An Act To Protect the Private Information of Maine Residents
Maine Legislature, Session 130, LD 1714
Committee: Innovation, Development, Economic Advancement and Business
Sponsors: KEIM, HICKMAN, WHITE

Legislative Document
No. 1714
S.P. 535
In Senate, May 19, 2021
An Act To Protect the Private Information of Maine Residents
Reference to the Committee on Innovation, Development, Economic Advancement and 
Business suggested and ordered printed.
DAREK M. GRANT
Secretary of the Senate
Presented by Senator KEIM of Oxford.
Cosponsored by Senator: HICKMAN of Kennebec, Representative: WHITE of Waterville.
Be it enacted by the People of the State of Maine as follows:
Sec. 1.  10 MRSA c. 1057 is enacted to read:
CHAPTER 1057
MAINE CONSUMER PRIVACY ACT
§9601.  Short title
This chapter may be known and cited as "the Maine Consumer Privacy Act."
§9602.  Definitions
1.  Aggregate consumer information.  "Aggregate consumer information" means 
information that relates to a group or category of consumers, from which individual 
consumer identities have been removed, that is not linked or reasonably linkable to any 
consumer or household, including via a device.  "Aggregate consumer information" does 
not mean one or more individual consumer records that have been deidentified.
2.  Biometric information.  "Biometric information" means an individual's 
physiological, biological or behavioral characteristics, including an individual's 
deoxyribonucleic acid, or DNA, that can be used, singly or in combination with each other 
or with other identifying data, to establish the individual's identity.  "Biometric 
information" includes, but is not limited to, imagery of the iris, retina, fingerprint, face, 
hand, palm, vein patterns and voice recordings, from which an identifier template, such as 
a faceprint, a minutiae template or a voiceprint, can be extracted and keystroke patterns or 
rhythms, gait patterns or rhythms and sleep, health or exercise data that contain identifying 
information.
3.  Business.  "Business" means:
A.  A sole proprietorship, partnership, limited liability company, corporation, 
association or other legal entity that is organized or operated for the profit or financial 
benefit of its shareholders or other owners that collects consumers' personal 
information or on the behalf of which that information is collected and that alone or 
jointly with others determines the purposes and means of the processing of consumers' 
personal information, that does business in the State and that satisfies one or more of 
the following thresholds:
(1)  Has annual gross revenues in excess of $25,000,000, as adjusted pursuant to 
section 9619, subsection 1, paragraph E;
(2)  Alone or in combination annually buys, receives for the business's commercial 
purposes, sells or shares for commercial purposes alone or in combination the 
personal information of 50,000 or more consumers, households or devices; or
(3)  Derives 50% or more of its annual revenues from selling consumers' personal 
information; or
B.  An entity that controls or is controlled by a business as defined in paragraph A and 
that shares common branding with the business.  For the purposes of this paragraph, 
"control" or "controlled" means ownership of, or the power to vote, more than 50% of 
the outstanding shares of any class of voting security of a business; control in any 
manner over the election of a majority of the directors or of individuals exercising 
similar functions; or the power to exercise a controlling influence over the management 
of a company, and "common branding" means a shared name, service mark or 
trademark. 
4.  Business purpose.  "Business purpose" means the use of personal information for 
the business's or a service provider's operational purposes or other purposes of which 
consumers are given notice, if the use of personal information is reasonably necessary and 
proportionate to achieve the operational purpose for which the personal information was 
collected or processed or for another operational purpose that is compatible with the context 
in which the personal information was collected.  "Business purposes" includes:
A.  Auditing related to a current interaction with the consumer and concurrent 
transactions, including, but not limited to, counting so-called ad impressions to unique 
visitors, verifying positioning and quality of ad impressions and auditing compliance 
with this specification and other standards;
B.  Detecting security incidents, protecting against malicious, deceptive, fraudulent or 
illegal activity and prosecuting those responsible for that activity;
C.  Debugging to identify and repair errors that impair existing intended functionality;
D.  Short-term, transient use if the personal information is not disclosed to another 3rd 
party and is not used to build a profile about a consumer or otherwise alter an individual 
consumer's experience outside the current interaction, including, but not limited to, the 
contextual customization of ads shown as part of the same interaction;
E.  Performing services on behalf of the business or service provider, including 
maintaining or servicing accounts, providing customer service, processing or fulfilling 
orders and transactions, verifying consumer information, processing payments, 
providing financing, providing advertising or marketing services, providing analytic 
services or providing similar services on behalf of the business or service provider;
F.  Undertaking internal research for technological development and demonstration; 
and
G.  Undertaking activities to verify or maintain the quality or safety of a service or 
device that is owned, manufactured, manufactured for or controlled by the business 
and to improve, upgrade or enhance the service or device that is owned, manufactured, 
manufactured for or controlled by the business.
5.  Collect.  "Collect" means to buy, rent, gather, obtain, receive or access any personal 
information pertaining to a consumer by any means and includes receiving information 
from the consumer, either actively or passively, or by observing the consumer's behavior.
6.  Commercial purposes.  "Commercial purposes" means to advance a person's 
commercial or economic interests, such as by inducing another person to buy, rent, lease, 
join, subscribe to, provide or exchange products, goods, property, information or services 
or enabling or effecting, directly or indirectly, a commercial transaction.  "Commercial 
purposes" does not include engaging in speech that state or federal courts have recognized 
as noncommercial speech, including political speech and journalism.
7.  Consumer.  "Consumer" means a natural person who is a resident of the State.
8.  Deidentified.  "Deidentified" means cannot reasonably identify, relate to, describe, 
be capable of being associated with or be linked, directly or indirectly, to a particular 
consumer, if a business that uses deidentified information:
A.  Has implemented technical safeguards that prohibit reidentification of the consumer 
to whom the information may pertain;
B.  Has implemented business processes that specifically prohibit reidentification of 
the information;
C.  Has implemented business processes to prevent inadvertent release of deidentified 
information; and
D.  Makes no attempt to reidentify the information.
9.  Designated method for submitting requests.  "Designated method for submitting 
requests" means a mailing address, e-mail address, Internet web page, Internet web portal, 
toll-free telephone number or other applicable contact information by which a consumer 
may submit a request or direction under this chapter and any consumer-friendly means of 
contacting a business as approved by the Attorney General pursuant to section 9619.
10.  Device.  "Device" means any physical object that is capable of connecting to the 
Internet, directly or indirectly, or to another device that is capable of connecting to the 
Internet, directly or indirectly.
11.  Health insurance information.  "Health insurance information" means a 
consumer's insurance policy number or subscriber identification number, any unique 
identifier used by a health insurer to identify the consumer or any information in the 
consumer's application and claims history, including any appeals records, if the information 
is linked or reasonably linkable to a consumer or household, including via a device, by a 
business or service provider.
12.  Homepage.  "Homepage" means the introductory page of an Internet website and 
any Internet web page where personal information is collected.  In the case of an online 
service, such as a mobile application, "homepage" means the application's platform page 
or download page, a link within the application, such as from the application's 
configuration, "about," "information" or settings page, and any other location that allows 
consumers to review the form required by section 9610, subsection 1, including, but not 
limited to, before downloading the application.
