permitted by Title 
22, section 1711-C or Title 24-A, chapter 24. 
This subsection does not apply to a 
supervise~fmandal organization. 
2. Opt in; disclosure to nonaffiliated 3rd party. A merchant required to comply 
with subsection 1 may not disclose, directly or through an affiliate, to a nonaffiliated 3rd 
party any nonpublic personal information unless the person fo whom the information 
pertains has affirmatively consented to the disclosure in writing and has not withdrawn 
that consent. This subsection does not prohibit the disclosure of nonpublic personal 
information by a merchant to a nonaffiliated 3rd partY to the extent such a disclosure is 
permitted by the federal Gramm-Leach-Bli1ey Act, 15 United States Code, Section 
6802(b)(2) and (e). 
3. Use of terms. As used in this section, unless the context otherwise indicates, the 
terms "affiliate," "nonaffiliated 3rd partY" and "nonpublic personal information" have the 
same meanings as in the federal Gramm-Leach-Bliley Act, 15 United States Code, 
Section6801 etseq.(1999). 
) 
) 
) 
() 
, 
U 
'6 
! j 
.J 
,23 
, 
" 
. 
,L) 
Sec. A-S. 9-B MRSA §161, sub".§2, ~, as enacted by PL 2001, c. 262, Pt. -E, 
§ 3, is amended to read: 
,M. ::(£e Except as provided in section 162-A, the sharing of infonnation to the extent 
permitted by the provisions of the federal Gramm-Leach-Bliley Act, 15 United States 
Code, Section 6801 et seq. (1999) and the applicable implementing federal Privacy of 
Consumer Infonnation re~lations, as adopted by the Office of the Comptroller of the 
Currency, 12 Code of Federal Regulations, Part 40 (2001); the Board of Governors of 
the Federal Reserve System, 12 Code of Federal RegUlations, Part 216 (2001); the 
Federal Deposit Insurance Corporation, 12 Code of Federal Regulations, Part 332 
(2001); the Office of Thrift Supervision, 12 Code ·of.Federal Regulations, Part 573 
(2001); the National Credit Union Administration, 12 Code of Federal Regulations, 
Part 716 (2001); the Federal Trade Commission, 16 Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 17 Code of Federal 
Regulations, Part 248 (2001). This paragraph is not intended to permit the release of 
health care infonnation except as permitted by Title 22, section 1711-C or Title 24-A, 
chapter 24; or 
Sec. A-6. 9-B MR8A §162-A is enacted to read: 
§162-A. Disclosure of non public personal information to nonaffIliated 3rd party 
1. Opt in; disclosure to nonaffiliated 3rd party. A financial institution authorized 
to do business in this State or a credit union authorized to do business in this State may 
not disclose, directly or through an affiliate,' to a nonaffiliated 3rd party any nonpublic 
personal IDfonnation unless' the person to whOin the infonnation pertains has 
affinnatively consented to the disclosure in writing and has not withdrawn that consent. 
This subsection does not prohibit the disclosure of nonpublic personal infonnation by a 
[mancial institution authorized to do business in this State or a credit union authorized to 
do business in this State to a nonaffiliated 3rd party to the extent such a disclosure is 
otherwise permitted by this chapter or the federal Gramm-Leach-Bliley Act, 15 United 
States Code, Section 6802(b)(2) and (e). 
2. Use of terms. As used in this section, unless the context otherwise indicates, the 
tenns ilaffiliate," "nonaffiliated 3rd party" and "nonpublic personal infonnation" have the' 
same meanings as in the federal Gramm-Leach-Bliley Act, 15 United S'tates Code, 
Section 6801 et seq. (1999). 
Sec. A-7. 9-B MRSA §241, sub-§13, as reallocated by RR 2001, c. 1, §15, is 
amended to read: 
. 
13. . Privacy of consumer information. A [mancial institution authorized to do 
business in this State or a credit union authorized to do business in this State shall comply 
with the provisions of section 162-A and the federal Gramm.;Leach'-Bliley Act, 15 United 
States Code, Section 6801 et seq~ (1999) and the applicable implementing federal privacy 
of Consumer Infonnation regulations, as adopted by the Office of the Comptroller of the 
Currency, 12 Code of Federal Regulations, Part 40 (2001); the Board of Governors of the 
Federal Reserve System, 12 Code of Federal Regulations, Part 216 (2001); the Federal 
Deposit Insurance Corporatio.l)., 12 Code of Federal Regulations, Part 332 (2001); the 
Office of Thrift Supervision, 12 Code of Federal Regulations, Part 573 (2001); or the 
National Credit Union Administration, 12 Code of Federal Regulations, Part 716 (2001). 
