An Act To Create a Data Broker Registry and Improve Consumer Protections
Maine Legislature, Session 130, LD 1655
Committee: Innovation, Development, Economic Advancement and Business
Sponsors: O'NEIL, BERRY, FAULKINGHAM, FECTEAU, GROHOSKI, BAILEY, KEIM

Legislative Document
No. 1655
H.P. 1226
House of Representatives, May 5, 2021
An Act To Create a Data Broker Registry and Improve Consumer 
Protections
Received by the Clerk of the House on May 3, 2021.  Referred to the Committee on 
Innovation, Development, Economic Advancement and Business pursuant to Joint Rule 308.2 
and ordered printed pursuant to Joint Rule 401.
ROBERT B. HUNT
Clerk
Presented by Representative O'NEIL of Saco.
Cosponsored by Representatives: BERRY of Bowdoinham, FAULKINGHAM of Winter 
Harbor, FECTEAU of Augusta, GROHOSKI of Ellsworth, Senators: BAILEY of York, KEIM 
of Oxford.
Be it enacted by the People of the State of Maine as follows:
Sec. 1.  10 MRSA c. 1057 is enacted to read:
CHAPTER 1057
PERSONAL INFORMATION PRIVACY
§9571.  Definitions
As used in this chapter, unless the context otherwise indicates, the following terms 
have the following meanings.
1.  Biometric data.  "Biometric data" means an individual's physiological, biological 
or behavioral characteristics that may be used, singly or in combination with each other or 
with other identifying data, to establish individual identity. "Biometric data" includes, but 
is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm or vein patterns 
and voice recordings from which minutiae or an identifier template, such as a faceprint or 
voiceprint, may be extracted, as well as keystroke patterns or rhythms, gait patterns or 
rhythms or sleep, health or exercise data that contains identifying information.
2.  Brokered personal information.  "Brokered personal information" means 
personally identifiable information or one or more of the following data elements, including 
digital or computerized data elements, about a consumer, if categorized or organized for 
dissemination to 3rd parties:
A.  Name;
B.  Address;
C.  Date of birth;
D.  Place of birth;
E.  Mother's maiden name;
F.  Biometric data;
G.  Name or address of a member of the consumer's immediate family or household;
H.  Social security number or other government-issued identification number; 
I.  Nongovernmental number assigned to a consumer, including, without limitation, a 
credit or other financial account, insurance policy or license number; or
J.  Other information that, alone or in combination with the other information sold, 
licensed or otherwise publicly available, may allow a reasonable person to identify the 
consumer with reasonable certainty.
"Brokered personal information" does not include publicly available information made 
available by a state or local government to the extent that the information is about a 
consumer's business or professional activities.
3.  Business.  "Business" means a commercial entity, including a sole proprietorship, 
partnership, corporation, association, limited liability company or other group however 
organized and whether or not organized to operate at a profit, including a financial 
institution organized, chartered or holding a license or authorization certificate under the 
laws of this State, any other state, the United States or any other country or the parent, 
affiliate or subsidiary of a financial institution, but does not include the State, a state 
agency, any political subdivision of the State or a vendor acting solely on behalf of and at 
the direction of the State.
4.  Consumer.  "Consumer" means an individual residing in the State.
5.  Data broker.  "Data broker" means a business or unit or units of a business, 
separately or together, that obtains and licenses to 3rd parties the brokered personal 
information of a consumer with whom the business does not have a direct relationship.  
"Data broker" includes a business that licenses, sells or allows a 3rd party to use personally 
identifiable information to select individuals to receive e-mails, telephone calls or 
advertising.  "Data broker" does not include:
A.  A business that obtains and licenses brokered personal information incidental to 
conducting the following activities:
(1)  Providing a name, address or telephone number for directory assistance or 
directory information services, including name, address and telephone number on 
behalf of or as a function of a telecommunications carrier;
(2) Providing publicly available information related to a consumer's business or 
profession, including a consumer reporting agency but only when the agency is 
engaging in conduct or an activity regulated under the federal Fair Credit Reporting 
Act; or
(3)  Providing publicly available information via real-time or near real-time alert 
services for health or safety purposes.