13.  Person.  "Person" means an individual, proprietorship, firm, partnership, joint 
venture, syndicate, business trust, company, corporation, limited liability company, 
association, committee and any other organization or group of persons acting in concert.
14.  Personal information.  "Personal information":
A.  Means information that identifies, relates to, describes, is reasonably capable of 
being associated with or could reasonably be linked, directly or indirectly, with a 
particular consumer or household and includes, but is not limited to:
(1)  Identifiers such as a real name, alias, mailing address, signature, telephone 
number, unique identifier, online identifier, Internet protocol address, e-mail 
address, account name, social security number, driver's license number, nondriver 
identification card number, passport number or other similar identifiers;
(2)  Physical characteristics or description, insurance policy number, bank account 
number, credit card number, debit card number or any other financial information, 
medical information or health information;
(3)  Characteristics of protected classifications under state or federal law;
(4)  Commercial information, including records of personal property, products or 
services purchased, obtained or considered, or other purchasing or consuming 
histories or tendencies;
(5)  Biometric information;
(6)  Internet or other electronic network activity information, including, but not 
limited to, browsing history, search history and information regarding a consumer's 
interaction with an Internet website, application or advertisement;
(7)  Geolocation data;
(8)  Audio, electronic, visual, thermal, olfactory or similar information;
(9)  Professional or employment-related information;
(10)  Education information, defined as information that is not publicly available 
personally identifiable information as defined in the Family Educational Rights 
and Privacy Act of 1974, 20 United States Code, Section 1232g; and
(11)  Inferences drawn from any of the information identified in this paragraph to 
create a profile about a consumer reflecting the consumer's preferences, 
characteristics, psychological trends, predispositions, behavior, attitudes, 
intelligence, abilities and aptitudes;
B.  "Personal information" does not include publicly available information.  For 
purposes of this paragraph, "publicly available" means information that is lawfully 
made available from federal, state or local government records.  "Publicly available" 
does not mean biometric information collected by a business about a consumer without 
the consumer's knowledge; and
C.  "Personal information" does not include consumer information that is deidentified 
or aggregate consumer information.
15.  Probabilistic identifier.  "Probabilistic identifier" means the identification of a 
consumer or a device to a degree of certainty of more probable than not based on any 
categories of personal information included in, or similar to, the categories enumerated in 
the definition of "personal information."
16.  Processing.  "Processing" means any operation or set of operations that is 
performed on personal information or on sets of personal information, whether or not by 
automated means.
17.  Reidentify.  "Reidentify" means the process of reversal of deidentification 
techniques, including, but not limited to, the addition of specific pieces of information or 
data elements that can, individually or in combination, be used to uniquely identify an 
individual or usage of any statistical method, contrivance, computer software or other 
means that have the effect of associating deidentified information with a specific 
identifiable individual.
18.  Research.  "Research" means scientific, systematic study and observation, 
including basic research or applied research that is in the public interest and that adheres to 
all other applicable ethics and privacy laws or studies conducted in the public interest in 
the area of public health.  Research with personal information that may have been collected 
from a consumer in the course of the consumer's interactions with a business's service or 
device for other purposes must be:
A.  Compatible with the business purpose for which the personal information was 
collected;
B.  Subsequently deidentified, or deidentified and in the aggregate, such that the 
information cannot reasonably identify, relate to, describe, be capable of being 
associated with or be linked, directly or indirectly, to a particular consumer;
C.  Made subject to technical safeguards that prohibit reidentification of the consumer 
to whom the information may pertain;
D.  Subject to business processes that specifically prohibit reidentification of the 
information;
E.  Made subject to business processes to prevent inadvertent release of deidentified 
information;
F.  Protected from any reidentification attempts;
G.  Used solely for research purposes that are compatible with the context in which the 
personal information was collected;
H.  Not be used for any commercial purpose; and
I.  Subjected by the business conducting the research to additional security controls that 
limit access to the research data to only those individuals in a business as are necessary 
to carry out the research purpose.
19.  Sell.  "Sell" means sell, rent, release, disclose, disseminate, make available, transfer 
or otherwise communicate orally, in writing or by electronic or other means, a consumer's 
personal information by a business to another business or a 3rd party for monetary or other 
valuable consideration.
For purposes of this chapter, a business does not sell personal information when:
A.  A consumer uses or directs the business to intentionally disclose personal 
information or uses the business to intentionally interact with a 3rd party, if the 3rd 
party does not also sell the personal information, unless that disclosure would be 
consistent with the provisions of this chapter.  An intentional interaction occurs when 
the consumer intends to interact with the 3rd party via one or more deliberate 
interactions.  Hovering over, muting, pausing or closing a given piece of content does 
not constitute a consumer's intent to interact with a 3rd party;
B.  The business uses or shares an identifier for a consumer who has opted out of the 
sale of the consumer's personal information for the purposes of alerting 3rd parties that 
the consumer has opted out of the sale of the consumer's personal information;
C.  The business uses or shares with a service provider personal information of a 
consumer that is necessary to perform a business purpose if both of the following 
conditions are met:
(1)  The business has provided notice of that information being used or shared in 
its terms and conditions consistent with section 9610; and 
(2)  The service provider does not further collect, sell or use the personal 
information of the consumer except as necessary to perform the business purpose;
D.  The business transfers to a 3rd party the personal information of a consumer as an 
asset that is part of a merger, acquisition, bankruptcy or other transaction in which the 
3rd party assumes control of all or part of the business, if that information is used or 
shared consistent with the provisions of sections 9605 and 9606.  If a 3rd party 
materially alters how it uses or shares the personal information of a consumer in a 
manner that is materially inconsistent with the promises made at the time of collection, 
it shall provide prior notice of the new or changed practice to the consumer.  The notice 
must be sufficiently prominent and robust to ensure that existing consumers can easily 
exercise their choices consistent with section 9607.  This paragraph does not authorize 
a business to make material, retroactive privacy policy changes or make other changes 
in its privacy policy in a manner that would violate the Unfair Trade Practices Act or 
chapter 206.
20.  Service.  "Service" means work or labor, including work or labor furnished in 
connection with the sale or repair of goods.
21.  Service provider.  "Service provider" means a sole proprietorship, partnership, 
limited liability company, corporation, association or other legal entity that is organized or 
operated for the profit or financial benefit of its shareholders or other owners, that processes 
information on behalf of a business and to which the business discloses a consumer's 
personal information for a business purpose pursuant to a written contract, if the contract 
prohibits the entity receiving the information from retaining, using or disclosing the 
personal information for any purpose other than for the specific purpose of performing the 
services specified in the contract for the business, or as otherwise permitted by this chapter, 
including retaining, using or disclosing the personal information for a commercial purpose 
other than providing the services specified in the contract with the business.
22.  Third party.  "Third party" means a person who is not any of the following:
A.  The business that collects personal information from consumers under this chapter;
B.  A person to whom the business discloses a consumer's personal information for a 
business purpose pursuant to a written contract, if the contract:
(1)  Prohibits the person receiving the personal information from:
(a)  Selling the personal information;
(b)  Retaining, using or disclosing the personal information for any purpose 
other than for the specific purpose of performing the services specified in the 
contract, including retaining, using or disclosing the personal information for 
a commercial purpose other than providing the services specified in the 
contract; or
(c)  Retaining, using or disclosing the information outside of the direct business 
relationship between the person and the business; and
(2)  Includes a certification made by the person receiving the personal information 
that the person understands the restrictions in subparagraph (1) and will comply 
with them.