This subsection is not intended to'pennit the release of health care infonnation except as 
pennitted by Title 22, section 1711-C or Title 24-A, chapter 24. 
. Any violation of this subsection is an anticompetitive or deceptive practice for the 
purposes' of this chapter and is subj ect to the remedies provided in this chapter in addition 
to remedies. otherwise provided by law. 
Sec. A..;8. 24-A MRSA §2215, sub-§l, c;rJ, as enacted byPL 1997, c. 677, §3 and 
affected by §5, is repealed. 
Sec. A-9. 24-A MRSA §2215, sub-§l, ~Q, as amended by PL 2005, c. 127, §2, 
is further amended to read: 
Q. In order to protect the public health and welfare, to state governmental entities 
only insofar as necessary to enable those entities to perfonn their duties when 
reporting is required or authorized by law; eF 
Sec. A-lO. 24-A MRSA §2215, sub-§l, 6fiR, as enacted by PL 2005, c. 127, §3, 
is amended to read: 
R. By a regulated insurance entity that is also a covered entity or is a business 
. associate of a covered entity under the standards for privacy of individually 
identifiable health infonnation, 45 Code of Federal Regulations, Paits 160 and 164 
(2004), if the disclosure is made for purposes of treatment, payment or health care 
operations of the disclosing or receiving entity and is made in full compliance with 
the requirements of the standards for privacy of individually identifiable health 
infonnation and any applicable business associate agreement:-; or' 
Sec. A-ll~ 24-A MRSA §2215, sub-§l, ~S is enacted to read: 
S. To the extent pennitted by the federal Gramm-Leach-Bliley Act, 15 United States 
Code, Section 6802(b)(2) and (e) as long as the infonnation disclosed does not 
include health care infonnation. 
Sec. A-12. 24-A MRSA §2215, sub-§2 is enacted to read: 
2. Opt in; disclosure to nonaffiliated 3rd party. A regulated insurance entity or 
insurance support organization may not disclose, directly or through an affiliate, to a 
nonaffiliated 3rd party any nonpublic personal infonnation unless the person to whom the 
infonnation pertains has affirmatively consented to the disClosure' in writing and has not 
withdrawn that consent. This subsection does not prohibit the disclosure of nonpublic 
personal infonnation by a regulated insurance entity or insurance support organization to 
a nonaffiliated 3rd party to the extent such a disclosure is pennitted by subsection 1 or the 
federal Gramm-Leach-BliIey Act, 15 United States Code, Section 6802(b)(2) and (e). As 
used in this subsection, unless the context otherwise indicates, the terms "affiliate," 
"nonaffiliated 3rd party" and "nonpublic personal infonnation" have the same meanings 
as ill the federal Gramm-Leach-Bliley Act, 15 United States Code, Section 6801 et seq. 
(1999). 
) 
) 
) 
() 
L 
(-j 
-u 
8. 
Sec. A-13. 30-A MRSA §3964-A, sub-§4, as enacted by PL 2001, c. 262, Pt. E, 
§ 1, is repealed and the following enacted in its place: 
4. Privacy of consumer financial information. The privacy of consumer financial 
infonnation is subject to this subsection. 
. 
A; Except as provided in paragraph B with respect to disclosure of nonpublic 
personal infonnation to nonaffiliated 3rd parties, a pawnbroker shall comply with the 
provisions of the federal Gramm-Leach-Bliley Act, 15 United States Code, Section 
6801 et seq. (1999) and the applicable implementing federal Privacy of Consumer 
Infonnation regulations, as adopted by the Office of the Comptroller of the Currency, 
Code of Federal Regulations, Part 40 (2001); the Board of Governors of the 
Federal Reserve System, 12 Code of Federal Regulations, Part 216 (2001); the 
Federal Deposit Insurance Corporation, 12 .Code of Federal Regulations, Part 332 
(2001); the Office of Thrift Supervision, ·12 Code of Federal Regulations, Part 573 
(2001); the National Credit Union Administration, 12 Code of Federal Regulations, 
Part 716 (2001); the Federal Trade Commission, 16 Code of Federal Regulations, 
Part 313 (2001); or the Securities and Exchange Commission, 17 Code of Federal 
Regulations, Part 248 (200 l), if the pawnbroker is a rmancial institution as dermed in 
those regulations. This paragraph is not intended to permit the release of health care 
infonnation except as permitted by Title 22, section 1711-C or Title 24-A, chapter 
24. 