The exclusions specified in this paragraph apply only to the extent that the information 
is used for the activities specified in this paragraph; 
B.  A person to the extent the person is covered by Title 24-A, chapter 24; or
C.  A business that obtains and licenses brokered personal information for fewer than 
5,000 consumers.
6.  License.  "License" means to grant access to, or to distribute or allow the use of, 
data in exchange for consideration, including by selling, renting, releasing, disclosing, 
disseminating, making available, transferring or otherwise communicating orally, in 
writing or by electronic or other means brokered personal information by a business to 
another business or a 3rd party for monetary or other valuable consideration, including 
targeted marketing.  "License" does not include:
A.  The use of data for the sole benefit of the data provider if the data provider maintains 
control over the use of the data; or
B.  The sale of the assets of a business as part of a transfer of control of those assets 
that is not part of the ordinary conduct of the business.
7.  Personally identifiable information.  "Personally identifiable information" means 
information about an identified or identifiable individual, including information about 
location, housing, education, finances, health, employment, criminal history, military 
service, taxation, agency program participation, Internet usage history or any other personal 
activity or characteristic, that contains any of the following data:
A.  Name;
B.  Home address, post office box number, private mailbox number or other physical 
or postal address;
C.  E-mail address;
D.  Telephone number;
E.  Vehicle license plate number;
F.  Social security number; passport number; credit or debit card number; account, 
license or employee number; or other identifying number assigned to an individual; 
G.  Date of birth;
H.  Internet protocol address or any comparable successor address;
I.  Data that permits contact of a specific individual, either physically or electronically; 
J.  Biometric data, a photograph or a genetic identifier;
K.  Information that identifies an individual's electronic device, including an 
international mobile equipment identity number, media access control address, 
contactless chip identifier or any information that a website or online service collects 
online through a computer or from the individual, individual's cellular telephone or 
other electronic device; or 
L.  Any other information concerning an individual processed in combination with data 
described in paragraphs A to K.
"Personally identifiable information" does not include publicly available information that 
is lawfully made available to the general public from federal, state or local government 
records, unless the information is combined with other personally identifiable information.
8.  Security breach.  "Security breach" means an unauthorized acquisition of 
electronic data, or a reasonable belief of an unauthorized acquisition of electronic data, that 
compromises the security, confidentiality or integrity of a consumer's personally 
identifiable information or login credentials. "Security breach" does not include a good 
faith but unauthorized acquisition of personally identifiable information or login 
credentials for a legitimate business purpose if the personally identifiable information or 
login credentials are not used for a purpose unrelated to the business or subject to further 
unauthorized disclosure.
§9572.  Annual registration
1.  Annual registration.  Annually, a data broker shall:
A.  Register with the Secretary of State;
B.  Pay a registration fee of $200;
C.  Provide the following information:
(1)  The name and primary physical address, primary e-mail address and all Internet 
addresses of the data broker; and
(2)  For an opt-out of a consumer required under section 9574:
(a)  The method for requesting an opt-out;
(b)  If the opt-out applies to activities or sales other than those for which a 
consumer must be given an opt-out pursuant to section 9574, which activities 
or sales the opt-out applies to; and
(c)  Whether the data broker permits a consumer to authorize a 3rd party to 
perform the opt-out on the consumer's behalf;
D.  Provide a list of all databases in possession of or used by the data broker that include 
personally identifiable information of residents of this State;
E.  Provide a statement as to whether the data broker implements a purchaser 
credentialing process;
F.  Provide the number of security breaches that the data broker has experienced during 
the prior year and, if known, the total number of consumers affected by the breaches; 
and
G.  If the data broker has reason to believe that the data broker possesses the brokered 
personal information of minors, provide a separate statement detailing the data 
collection practices, databases, sales activities and opt-out policies that are applicable 
to the brokered personal information of minors.