23.  Unique identifier.  "Unique identifier" means a persistent identifier that can be 
used to recognize a consumer, a household or a device that is linked to a consumer or 
household, over time and across different services, including, but not limited to: a device 
identifier; an Internet protocol address; cookies, beacons, pixel tags, mobile ad identifiers 
or similar technology; customer number, unique pseudonym or user alias; telephone 
numbers; or other forms of persistent or probabilistic identifiers that can be used to identify 
a particular consumer or device.  For purposes of this subsection, "household" means a 
custodial parent or guardian and any minor children of whom the parent or guardian has 
custody.
24.  Verifiable consumer request.  "Verifiable consumer request" means a request 
that is made by a consumer or by a consumer on behalf of the consumer's minor child, or 
by a natural person or a person registered with the Secretary of State authorized by the 
consumer to act on the consumer's behalf, and that the business can reasonably verify, 
pursuant to rules adopted by the Attorney General pursuant to section 9619, subsection 1, 
paragraph G to be the consumer about whom the business has collected personal 
information.
§9603.  Consumer's right to request personal information
1.  Request.  A consumer has the right to request that a business that collects a 
consumer's personal information disclose to that consumer the categories of personal 
information the business has collected regarding the consumer.
2.  Categories to be collected; purposes.  A business that collects a consumer's 
personal information shall, at or before the point of collection, inform consumers as to the 
categories of personal information to be collected and the purposes for which the categories 
of personal information may be used.  A business may not collect additional categories of 
personal information or use personal information collected for additional purposes without 
providing the consumer with notice consistent with this section.
3.  Verifiable consumer request required.  A business shall provide the information 
specified in subsection 1 to a consumer only upon receipt of a verifiable consumer request.  
A business is not obligated to provide information to the consumer pursuant to this section 
and sections 9604, 9605 and 9606 if the business cannot verify, pursuant to this subsection 
and rules adopted by the Attorney General pursuant to section 9616, subsection 1, 
paragraph G, that the consumer making the request is the consumer about whom the 
business has collected information or is a person authorized by the consumer to act on such 
consumer's behalf.
4.  Disclose and deliver personal information.  A business that receives a verifiable 
consumer request from a consumer to access personal information shall promptly take steps 
to disclose and deliver, free of charge to the consumer, the personal information required 
by this section.  The information may be delivered by mail or electronically, and, if 
provided electronically, the information must be in a portable and, to the extent technically 
feasible, readily useable format that allows the consumer to transmit this information to 
another entity without hindrance.  A business may provide personal information to a 
consumer at any time, but is not required to provide personal information to a consumer 
more than twice in a 12-month period.
5.  Single, one-time transaction.  This section does not require a business to retain 
any personal information collected for a single, one-time transaction, if such information 
is not sold or retained by the business or to reidentify or otherwise link information that is 
not maintained in a manner that would be considered personal information.
§9604.  Consumer's right to request deletion of personal information
1.  Request to delete.  A consumer has the right to request that a business delete any 
personal information about the consumer that the business has collected from the consumer.
2.  Disclose right to request deletion.  A business that collects personal information 
about a consumer shall disclose, pursuant to section 9609, the consumer's right to request 
the deletion of the consumer's personal information.
3.  Verifiable consumer request.  A business that receives a verifiable consumer 
request from a consumer to delete the consumer's personal information pursuant to 
subsection 1 shall delete the consumer's personal information from its records and direct 
any service providers to delete the consumer's personal information from their records.  A 
business is not obligated to provide information to the consumer pursuant to this section 
and sections 9603, 9605 and 9606 if the business cannot verify, pursuant to this subsection 
and rules adopted by the Attorney General pursuant to section 9616, subsection 1, 
paragraph G, that the consumer making the request is the consumer about whom the 
business has collected information or is a person authorized by the consumer to act on such 
consumer's behalf.
4.  Deletion not required.  A business or a service provider is not required to comply 
with a consumer's request to delete the consumer's personal information if it is necessary 
for the business or service provider to maintain the consumer's personal information in 
order to:
A.  Complete the transaction for which the personal information was collected, fulfill 
the terms of a written warranty or product recall conducted in accordance with federal 
law, provide a good or service requested by the consumer or reasonably anticipated 
within the context of a business's ongoing business relationship with the consumer or 
otherwise perform a contract between the business and the consumer; 
B.  Detect security incidents, protect against malicious, deceptive, fraudulent or illegal 
activity or prosecute those responsible for that activity;
C.  Debug to identify and repair errors that impair existing intended functionality;
D.  Exercise free speech, ensure the right of another consumer to exercise that 
consumer's right of free speech or exercise another right provided for by law;
E.  Comply with a warrant under Title 16, chapter 3, subchapter 9-A, 10 or 11;
F.  Engage in public or peer-reviewed scientific, historical or statistical research in the 
public interest that adheres to all other applicable ethics and privacy laws, when the 
business's deletion of the information is likely to render impossible or seriously impair 
the achievement of such research, if the consumer has provided informed consent;
G.  To enable solely internal uses that are reasonably aligned with the expectations of 
the consumer based on the consumer's relationship with the business;
H.  Comply with a legal obligation; or
I.  Otherwise use the consumer's personal information, internally, in a lawful manner 
that is compatible with the context in which the consumer provided the information.
§9605.  Consumer's right to disclosure of information
1.  Request.  A consumer has the right to request that a business that collects personal 
information about the consumer disclose to the consumer the following:
A.  The categories of sources from which the personal information is collected;
B.  The business purpose or commercial purpose for collecting or selling personal 
information;
C.  The categories of 3rd parties with whom the business shares personal information; 
and
D.  The specific pieces of personal information it has collected about that consumer.
2.  Verifiable consumer request.  A business that collects personal information about 
a consumer shall disclose to the consumer, pursuant to section 9609, subsection 1, 
paragraph C, the information specified in subsection 1 upon receipt of a verifiable 
consumer request from the consumer.  A business is not obligated to provide information 
to the consumer pursuant to this section and sections 9603, 9604 and 9606 if the business 
cannot verify, pursuant to this subsection and rules adopted by the Attorney General 
pursuant to section 9616, subsection 1, paragraph G, that the consumer making the request 
is the consumer about whom the business has collected information or is a person 
authorized by the consumer to act on such consumer's behalf.
3.  Information disclosed.  A business that collects personal information about 
consumers shall disclose, pursuant to section 9609, subsection 1, paragraph E, 
subparagraph (2):
A.  The categories of personal information it has collected about consumers;
B.  The categories of sources from which the personal information is collected;
C.  The business purpose or commercial purpose for collecting or selling personal 
information;
D.  The categories of 3rd parties with whom the business shares personal information; 
and
E.  That a consumer has the right to request the specific pieces of personal information 
the business has collected about that consumer.
4.  Actions not required.  This section does not require a business to:
A.  Retain any personal information about a consumer collected for a single, one-time 
transaction if, in the ordinary course of business, that information about the consumer 
is not retained; or
B.  Reidentify or otherwise link any data that, in the ordinary course of business, is not 
maintained in a manner that would be considered personal information.