B. A pawnbroker required to comply with paragraph A may not disclose, directly or 
through an affiliate, to a nonaffiliated 3rd party any nonpublic personal infonnati6n 
unless the person to whom the infonnation pertains has affrrmatively consented to the 
disclosure in writing and has not withdrawn that consent. This paragraph does not 
prohibit the disclosure, of nonpublic personal infonnation by a pawnbroker to a 
nonaffiliated 3rd party to the extent such a disclosure is permitted by the federal-
Gramm-Leach-Bliley Act, 15 United States Code, Section 6802(b)(2) and (e). 
C. 
As used in this subsection, -unless the context otherwise indicates, the tenns 
"affiliate," "nonaffiliated 3rd party" and "nonpublic personal infonnation" have the 
same meanings as ill the federal Gramm-Leach-Bliley Act, 15 United States Code, 
Section 6801 et seq. (1999). 
. 
Sec. A .. 14 .. 32 MRSA §6146, as enacted by PL 2001, c. 262, Pt. E, §2, is repealed 
. and the following enacted in its place: 
§6146. Privacy of consumer financial information 
1. Compliance with federal law and regulations. Except as provided in subsection 
with respect to disclosure of nonpublic personal infonnation to nonaffiliated 3rd parties, 
a check cashing business or foreign currency exchange business shall comply with the 
provisions of the federal Gramm-Leach-Bliley Act, 15 United States Code, Section 6801 
et seq. (1999) and the applicable implementing federal Privacy of Consumer Infonnation 
regulations, as adopted by the Office of the Comptroller of the Currency, 12 Code of 
Federal Regulations, Part 40 (2001); the Board ·of Governors of the Federal Reserve 
System, 12 Code of Federal Regulations; Part 216 (2001); the Federal Deposit Insurance 
Corporation, 12 Code of Federal Regulations, Part 332 (2001); the· Office of Thrift 
5-
Supervision, 12 Code of Federal Regulations, Part 573 (2001); the National Credit Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); the Federal Trade 
Commission, 16 Code of Federal Regulations, Part 313 (2001); or the Securities and 
Exchange Commission, 17 Code of Federal Regulations, Part 248 (2001), if the check 
cashing business or foreign currency exchange business is a [mancial institution as 
de[med in those regulations.' This subsection is not intended to permit the release of 
health care infonnation except as permitted by Title 22, section 17ll-C or Title 24-A, 
, chapter 24. 
2. Opt in; disclosure to nonaffliliated 3rd party. A check cashing business or 
foreign currency exchange business required to comply with subsection 1 may not 
disclose, directly or through an affiliate, to a nonaffiliated 3rd party any nonpublic 
personal infonnation unless the' person to whom the infonnation pertains has 
affrrmatively consented to the disclosure in writing and has not withdrawn that consent. 
, 14 
This subsection does not prohibit the disclosure of nonpublic personal inforrilation by a 
'IS 
check cashing business or foreign currency exchange business to a nonaffiliated 3rd party 
to the extent such a disclosure is permitted bY,the federal Gramm-Leach-Bliley Act, 15 
United States Code, Section 6802(b)(2) and (e). 
3. Use of teirms. As used in this section, unless the context otherwise indicates, the 
tenns "affiliate,'" "nonaffiliated 3rd party" and "nonpublic personal infonnation" have the 
' 
same meanings as in the federal Gramm-Leach-Bliley Act, 15 United States Code, 
Section 6801 et seq. (1999). 
Sec. A.:.15. 32 MRSA §6162, as en~cted by PL 2001, c. 262, Pt. E, §3, is repealed--
and the following enacted inits place: 
§6162. Privacy of consumer financial information 
,1. Compliance with federal law and regulations. Except as provided in subsection 
with respect to disclosure of nonpublic personal infonnation to nonaffiliated 3rd parties, 
an operator shall comply with the provisions of the federal Gramm-teach-Bliley Act, 15 
United States Code, Section 6801 et seq. (1999) and the applicable implementing federal 
Privacy of Consumer Infonnation regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 40 (2001); the Board 
of Governors of the Federal Reserve System, 12 Code of Federal Regulations, Part 216 
, (2001); the Federal Deposit Insurance Corporation, 12 Code of Federal Regulations, Part 
(2001); the Office of Thrift Supervision, 12 Code of Federal Regulations, Part 573 
(2001); the National Credit Union Administration, 12 Code of Federal Regulations, Part 
_ 
(2001); the Federal Trade Commission, 16 Code of Federal Regulations; Part 313 
(2001); or the Securities and Exchange Commission, 17 Code of Federal Regulations, , 
Part 248 (2001), if the operator is a [mancialinstitutionas defined in those regulations. 
This subsection is not intended to permit the release of health care infonnation except as , 
permitted by Title 22, section 17l1-C or Title .24~A, chapter 24. 
