An Act To Amend the Laws Governing Notification after a Security Breach Involving Personal Information
Maine Legislature, Session 124, LD 0970
Committee: Insmance and Financial Services
Sponsors: PRIEST, GOODE, LEGG, ROTUNDO, TREAT
Amends: 10 MRSA §1347, 10 MRSA §1347-A, 10 MRSA §1348, 10 MRSA §1349

Legislative Document 
No. 970 
H.P.672 
House of Representatives, March 10,2009 
An Act To Amend the Laws Governing Notification after a Security 
Breach Involving Personal Information 
Reference to the Committee on Insmance and Financial Services suggested and ordered 
printed. 
Presented by Representative PRIEST of Bnmswick. 
17/;U~d 1/1. md£~{ 
MILLICENT M. MacFARLAND 
Clerk 
Cosponsored by Representatives: GOODE of Bangor, LEGG of Kennebunk, ROTUNDO of 
Lewiston, TREAT of Hallowell. 
Prinl~d on recycled paper 
Be it enacted by the People of the State of Maine as follows: 
Sec. 1. 
MRSA §1347, sub-§1, as amended by PL 2005, c. 583, §1 and 
affected by § 14, is further amended to read: 
1. Breach of the security of the system. "Breach of the security of the system" or 
"security breach" means unauthorized acquisition, release or use of an individual's 
computerized data that includes personal information that compromises the security, 
confidentiality or integrity of personal information of the individual maintained by a 
person. Good faith acquisition, release or use of personal information by an employee or 
agent of a person on behalf of the person is not a breach of the security of the system if 
the personal information is not used for or subject to further unauthorized disclosure to 
another person. 
Sec. 2. 10 MRSA §1347-A is enacted to read: 
§1347-A. Release or use of personal information prohibited 
It is a violation of this chapter for an unauthorized person to release or use an 
individual's personal information acquired through a security breach. 
Sec. 3. 10 MRSA §1348, sub-§3, as enacted by PL 2005, c. 379, § 1 and affected 
by §4, is amended to read: 
3. Delay of notification for law enforcement purposes. The notification required 
by this section may be delayed for no longer than 7 business days if a law enforcement 
agency determines that the notification will compromise a criminal investigation; the 
notification required by this section must be made after the law enforcement agency 
determines that it will not compromise the investigation. 
Sec.4. 10 MRSA §1349, sub-§4, as enacted by PL 2005, c. 583, §12 and affected 
by § 14, is amended to read: 
4. 
Exceptions. 
A person that complies with the security breach notification 
requirements of rules, regulations, procedures or guidelines established pursuant to 
federal law or the law of this State is deemed to be in compliance with the requirements 
of this chapter section 1348 as long as the law, rules, regulations or guidelines provide for 
notification procedures at least as protective as the notification requirements of this 
chanter section 1348. 
SUMMARY 
This bill amends the security breach notification laws. The bill makes it clear that the 
release or use of personal information acquired through a security breach by an 
unauthorized person constitutes a violation of the law. The bill also requires that any 
delay for law enforcement purposes in notification to persons affected by a security 
breach may not be longer than 7 business days. 
) 
) 
)