§9606.  Consumer's rights when information sold or disclosed
1.  Request.  A consumer has the right to request that a business that sells the 
consumer's personal information, or that discloses it for a business purpose, disclose to that 
consumer:
A.  The categories of personal information about the consumer that the business 
collected;
B.  The categories of personal information about the consumer that the business sold 
and the categories of 3rd parties to whom the personal information was sold, by 
category or categories of personal information for each category of 3rd parties to whom 
the personal information was sold; and
C.  The categories of personal information about the consumer that the business 
disclosed for a business purpose.
2.  Verifiable consumer request.  A business that sells personal information about a 
consumer, or that discloses a consumer's personal information for a business purpose, shall 
disclose, pursuant to section 9609, subsection 1, paragraph D, the information specified in 
subsection 1 to the consumer upon receipt of a verifiable consumer request from the 
consumer.  A business is not obligated to provide information to the consumer pursuant to 
this section and sections 9603, 9604 and 9605 if the business cannot verify, pursuant to this 
subsection and rules adopted by the Attorney General pursuant to section 9616, subsection 
1, paragraph G, that the consumer making the request is the consumer about whom the 
business has collected information or is a person authorized by the consumer to act on such 
consumer's behalf.
3.  Information disclosed.  A business that sells consumers' personal information, or 
that discloses consumers' personal information for a business purpose, shall disclose, 
pursuant to section 9609, subsection 1, paragraph E, subparagraph (2):
A.  The category or categories of consumers' personal information it has sold, or if the 
business has not sold consumers' personal information, it shall disclose that fact; and
B.  The category or categories of consumers' personal information it has disclosed for 
a business purpose, or if the business has not disclosed the consumers' personal 
information for a business purpose, it shall disclose that fact.
4.  Sale by 3rd party.  A 3rd party may not sell personal information about a consumer 
that has been sold to the 3rd party by a business unless the consumer has received explicit 
notice and is provided an opportunity to exercise the right to opt out pursuant to section 
9607.
5.  Violations.  A person covered by this section that violates any of the restrictions set 
forth in this chapter is liable for the violations.  A business that discloses personal 
information to a person covered by this section in compliance with this section is not liable 
under this chapter if the person receiving the personal information uses it in violation of 
the restrictions set forth in this chapter, if, at the time of disclosing the personal information, 
the business does not have actual knowledge, or reason to believe, that the person intends 
to commit such a violation.
§9607.  Consumer's right to prohibit sale; right to opt out
1.  Right to opt out.  A consumer has the right, at any time, to direct a business that 
sells personal information about the consumer to 3rd parties not to sell the consumer's 
personal information.  This right may be referred to as "the right to opt out."
2.  Notice of right to opt out.  A business that sells consumers' personal information 
to 3rd parties shall provide notice to consumers, pursuant to section 9610, subsection 1, 
that this information may be sold and that consumers have the right to opt out of the sale 
of their personal information.
3.  Right to opt in; consumer's age.  Notwithstanding subsection 1, a business may 
not sell the personal information of a consumer if the business has actual knowledge that 
the consumer is less than 16 years of age, unless the consumer, in the case of a consumer 
at least 13 years of age and less than 16 years of age, or the consumer's parent or guardian, 
in the case of a consumer less than 13 years of age, has affirmatively authorized the sale of 
the consumer's personal information.  A business that willfully disregards the consumer's 
age is deemed to have had actual knowledge of the consumer's age.
The affirmative authorization required under this subsection may be referred to as "the right 
to opt in."
4.  Sale prohibited.  A business that has received direction from a consumer not to sell 
the consumer's personal information or, in the case of a minor consumer's personal 
information has not received consent to sell the minor consumer's personal information, is 
prohibited, pursuant to section 9610, subsection 1, paragraph D, from selling the 
consumer's personal information after its receipt of the consumer's direction, unless the 
consumer subsequently provides express authorization for the sale of the consumer's 
personal information.
§9608.  Business practices 
1.  Discrimination based on exercise of rights prohibited.  A business may not 
discriminate against a consumer because the consumer exercised any of the consumer's 
rights under this chapter, including, but not limited to, by:
A.  Denying goods or services to the consumer;
B.  Charging different prices or rates for goods or services, including through the use 
of discounts or other benefits or imposing penalties;
C.  Providing a different level or quality of goods or services to the consumer; or
D.  Suggesting that the consumer will receive a different price or rate for goods or 
services or a different level or quality of goods or services.
Nothing in this subsection prohibits a business from charging a consumer a different price 
or rate, or from providing a different level or quality of goods or services to the consumer, 
if that difference is reasonably related to the value provided to the business by the 
consumer's personal information.
2.  Financial incentives.  A business may offer financial incentives, including 
payments to consumers as compensation, for the collection of personal information, the 
sale of personal information or the deletion of personal information.  A business may also 
offer a different price, rate, level or quality of goods or services to the consumer if that 
price or difference is directly related to the value provided to the business by the consumer's 
personal information.
A.  A business that offers any financial incentives pursuant to this subsection shall 
notify consumers of the financial incentives pursuant to section 9609.
B.  A business may enter a consumer into a financial incentive program only if the 
consumer gives the business prior opt in consent pursuant to section 9609 that clearly 
describes the material terms of the financial incentive program, and which may be 
revoked by the consumer at any time.
C.  A business may not use financial incentive practices that are unjust, unreasonable, 
coercive or usurious in nature.
§9609.  Requests for and disclosure of information
1.  Requests; disclosure and delivery.  In order to comply with sections 9603, 9604, 
9605, 9606 and 9608, a business shall, in a form that is reasonably accessible to consumers:
A.  Make available to consumers 2 or more designated methods for submitting requests 
for information required to be disclosed pursuant to sections 9605 and 9606, including, 
at a minimum, a toll-free telephone number.  
(1)  A business that operates exclusively online and has a direct relationship with 
a consumer from whom it collects personal information is required to provide only 
an e-mail address for submitting requests for information required to be disclosed 
pursuant to sections 9605 and 9606.
(2)  If the business maintains an Internet website, the business shall make the 
Internet website available to consumers to submit requests for information required 
to be disclosed pursuant to sections 9605 and 9606;
B.  Disclose and deliver the required information to a consumer free of charge within 
days of receiving a verifiable consumer request from the consumer.  The business 
shall promptly take steps to determine whether the request is a verifiable consumer 
request, but this does not extend the business's duty to disclose and deliver the 
information within 45 days of receipt of the consumer's request.  The time period to 
provide the required information may be extended once by an additional 45 days when 
reasonably necessary, if the consumer is provided notice of the extension within the 
first 45-day period.  The disclosure must cover at least the 12-month period preceding 
the business's receipt of the verifiable consumer request and must be made in writing 
and delivered through the consumer's account with the business, if the consumer 
maintains an account with the business, or by mail or electronically at the consumer's 
option if the consumer does not maintain an account with the business, in a readily 
useable format that allows the consumer to transmit this information from one entity 
to another entity without hindrance.  The business may require authentication of the 
consumer that is reasonable in light of the nature of the personal information requested, 
but may not require the consumer to create an account with the business in order to 
make a verifiable consumer request.  If the consumer maintains an account with the 
business, the business may require the consumer to submit the request through that 
account.