2.' Opt in; disclosure to nonaffiliated 3nll party. An operator required to comply 
with subsection 1 may not disclose, directly or through an affiliate, to a nonaffi.liated 3rd 
party any nonpublic personal infonnation unless the person to whom the infonnation 
pertains has affinnatively consented to the disclosure in writing and has not withdrawn 
) 
), 
) 
() 
( 
-30 
--
I 
I' 
-37 
I 
. 40 
L) 
that consent. This subsection does not prohibit the disclosure of nonpublic personal 
information by an operator to a nonaffiliated 3rd party to "the extent such a disclosure is 
permitted by the federal Gramm-Leach~B1iley Act, 15 United States Code, Section 
6802(b)(2) and (e)." 
3. Use of terms. As used in this section, unless the context otherwise indicates, the 
terms "affiliate," "nonaffiliated 3rd party" and "nonpublic personal information" have the 
same meanings as in the federal Gramm-Leach-Bliley Act, 15 United States Code, 
Section 6801 et seq. (1999). 
. 
Sec. A-16. 32 MRSA §11018, as enacted by PL 2001, c. 262, Pt. E, §4, is 
repealed and the following enacted in its place: 
&11018. Privacy of consumer financial information 
1. Compliance with federal law and regulations. Except as provided in subsection 
with respect to disclosure of nonpublic personal information to nonaffiliated 3rd parties, 
a collection agency or repossession company shall comply with the provisions of the 
federal Gramm-Leach-Bliley Act, 15 United States Code, Section 6801 et seq. (1999) and 
the applicable implementing federal Privacy of Consumer Information regulations, as 
adopted by the Office of the Comptroller of the Currency, 12 Code of Federal 
Regulations, Part 40 (2001); the Board of Governors of the Federal Reserve System, 12 
Code of Federal Regulations, Part 216 (2001); the Federal Deposit Insurance 
Corporation, 12 Code of Federal Regulations, Part 332 (2001); the Office of Thrift 
Supervision, 12 Code of Federal Regulations, Part 573 (2001); the National Credit Union 
Administration, 12 Code of Federal Regulations, Part 716 (2001); the Federal Trade 
Commission, 16 Code of Federal Regulations, Part 313 (2001); or the Securities and 
Exchange Commission, 17 Code of Federal Regulations, Part 248 (2001), tfthe collection 
agency or repossession company is a [mancial institution as defined in those regulations. 
This subsection is not intended to permit the release of health care information except as 
permitted by Title 22, section 1711-C or Title 24-A, chapter 24. 
2. 
Opt in; disclosure to nonaffiliated 3rd pa:rty. 
A collection agency or 
repossession company required to comply with subsection 1 may not disclose, directly or 
through an affiliate, to a nonaffiliated 3rd party any nonpublic personal information 
unless the person to whom the information pertains has affirmatively consented to the 
disclosure in writing and has not withdrawn that consent. This subsection does not 
prohibit the disclosure of nonpublic personal information by a collection agency or 
. repossession company to a nonaffiliated 3rd party to the extent such a disclosure is 
permitted by the federal Gramm-Leach-Bliley Act, 15 United States Code, Section 
6802(b)(2) and (e). 
.. -
-~ 
-3; -Use of terms. As used in this section, unless the context otherwise indicates, the 
"_" terms "affiliate," "nonaffiliated 3rd party" and "nonpublic personal information" have the 
same meanings as in the federal Gramm-Leach-Bliley Act, 15 United States Code, 
Section 6801 et seq. (1999) . 
Sec. A'-17. 32 MRSA §16411, sub-§9, as enacted by PL 2005, c. 65, Pt. A, §2, is 
amended to read: 
9. Privacy provisions. A broker-dealer licensed or required to be licensed under 
this chapter and an investment adviser licensed or required. to be licensed under this 
chapter shall comply with the privacy provisions of the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999) and the implementing Regulation S-P, 
federal Privacy of Consumer Financial illformation, 17 Code of Federal Regulations, Part 
(2001) adopted by the Securities and Exchange Commission. This subsection is not 
intended to permit the release of health care information except as permitted by Title 22, 
section 1711-C or Title 24-A, chapter 24. 