In addition to the information required under this subsection, a data broker may provide 
any additional information or explanation concerning the data broker's data collection 
practices.
2.  Violations.  The Attorney General shall enforce the provisions of this section. A 
data broker that fails to register pursuant to subsection 1 commits a civil violation for which 
the following must be adjudged:
A.  A fine of $100 for each day, not to exceed a total of $10,000 for each year, the data 
broker fails to register pursuant to this section;
B.  An amount equal to the fees due under this section during the period the data broker 
failed to register pursuant to this section; 
C.  An amount equal to the amount of expenses incurred by the Attorney General in 
the investigation and prosecution of the civil violation as the court determines 
appropriate; and
D.  Other penalties imposed by law.
The Treasurer of State shall transfer any fine or amount received under this subsection to 
the Attorney General to be used for consumer protection enforcement.
§9573.  Data broker duty to protect information; standards; technical requirements
1.  Duty to protect personally identifiable information.  A data broker shall develop, 
implement and maintain a comprehensive information security program to protect 
personally identifiable information.  The program must be written in one or more readily 
accessible parts and contain administrative, technical and physical safeguards that are 
appropriate to:
A.  The size, scope and type of business of the data broker;
B.  The amount of resources available to the data broker;
C.  The amount of stored data; and
D.  The need for security and confidentiality of personally identifiable information.
A data broker subject to this subsection shall adopt safeguards in the comprehensive 
information security program that are consistent with the safeguards for protection of 
personally identifiable information and information of a similar character set forth in other 
state rules or federal regulations applicable to the data broker.
2.  Comprehensive information security program; minimum features and 
requirements.  The Attorney General, by rulemaking as required in section 9575, shall 
establish minimum features and requirements for the comprehensive information security 
program required under subsection 1.
3.  Enforcement.  A person who violates a provision of this section, including rules 
adopted pursuant to section 9575, commits a violation of the Maine Unfair Trade Practices 
Act.
§9574. Opt-out right of consumers 
1.  Opt-out right of consumers.  A data broker shall provide notice to a consumer that 
the consumer may direct the data broker not to license the consumer's brokered personal 
information.  Upon request of a consumer not to license the consumer's brokered personal 
information, a data broker may not license the brokered personal information of the 
consumer to a 3rd party.  A 3rd party may not license brokered personal information about 
a consumer that has been licensed to the 3rd party by a data broker unless the data broker 
provides the consumer notice of the consumer's option and provides the consumer an 
opportunity to direct the 3rd party not to license the brokered personal information of that 
consumer.  A data broker that has received direction from a consumer not to license the 
consumer's brokered personal information may not license the consumer's brokered 
personal information after receipt of the consumer's direction unless the consumer 
subsequently provides written consent for the license of the consumer's brokered personal 
information.  A data broker shall accept from a 3rd party acting on behalf of a consumer 
direction not to license that consumer's brokered personal information.
2.  Enforcement.  The Attorney General shall enforce this section.  A person who 
violates a provision of this section commits a violation of the Maine Unfair Trade Practices 
Act.
§9575.  Rules
The Attorney General may adopt rules to carry out the provisions of this chapter, 
including establishing minimum features and computer system security requirements for 
comprehensive information security programs as required by section 9573.  Rules adopted 
pursuant to this section are routine technical rules as defined by Title 5, chapter 375, 
subchapter 2-A.
SUMMARY
This bill requires data brokers, which are businesses that obtain and sell or license to 
3rd parties or allow 3rd parties to access the personal information of a consumer with whom 
the business does not have a direct relationship, to register with the Secretary of State, to 
protect a consumer's personal information through various security requirements and to 
allow a consumer to opt out of allowing the sale or lease of or access to the consumer's 
personal information.