C.  For purposes of section 9605, subsection 2:
(1)  To identify the consumer, associate the information provided by the consumer 
in the verifiable consumer request to any personal information previously collected 
by the business about the consumer; and
(2)  Identify by category or categories the personal information collected about the 
consumer in the preceding 12 months by reference to the enumerated category or 
categories in subsection 3 that most closely describe the personal information 
collected;
D.  For purposes of section 9606, subsection 2:
(1)  Identify the consumer and associate the information provided by the consumer 
in the verifiable consumer request to any personal information previously collected 
by the business about the consumer;
(2)  Identify by category or categories the personal information of the consumer 
that the business sold in the preceding 12 months by reference to the enumerated 
category or categories in subsection 3 that most closely describe the personal 
information, and provide the categories of 3rd parties to whom the consumer's 
personal information was sold in the preceding 12 months by reference to the 
enumerated category or categories in subsection 3 that most closely describe the 
personal information sold.  The business shall disclose the information in a list that 
is separate from a list generated for the purposes of subparagraph (3); and
(3)  Identify by category or categories the personal information of the consumer 
that the business disclosed for a business purpose in the preceding 12 months by 
reference to the enumerated category or categories in subsection 3 that most closely 
describes the personal information, and provide the categories of 3rd parties to 
whom the consumer's personal information was disclosed for a business purpose 
in the preceding 12 months by reference to the enumerated category or categories 
in subsection 3 that most closely describe the personal information disclosed.  The 
business shall disclose the information in a list that is separate from a list generated 
for the purposes of subparagraph (2);
E.  Disclose the following information in its online privacy policy or policies if the 
business has an online privacy policy or policies and in any description of consumers' 
privacy rights specific to the State or, if the business does not maintain those policies, 
on its Internet website and update that information at least once every 12 months:
(1)  A description of a consumer's rights pursuant to sections 9603, 9604, 9605, 
9606 and 9608 and one or more designated methods for submitting requests;
(2)  For purposes of section 9605, subsection 3, a list of the categories of personal 
information it has collected about consumers in the preceding 12 months by 
reference to the enumerated category or categories in subsection 3 that most closely 
describe the personal information collected;
(3)  For purposes of section 9606, subsection 3, paragraphs A and B, 2 separate 
lists:
(a)  A list of the categories of personal information it has sold about consumers 
in the preceding 12 months by reference to the enumerated category or 
categories in subsection 3 that most closely describe the personal information 
sold or, if the business has not sold consumers' personal information in the 
preceding 12 months, the business shall disclose that fact; and
(b)  A list of the categories of personal information it has disclosed about 
consumers for a business purpose in the preceding 12 months by reference to 
the enumerated category or categories in subsection 3 that most closely 
describe the personal information disclosed or, if the business has not disclosed 
consumers' personal information for a business purpose in the preceding 12 
months, the business shall disclose that fact;
(4)  In the case of a business that sells or discloses deidentified patient information 
not subject to this chapter pursuant to section 9612, subsection 1, paragraph D, 
subparagraph (1), whether the business sells or discloses deidentified patient 
information derived from patient information and, if so, whether that patient 
information was deidentified pursuant to one or more of the following:
(a)  The deidentification methodology described in of 45 Code of Federal 
Regulations, Section 164.514(b)(1); and
(b)  The deidentification methodology described in 45 Code of Federal 
Regulations, Section 164.514(b)(2);
F.  Ensure that all individuals responsible for handling consumer inquiries about the 
business's privacy practices or the business's compliance with this chapter are informed 
of all requirements in sections 9603, 9604, 9605, 9606 and 9608 and this section and 
how to direct consumers to exercise their rights under those sections; and
G.  Use any personal information collected from the consumer in connection with the 
business's verification of the consumer's request solely for the purposes of verification.
2.  Limit.  A business is not obligated to provide the information required by sections 
9605 and 9606 to the same consumer more than twice in a 12-month period.
3.  Categories of personal information.  The categories of personal information 
required to be disclosed pursuant to sections 9605 and 9606 must follow the enumerated 
categories set out in the definition of personal information in section 9602, subsection 14.
§9610.  Posted links and information
1.  Required links and information.  A business that is required to comply with 
section 9607 shall, in a form that is reasonably accessible to consumers:
A.  Provide a clear and conspicuous link on the business's homepage, titled "Do Not 
Sell My Personal Information," to an Internet webpage that enables a consumer, or a 
person authorized by the consumer, to opt out of the sale of the consumer's personal 
information.  A business may not require a consumer to create an account in order to 
direct the business not to sell the consumer's personal information;
B.  Include a description of a consumer's rights pursuant to section 9607, along with a 
separate link to the "Do Not Sell My Personal Information" Internet webpage in:
(1)  Its online privacy policy or policies if the business has an online privacy policy 
or policies; and
(2)  Any description of consumers' privacy rights specific to this State;
C.  Ensure that all individuals responsible for handling consumer inquiries about the 
business's privacy practices or the business's compliance with this chapter are informed 
of all requirements in section 9607 and this section and how to direct consumers to 
exercise their rights under section 9607 and this section;
D.  For consumers who exercise their right to opt out of the sale of their personal 
information under section 9607, refrain from selling personal information collected by 
the business about the consumer;
E.  For a consumer who has opted out of the sale of the consumer's personal information 
under section 9607, respect the consumer's decision to opt out for at least 12 months 
before requesting that the consumer authorize the sale of the consumer's personal 
information; and
F.  Use any personal information collected from a consumer in connection with the 
submission of the consumer's opt out request pursuant to section 9607 solely for the 
purposes of complying with the opt out request.
2.  Location of links and information.  Nothing in this chapter may be construed to 
require a business to comply with this chapter by including the required links and text on 
the homepage that the business makes available to the public generally, if the business 
maintains a separate and additional homepage that is dedicated to consumers in this State 
and that includes the required links and text, and the business takes reasonable steps to 
ensure that consumers in this State are directed to the homepage for consumers in this State 
and not the homepage made available to the public generally.
3.  Authorized person.  A consumer may authorize another person solely to opt out of 
the sale of the consumer's personal information on the consumer's behalf, and a business 
shall comply with an opt out request received from a person authorized by the consumer to 
act on the consumer's behalf, pursuant to rules adopted by the Attorney General pursuant 
to section 9619.
§9611.  Unaffected ability; continued application
1.  Business ability not restricted.  The obligations imposed on businesses by this 
chapter do not restrict a business's, service provider's or 3rd party's ability to:
A.  Comply with federal, state or local laws;
B.  Comply with a civil, criminal or regulatory inquiry, investigation, subpoena or 
summons by federal, state or local authorities;
C.  Cooperate with law enforcement agencies concerning conduct or activity that the 
business, service provider or 3rd party reasonably and in good faith believes may 
violate federal, state or local law;
D.  Exercise or defend legal claims;
E.  Collect, use, retain, sell or disclose consumer information that is deidentified or 
aggregate consumer information;
F.  Collect or sell a consumer's personal information if every aspect of that commercial 
conduct takes place wholly outside of the State.  For purposes of this chapter, 
commercial conduct takes place wholly outside of the State if the business, service 
provider or 3rd party collected that information while the consumer was outside of the 
State, no part of the sale of the consumer's personal information occurred in the State 
and no personal information collected while the consumer was in the State is sold. This 
paragraph does not permit a business, service provider or 3rd party to store, including 
on a device, personal information about a consumer when the consumer is in the State 
and then collect that personal information when the consumer and stored personal 
information is outside of the State.