. 9 
A. A person subject to this chapter may not disclose, directly or through an affiliate, 
to a nonaffiliated 3rd party any nonpublic personal information unless the person to 
whom the information pertains has affmnatively consented to the· disclosure in 
writing and has not withdrawn that consent. This paragraph does not prohibit the 
disclosure of nonpublic personal information by a person subject to this chapter to a 
14· 
nonaffiliated 3rd party to the extent such a disclosure is permitted by the federal 
Gramm-Leach-Bliley Act, 15 United States Code, Section 6802(b)(2) and (e). As 
used in this paragraph, unless the context otherwise indicates, the terms "affiliate," 
"nonaffiliated 3rd party" and "nonpublic personal information" have the same 
meanings as in the federal Gramm-Leach-Bliley Act, 15 United States Code, Section 
6801 et seq. (1999). 
Sec. A-1S. 33 MRSA §528, as enacted by PL 2001, c. 262, Pt. E, §5, is repealed 
21· 
and the following enacted in its place: 
§528. Privacy duties of settlement agents 
1. Compliance with federal law and regulations. Except as provided in subsection 
with respect to disclosure of non public personal information to nonaffiliated 3rd parties, 
a settlement agent shall comply with the provisions of the federal Gramm-Leach-Bliley 
Act, 15 United States Code, Section 6801 et seq. (1999) and the applicable implementing 
federal Privacy of Consumer Information regulations, as adopted by the Office of the 
Comptroller of the Currency, 12 Code of Federal Regulations, Part 40 (2001); the Board 
of Governors of the Federal Reserve System, 12 Code of Federal Regulations, Part 216 
(2001); the Federal Deposit Insurance Corporation, 12 Code of Federal Regulations, Part 
(2001); the Office of Thrift Supervision; 12 Code of Federal Regulations, Part 573 
(2001); the National Credit Union Administration, 12 Code of Federal Regulations, Part 
(2001); the Federal Trade Commission, 16 Code of Federal· Regulations, Part 313 
(2001); or the Securities and Exchange Commission, 17 Code of Federal Regulations, 
Part 248 (2001), if the settlement agent is a financial institution . as defined in those 
regulations. . This subsection is not intended to permit the release of health care 
information except as permitted by Title 22; section 1711-C or Title 24-A, chapter 24. 
2. Opt in;disc!osure to nonaffiliated 3rd party. A settlement agent required to 
comply with subsection 1 may. not' disclose, directly or through an affiliate, to a 
nonaffiliated 3rd party any nonpublic personal information unless the person to whom the 
information pertains has affirmatively consented to the disclosure in writing and has not 
withdrawn that consent. This subsection does not prohibit the disclosure of nonpubiic 
personal information by a settlement agent to a nonaffiliated 3rd party to the extent such a 
) 
) 
') 
. 1 
() 
i 
~~ 
'~/ 
disclosure is pennitted by the federal Gramm-Leach-Bliley Act, 15 United States Code, 
Section 6802(b)(2) and (e). 
3. Use of terms. As used in this section, unless the context otherwise indicates, the 
terms "affiliate," "nonaffiliated 3rd party" and "nonpublic personal information" have the 
same meanings as in the federal Gramm-Leach-Bliley Act, 15 United States Code, 
Section 6801 et seq. (999). 
PARTB 
Sec. B-1. Statutory referendum procedure; submission at election; form 
of question; effective date. This Act must be submitted to the legal voters of the State 
at a statewide election held in the month of November.following passage of this Act. The 
municipal officers of this State shall notify the inhabitants of their respective cities, towns 
and plantations to meet, in the manner prescribed .by law for holding a statew~de election, 
to vote on the acceptance or rejection of this Act by voting on the following question: 
"Do you favor requiring financial services providers to obtain pennission from 
individuals before disclosing nonpublic personal information to nonaffiliated 3rd 
parties?" 
. 
. 
, 
The legal voters of each city, town and plantation shall vote by ballot on this question 
and designate their choice by a cross or check mark placed within a corresponding square 
below the word "Yes" or '.'No." 
The ballots must be received, sorted, counted.and 
declared in open ward, town and plantation meetings and returns made to the Secretary of 
State in the same manner as votes for members of the Legislature. The Governor shall 
review the returns. If a majority of the legal votes are cast in'favor of this Act, the 
Governor shall proclaim the result without delay and this Act becomes effective 30 days 
after the date of the proclamation .. 
The Secretary of State shall prepare and furnish to each city, town and plantation all 
ballots, returns and copies of this Act necessary to carry out the purposes of this . 
referendum. 
. 
. 
SUMMARY 
Currently, state law conforms to the opt-out provisions of the federal Gramm-Leach-
Bliley Act regarding the disclosure of nonpublic personal inforniation. This bill puts in 
place an opt-in requirement so that fmancial services providers, including banks, credit 
unions, securities firms and mortgage companies, must have pennission from individuals 
before disclosing nonpubli.c personal information to nonaffiliated 3rd parties. The bill is 
contingent on approval by voters at a statewide referendum.