An Act To
Maine Legislature, Session 126, LD 0158
Committee Amendment CA_A_H151 (House)
Amends: 10 MRSA §1347, 10 MRSA §1348

COMMITTEE AMENDMENT" A " to H.P. 133, L.D. 158, Bill, "An Act To 
Amend the Notice of Risk to Perspnal Data Act To Further Protect Consumers" 
I 
Amend the bill by striking o~t everything after the enacting clause and before the 
summary and inserting the followiti'~ , 
'Sec. 1. 10 MRSA §1347, sub-§I, as amended by PL 2009, c. 161, §1 and 
affected by §5, is further amended to read: 
1. Breach of the security of the system. "Breach of the security of the system" or 
"security breach" means unauthorized acquisition, release or use of an individual's 
computerized data or lost, misplaced or unaccounted for computerized data that includes 
personal information that compromises the security, confidentiality or integrity of 
personal information of the individual maintained by a person. Good faith acquisition, 
release or use of personal information by an employee or agent of a person on behalf of 
the person is not a breach of the security of the system if the personal information is not 
used for or subject to further unauthorized disclosure to another person. 
Sec.2. 10 MRSA §1348, sub-§I, as repealed and replaced by PL 2005, c. 583, §6 
and affected by § 14, is amended to read: 
1. Notification to residents. The following provisions apply to notification to 
residents by information brokers and other persons. 
A. If an information broker that maintains computerized data that includes personal 
information becomes aware of a breach of the security of the system, the information 
broker shall conduct in good faith a reasonable and prompt investigation to determine 
the likelihood that personal information has been or will may be misused and shall 
give notice of a breach of the security of the system following discovery or 
notification of the security breach to a resident of this State vihose personal 
information has been, or is reasonably believed to have been, acquired by an 
unauthorii'ied person if misuse of the personal information has occurred or if it is 
reasonably possible that misuse may occur. 
COMMITTEE AMENDMENT 
Oi~ 
~ 
COMMITTEE AMENDMENT "A "to H.P. 133, L.D. 158 
B. If any other person who maintains computerized data that includes personal 
information becomes aware of a breach of the security of the system, the person shall 
conduct in good faith a reasonable and prompt investigation to determine the 
likelihood that personal information has been or will may be misused and shall give 
notice of a breach of the security of the system following discovery or notification of 
the security breach to a resident of this State if misuse of the personal information has 
occurred or if it is reasonably possible that misuse will may occur. 
The notices required under paragraphs A and B must be made as expediently as possible 
and without unreasonable delay, consistent with the legitimate needs of law enforcement 
pursuant to subsection 3 or with measures necessary to determine the scope of the 
security breach and restore the reasonable integrity, security and confidentiality of the 
data in the system. Notice must be provided no later than 60 days after the discovery of 
the breach of the security of the system. except that, if lost, misplaced or unaccounted for 
computerized data is accounted for within 60 days of discovery of the breach of the 
security of the system, notice is not required. 
Sec. 3. 10 MRSA §1348, sub-§3, as amended by PL 2009, c. 161, §3 and 
affected by §5, is further amended to read: 
3. Delay of notification; criminal investigation by law enforcement. If, after the 
completion of an investigation required by subsection 1, notifieation is reqliired a person 
is required to provide notice under this section, a law enforcement agency may make a 
written request to that person to delay the notification required by this section may be 
delayed for no longer than 7 business days after a lWN enforeement ageney determines so 
that the notification will not compromise a criminal investigation. 
Sec. 4. 10 MRSA §1348, sub-§5, as amended by PL 2005, c. 583, §9 and 
affected by §14, is further amended to read: 
5. Notification to state regulators. '}/heft ftotiee Within 10 days after the discovery 
of a breach of the security of the system is re€J:liired liftder slibseetioft l, the person shall 
notify the appropriate state regulators within the Department of Professional and 
Financial Regulation, or if the person is not regulated by the department, the Attorney 
Genera1.' 
SUMMARY 
This amendment is the minority report of the committee and replaces the bil1. This 
amendment does the following with respect to the Notice of Risk to Personal Data Act. 
1. It clarifies the definition of "breach of the security of the system" to include lost, 
misplaced or unaccounted for computerized data that includes personal information and 
requires notice to be provided to residents affected by a breach within 60 days unless the 
computerized data becomes accounted for prior to the 60-day deadline. 
2. It requires that notice of a breach must be provided to state regulators no later than 
days after discovery of the breach. 
3. It clarifies that a notice to residents affected by a breach may be delayed only 
pursuant to a written request from a law enforcement agency. 
COMMITTEE AMENDMENT 
Oi~ 
~ 
COMMITTEE AMENDMENT" A "to H.P. 133, L.D. 158 
4. It does not include the provision in the bill increasing the penalties for violations. 
FISCAL NOTE REQUIRED 
(See attached) 
COMMITTEE AMENDMENT 
Approved: 05/03/13 
~ae 
LD 158 
LR 157(02) 
An Act To Amend the Notice of Risk to Personal Data Act To Further Protect Consumers 
Fiscal Note for Bill as Amended by Committee Amendment 71' (H- J£ J J 
Committee: Insurance and Financial Services 
l J 
Fiscal Note Required: Yes 
Fiscal Note 
Minor cost increase - General Fund 
Minor revenue increase - General Fund 
Correctional and Judicial Impact Statements 
Increase in civil violations. 
The collection of additional fines may also increase General Fund revenue by minor amounts. 
LR0157(02) - Fiscal Note - Page 1 of 1