2.  Violation of evidentiary privilege.  The obligations imposed on businesses by 
sections 9605 to 9610 do not apply when compliance by the business with those sections 
would violate an evidentiary privilege under the law of this State and do not prevent a 
business from providing the personal information of a consumer to a person covered by an 
evidentiary privilege under the law of this State as part of a privileged communication.
3.  Credit reporting agency information.  This chapter does not apply to an activity 
involving the collection, maintenance, disclosure, sale, communication or use of any 
personal information bearing on a consumer's credit worthiness, credit standing, credit 
capacity, character, general reputation, personal characteristics or mode of living by a 
consumer reporting agency, as defined in 15 United States Code, Section 1681a(f), by a 
furnisher of information, as set forth in 15 United States Code, Section 1681s-2, who 
provides information for use in a consumer report, as defined in 15 United States Code, 
Section 1681a(d), and by a user of a consumer report as set forth in 15 United States Code, 
Section 1681b.
This subsection applies only to the extent that such activity involving the collection, 
maintenance, disclosure, sale, communication or use of such information by that agency, 
furnisher or user is subject to regulation under the Fair Credit Reporting Act, 15 United 
States Code, Section 1681 et seq., and the information is not used, communicated, disclosed 
or sold except as authorized by the Fair Credit Reporting Act.
This subsection does not apply to section 9614.
4.  Gramm-Leach-Bliley Act information.  This chapter does not apply to personal 
information collected, processed, sold or disclosed pursuant to the federal Gramm-Leach-
Bliley Act, Public Law 106-102, and implementing regulations. 
This subsection does not apply to section 9614.
5.  Driver's Privacy Protection Act information.  This chapter does not apply to 
personal information collected, processed, sold or disclosed pursuant to the Driver's 
Privacy Protection Act of 1994, 18 United States Code, Section 2721 et seq.
This subsection does not apply to section 9614.
6.  Vehicle information or ownership information.  Section 9607 does not apply to 
vehicle information or ownership information retained or shared between a new motor 
vehicle dealer, as defined in section 1171, subsection 12, and the vehicle's manufacturer, 
as defined in section 1171, subsection 10, if the vehicle information or ownership 
information is shared for the purpose of effectuating, or in anticipation of effectuating, a 
vehicle repair covered by a vehicle warranty or a recall conducted pursuant to 49 United 
States Code, Sections 30118 to 30120, as long as the new motor vehicle dealer or vehicle 
manufacturer with which that vehicle information or ownership information is shared does 
not sell, share or use that information for any other purpose.
For purposes of this subsection:
A.  "Vehicle information" means the vehicle information number, make, model, year 
and odometer reading; and
B.  "Ownership information" means the name or names of the registered owner or 
owners and the contact information for the owner or owners.
7.  Extensions; reasons for not taking action; manifestly unfounded or excessive 
requests.  Notwithstanding a business's obligations to respond to and honor consumer 
rights requests pursuant to this chapter:
A.  A time period for a business to respond to any verifiable consumer request may be 
extended by up to 90 additional days where necessary, taking into account the 
complexity and number of the requests.  The business shall inform the consumer of any 
such extension within 45 days of receipt of the request, together with the reasons for 
the delay;
B.  If the business does not take action on the request of the consumer, the business 
shall inform the consumer, without delay and at the latest within the time period 
permitted for response by this section, of the reasons for not taking action and any 
rights the consumer may have to appeal the decision to the business; and
C.  If requests from a consumer are manifestly unfounded or excessive, in particular 
because of their repetitive character, a business may either charge a reasonable fee, 
taking into account the administrative costs of providing the information or 
communication or taking the action requested, or refuse to act on the request and notify 
the consumer of the reason for refusing the request.  The business shall bear the burden 
of demonstrating that any verifiable consumer request is manifestly unfounded or 
excessive.
8.  Disclosure to service provider.  A business that discloses personal information to 
a service provider is not liable under this chapter if the service provider receiving the 
personal information uses it in violation of the restrictions set forth in this chapter, if, at the 
time of disclosing the personal information, the business does not have actual knowledge 
or reason to believe that the service provider intends to commit such a violation.  A service 
provider is likewise not liable under this chapter for the obligations of a business for which 
it provides services as set forth in this chapter.
9.  Ordinary course of business.  This chapter may not be construed to require a 
business to collect personal information that it would not otherwise collect in the ordinary 
course of its business, retain personal information for longer than it would otherwise retain 
such information in the ordinary course of its business or reidentify or otherwise link 
information that is not maintained in a manner that would be considered personal 
information.
10.  Rights and freedoms of other consumers.  The rights afforded to consumers and 
the obligations imposed on a business under this chapter may not adversely affect the rights 
and freedoms of other consumers.
§9612.  Medical and health information
1.  Nonapplicability.  This chapter does not apply to any of the following:
A.  Health care information governed by Title 22, section 1711-C or protected health 
care information that is collected by a covered entity or business associate governed by 
the privacy, security and breach notification rules issued by the United States 
Department of Health and Human Services, 45 Code of Federal Regulations, Parts 160 
and 164, established pursuant to the federal Health Insurance Portability and 
Accountability Act of 1996, Public Law 104-191, and the federal Health Information 
Technology for Economic and Clinical Health Act, Title XIII of the federal American 
Recovery and Reinvestment Act of 2009, Public Law 111-5;
B.  A health care practitioner governed by Title 22, section 1711-C or a covered entity 
governed by the privacy, security and breach notification rules issued by the United 
States Department of Health and Human Services, 45 Code of Federal Regulations, 
Parts 160 and 164, established pursuant to the federal Health Insurance Portability and 
Accountability Act of 1996, Public Law 104-191, to the extent the provider or covered 
entity maintains, uses and discloses patient information in the same manner as health 
care information or protected health care information as described in paragraph A;
C.  A business associate of a covered entity governed by the privacy, security and data 
breach notification rules issued by the United States Department of Health and Human 
Services, 45 Code of Federal Regulations, Parts 160 and 164, established pursuant to 
the federal Health Insurance Portability and Accountability Act of 1996, Public Law 
104-191, and the federal Health Information Technology for Economic and Clinical 
Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 
2009, Public Law 111-5, to the extent that the business associate maintains, uses and 
discloses patient information in the same manner as health care information or 
protected health care information as described in paragraph A;
D.  Information that meets both of the following conditions:
(1)  It is deidentified in accordance with the requirements for deidentification set 
forth in 45 Code of Federal Regulations, Section 164.514; and
(2)  It is derived from patient information that was originally collected, created, 
transmitted or maintained by an entity regulated by the federal Health Insurance 
Portability and Accountability Act of 1996 or 45 Code of Federal Regulations, Part 
46.
Information that met the requirements of subparagraphs (1) and (2) but is subsequently 
reidentified is no longer eligible for the exemption in this paragraph and is subject to 
applicable federal and state data privacy and security laws, including, but not limited 
to, the federal Health Insurance Portability and Accountability Act of 1996 and this 
chapter; and
E.  Information that is collected, used or disclosed in research, as defined in 45 Code 
of Federal Regulations, Section 164.501, including, but not limited to, a clinical trial, 
and that is conducted in accordance with applicable ethics, confidentiality, privacy and 
security rules of 45 Code of Federal Regulations, Parts 46 and 164, good clinical 
practice guidelines issued by the International Council for Harmonisation of Technical 
Requirements for Pharmaceuticals for Human Use, or successor organization, or 
human subject protection requirements of the United States Food and Drug 
Administration.
2.  Terms.  For purposes of this section:
A.  "Business associate" has the same meaning as in 45 Code of Federal Regulations, 
Section 160.103;
B.  "Covered entity" has the same meaning as in 45 Code of Federal Regulations, 
Section 160.103;
C.  "Health care information" means any individually identifiable information, in 
electronic or physical form, in possession of or derived from a provider of health care, 
health care service plan, pharmaceutical company or contractor regarding a patient's 
medical history, mental or physical condition or treatment.  "Individually identifiable" 
means that the medical information includes or contains any element of personal 
identifying information sufficient to allow identification of the individual, such as the 
patient's name, mailing address, e-mail address, telephone number or social security 
number, or other information that, alone or in combination with other publicly available 
information, reveals the individual's identity;
D.  "Health care practitioner" means a person licensed by this State to provide or 
otherwise lawfully providing health care or a partnership or corporation made up of 
health care practitioners or an officer, employee, agent or contractor of a health care 
practitioner acting in the course and scope of employment, agency or contract related 
to or supportive of the provision of health care to individuals;
E.  "Identifiable private information" has the same meaning as in 45 Code of Federal 
Regulations, Section 46.102;
F.  "Individually identifiable health information" has the same meaning as in 45 Code 
of Federal Regulations, Section 160.103;
G.  "Patient information" means identifiable private information, protected health 
information, individually identifiable health information or health care information; 
and
H.  "Protected health information" has the same meaning as in 45 Code of Federal 
Regulations, Section 160.103.
§9613.  Reidentification of information
1.  Reidentification prohibited; exceptions.  A business or other person may not 
reidentify, or attempt to reidentify, information that has met the requirements of section 
9612, subsection 1, paragraph D, except for one or more of the following purposes:
A.  Treatment, payment or health care operations conducted by a covered entity or 
business associate acting on behalf of, and at the written direction of, the covered entity.  
For purposes of this paragraph, "treatment," "payment" and "health care operations" 
have the same meanings as in 45 Code of Federal Regulations, Section 164.501 and 
"covered entity" and "business associate" have the same meanings as in 45 Code of 
Federal Regulations, Section 160.103;
B.  Public health activities or purposes as described in 45 Code of Federal Regulations, 
Section 164.512;
C.  Research, as defined in 45 Code of Federal Regulations, Section 164.501, that is 
conducted in accordance with 45 Code of Federal Regulations, Part 46;
D.  Pursuant to a contract where the lawful holder of the deidentified information that 
met the requirements of section 9612, subsection 1, paragraph D expressly engages a 
person or entity to attempt to reidentify the deidentified information in order to conduct 
testing, analysis or validation of deidentification, or related statistical techniques, if the 
contract bans any other use or disclosure of the reidentified information and requires 
the return or destruction of the information that was reidentified upon completion of 
the contract; and
E.  If otherwise required by law.
2.  Information reidentified subject to data privacy and security laws.  In 
accordance with section 9612, subsection 1, paragraph D, information reidentified pursuant 
to this section is subject to applicable federal and state data privacy and security laws 
including, but not limited to, the federal Health Insurance Portability and Accountability 
Act of 1996 and this chapter.
3.  Statements; further disclosure.  A contract for the sale or license of deidentified 
information that has met the requirements of section 9612, subsection 1, paragraph D, when 
one of the parties is a person residing or doing business in the State, must include the 
following, or substantially similar, provisions:
A.  A statement that the deidentified information being sold or licensed includes 
deidentified patient information;
B.  A statement that reidentification, and attempted reidentification, of the deidentified 
information by the purchaser or licensee of the information is prohibited pursuant to 
this section; and
C.  A requirement that, unless otherwise required by law, the purchaser or licensee of 
the deidentified information may not further disclose the deidentified information to 
any 3rd party unless the 3rd party is contractually bound by the same or stricter 
restrictions and conditions.
§9614.  Civil action based on violation
1.  Civil action based on violation.  A consumer whose nonencrypted and nonredacted 
personal information is subject to an unauthorized access and exfiltration, theft or 
disclosure as a result of the business's violation of the duty to implement and maintain 
reasonable security procedures and practices appropriate to the nature of the information to 
protect the personal information may institute a civil action for any of the following:
A.  To recover damages in an amount not less than $100 and not greater than $750 per 
consumer per incident or actual damages, whichever is greater;
B.  Injunctive or declaratory relief; and
C.  Any other relief the court determines proper.
In assessing the amount of statutory damages, the court shall consider any one or more of 
the relevant circumstances presented by any of the parties to the case, including, but not 
limited to, the nature and seriousness of the misconduct, the number of violations, the 
persistence of the misconduct, the length of time over which the misconduct occurred, the 
willfulness of the defendant's misconduct and the defendant's assets, liabilities and net 
worth.
2.  Notice of alleged violation; opportunity to cure; exception.  Actions pursuant to 
this section may be brought by a consumer if, prior to initiating any action against a 
business for statutory damages on an individual or classwide basis, a consumer provides a 
business 30 days' written notice identifying the specific provisions of this chapter the 
consumer alleges have been or are being violated.  In the event a cure is possible, if within 
the 30 days the business actually cures the noticed violation and provides the consumer an 
express written statement that the violations have been cured and that no further violations 
will occur, no action for individual statutory damages or classwide statutory damages may 
be initiated against the business.  Notice is not required prior to an individual consumer's 
initiating an action solely for actual pecuniary damages suffered as a result of the alleged 
violation of this chapter.  If a business continues to violate this chapter in breach of the 
express written statement provided to the consumer under this section, the consumer may 
initiate an action against the business to enforce the written statement and may pursue 
statutory damages for each breach of the express written statement, as well as any other 
violation of the chapter that postdates the written statement.
3.  Defined violations; no basis for private right of action under other law.  The 
cause of action established by this section applies only to violations as defined in subsection 
and may not be based on violations of any other section of this chapter.  Nothing in this 
chapter may be interpreted to serve as the basis for a private right of action under any other 
law.  This section may not be construed to relieve any party from any duties or obligations 
imposed under other law or the United States Constitution or the Constitution of Maine.
§9615.  Compliance; civil penalties
1.  Guidance of Attorney General.  Any business or 3rd party may seek the opinion 
of the Attorney General for guidance on how to comply with the provisions of this chapter.
2.  Failure to cure; civil penalties.  A business violates this chapter if it fails to cure 
any alleged violation within 30 days after being notified of alleged noncompliance.  A 
business, service provider or other person that violates this chapter is subject to an 
injunction and liable for a civil penalty of not more than $2,500 for each violation or $7,500 
for each intentional violation, which must be assessed and recovered in a civil action 
brought in the name of the State by the Attorney General.  The civil penalties provided for 
in this section must be exclusively assessed and recovered in a civil action brought in the 
name of the State by the Attorney General.
3.  Consumer Privacy Fund.  Any civil penalty assessed for a violation of this chapter 
and the proceeds of any settlement of an action brought pursuant to subsection 2 must be 
deposited in the Consumer Privacy Fund created pursuant to section 9616, subsection 1.
§9616.  Consumer Privacy Fund
1.  Consumer Privacy Fund created.  A special fund to be known and referred to in 
this section as "the Consumer Privacy Fund" is created within the General Fund in the State 
Treasury. The purpose of the fund is to offset any costs incurred by the courts in connection 
with actions brought to enforce this chapter and any costs incurred by the Attorney General 
in carrying out the Attorney General's duties under this chapter.
2.  Uses.  Funds transferred to the Consumer Privacy Fund must be used exclusively to 
offset any costs incurred by the state courts and the Attorney General in connection with 
this chapter. These funds may not be subject to appropriation or transfer by the Legislature 
for any other purpose, unless the Commissioner of Administrative and Financial Services 
determines that the funds are in excess of the funding needed to fully offset the costs 
incurred by the state courts and the Attorney General in connection with this chapter, in 
which case the Legislature may appropriate excess funds for other purposes.
§6917.  Privacy protection
This chapter is intended to further the right of privacy and to supplement existing laws 
relating to consumers' personal information.  The provisions of this chapter are not limited 
to information collected electronically or over the Internet, but apply to the collection and 
sale of all personal information collected by a business from consumers.  Wherever 
possible, law relating to consumers' personal information must be construed to harmonize 
with the provisions of this chapter, but in the event of a conflict between other laws and the 
provisions of this chapter, the provisions of the law that afford the greatest protection for 
the right of privacy for consumers controls.
§9618.  Preemption
This chapter is a matter of statewide concern and supersedes and preempts all rules, 
regulations, codes, ordinances and other laws adopted by a municipality, county or local 
agency regarding the collection and sale of consumers' personal information by a business.
§9619.  Rules
1.  Rules.  On or before January 1, 2022, the Attorney General shall solicit broad public 
participation and adopt rules to further the purposes of this chapter, including, but not 
limited to, the following areas:
A.  Updating as needed additional categories of personal information to those 
enumerated in section 9602, subsection 14 in order to address changes in technology, 
data collection practices, obstacles to implementation and privacy concerns;
B.  Updating as needed the definition of "unique identifiers" to address changes in 
technology, data collection, obstacles to implementation and privacy concerns, and to 
add categories to the definition of "designated methods for submitting requests" to 
facilitate a consumer's ability to obtain information from a business pursuant to section 
9609;
C.  Establishing any exceptions necessary to comply with state or federal law, 
including, but not limited to, those relating to trade secrets and intellectual property 
rights, within one year of passage of this chapter and as needed thereafter;
D.  Establishing rules and procedures for the following:
(1)  To facilitate and govern the submission of a request by a consumer to opt out 
of the sale of personal information pursuant to section 9607;
(2)  To govern business compliance with a consumer's opt out request; and
(3)  For the development and use of a recognizable and uniform opt out logo or 
button by all businesses to promote consumer awareness of the opportunity to opt 
out of the sale of personal information;
E.  Adjusting the monetary threshold in section 9602, subsection 3, paragraph A, 
subparagraph (1) in January of every odd-numbered year to reflect any increase in the 
United States Department of Labor, Bureau of Labor Statistics Consumer Price Index;
F.  Establishing rules, procedures and any exceptions necessary to ensure that the 
notices and information that businesses are required to provide pursuant to this chapter 
are provided in a manner that may be easily understood by the average consumer, are 
accessible to consumers with disabilities and are available in the language primarily 
used to interact with the consumer, including establishing rules and guidelines 
regarding financial incentive offerings, within one year of passage of this chapter and 
as needed thereafter; and
G.  Establishing rules and procedures to further the purposes of sections 9605 and 9606 
and to facilitate a consumer's or the consumer's authorized agent's ability to obtain 
information pursuant to section 9609, with the goal of minimizing the administrative 
burden on consumers, taking into account available technology, security concerns and 
the burden on the business, to govern a business's determination that a request for 
information received from a consumer is a verifiable consumer request, including 
treating a request submitted through a password-protected account maintained by the 
consumer with the business while the consumer is logged into the account as a 
verifiable consumer request and providing a mechanism for a consumer who does not 
maintain an account with the business to request information through the business's 
authentication of the consumer's identity, within one year of passage of this chapter 
and as needed thereafter.
2.  Additional rules.  The Attorney General may adopt additional rules as follows:
A.  To establish rules and procedures on how to process and comply with verifiable 
consumer requests for specific pieces of personal information relating to a household 
in order to address obstacles to implementation and privacy concerns; and
B.  As necessary to further the purposes of this chapter.
3.  Enforcement action after 6 months.  The Attorney General may not bring an 
enforcement action under this chapter until 6 months after the adoption of the final rules 
issued pursuant to this section or July 1, 2022, whichever is sooner.
4.  Routine technical rules.  Rules adopted under this section are routine technical 
rules pursuant to Title 5, chapter 375, subchapter 2-A.
§9620.  Series of steps or transactions
If a series of steps or transactions were component parts of a single transaction intended 
from the beginning to be taken with the intention of avoiding the reach of this chapter, 
including the disclosure of information by a business to a 3rd party in order to avoid the 
definition of "sell," a court shall disregard the intermediate steps or transactions for 
purposes of effectuating the purposes of this chapter.
§9621.  Waiver or limit of rights void and unenforceable
Any provision of a contract or agreement of any kind that purports to waive or limit in 
any way a consumer's rights under this chapter, including, but not limited to, any right to a 
remedy or means of enforcement, is deemed contrary to public policy and is void and 
unenforceable.  This section does not prevent a consumer from declining to request 
information from a business, declining to opt out of a business's sale of the consumer's 
personal information or authorizing a business to sell the consumer's personal information 
after previously opting out.
§9622.  Liberal construction 
This chapter must be liberally construed to effectuate its purposes.
§9623.  Effective date
This chapter takes effect January 1, 2022.
Sec. 2.  35-A MRSA c. 94, as amended, is repealed.
Sec. 3.  Effective date.  That section of this Act that repeals the Maine Revised 
Statutes, Title 35-A, chapter 94 takes effect January 1, 2022.
SUMMARY
This bill establishes the Maine Consumer Privacy Act, which is modeled on the 
California Consumer Privacy Act of 2018.  It applies to the collection and sale of all 
personal information collected by a business from consumers.  Because the new Act covers 
Internet service providers, this bill repeals the Maine Revised Statutes, Title 35-A, chapter 
to keep all entities on equal footing, allowing consumers to opt out of the sale of personal 
information.
The Maine Consumer Privacy Act takes effect January 1, 2022.  The repeal of Title 
35-A, chapter 94 is effective January 1, 2022.