An Act to Create the Data Privacy and Protection Act
Maine Legislature, Session 131, LD 1977
Committee: Innovation, Development, Economic Advancement and Business
Sponsors: O'NEIL, HICKMAN, BOYER, BRENNAN, RIELLY

Legislative Document
No. 1977
H.P. 1270
House of Representatives, May 22, 2023
An Act to Create the Data Privacy and Protection Act
Reference to the Committee on Innovation, Development, Economic Advancement and 
Business suggested and ordered printed.
ROBERT B. HUNT
Clerk
Presented by Representative O'NEIL of Saco.
Cosponsored by Senator HICKMAN of Kennebec and
Representatives: BOYER of Poland, BRENNAN of Portland, RIELLY of Westbrook.
Be it enacted by the People of the State of Maine as follows:
Sec. 1.  10 MRSA c. 1057 is enacted to read:
CHAPTER 1057
DATA PRIVACY AND PROTECTION ACT
§9601. Short title
This chapter may be known and cited as "the Data Privacy and Protection Act."
§9602. Definitions
As used in this chapter, unless the context otherwise indicates, the following terms 
have the following meanings.
1. Affirmative consent.  "Affirmative consent" means an affirmative act by an 
individual that clearly communicates the individual's freely given, specific and 
unambiguous authorization for an act or practice after having been informed, in response 
to a specific request from a covered entity.
2. Biometric information.  "Biometric information" means covered data generated 
from the technological processing of an individual's unique biological, physical or 
physiological characteristics that is linked or reasonably linkable to an individual. 
"Biometric information" includes fingerprints; voice prints; iris or retina scans; facial or 
hand mapping, geometry or templates; or gait or other unique body movements. "Biometric 
information" does not include a digital or physical photograph; an audio or video recording; 
or data generated from a digital or physical photograph or an audio or video recording, that 
cannot be used, alone or in combination with other information, to identify an individual.
3. Control.  "Control" means, with respect to an entity:
A.  Ownership of, or the power to vote, more than 50% of the outstanding shares of 
any class of voting security of the entity;
B.  Control over the election of a majority of the directors of the entity or of individuals 
exercising similar functions; or
C.  The power to exercise a controlling influence over the management of the entity.
4. Covered algorithm.  "Covered algorithm" means a computational process that uses 
machine learning, natural language processing, artificial intelligence techniques or other 
computational processing techniques of similar or greater complexity and that makes a 
decision or facilitates human decision-making with respect to covered data, including to 
determine the provision of products or services or to rank, order, promote, recommend, 
amplify or similarly determine the delivery or display of information to an individual.
5. Covered data.  "Covered data" means information, including derived data and 
unique identifiers, that identifies or is linked or reasonably linkable, alone or in 
combination with other information, to an individual or a device that identifies or is linked 
or reasonably linkable to an individual.  "Covered data" does not include de-identified data 
or publicly available information.
6. Covered entity.  "Covered entity" means a person, other than an individual acting 
in a non-commercial context, that alone or jointly with others determines the purposes and 
means of collecting, processing or transferring covered data.  "Covered entity" includes a 
person that controls, is controlled by or is under common control with the covered entity.  
"Covered entity" does not include an entity that is acting as a service provider.
7. Covered high-impact social media company.  "Covered high-impact social media 
company" means a covered entity that provides an Internet-based platform that constitutes 
an online product or service that is primarily used by users to access or share user-generated 
content and:
A.  Generates $3,000,000,000 or more in annual revenue; and
B.  Has 300,000,000 or more monthly active users for not fewer than 3 of the preceding 
months on the online product or service of the covered entity.
8. Covered language.  "Covered language" means one of the 10 languages with the 
most speakers in the United States, according to the most recent United States census.
9. Data broker.  "Data broker" means a covered entity whose principal source of 
revenue is derived from processing or transferring covered data that the covered entity did 
not collect directly from the individuals linked or linkable to the covered data. "Data 
broker" does not include a covered entity as long as that covered entity is acting as a service 
provider. For purposes of this subsection, "principal source of revenue" means, for the prior 
12-month period, either more than 50% of all revenue of the covered entity or obtaining 
revenue from processing or transferring the covered data of more than 5,000,000 
individuals that the covered entity did not collect directly from the individuals linked or 
linkable to the covered data.
10. De-identified data.  "De-identified data" means information that does not identify 
and is not linked or reasonably linkable to a distinct individual or a device, regardless of 
whether the information is aggregated.
11. Large data holder.  "Large data holder" means a covered entity or service provider 
that, in the most recent calendar year, had annual gross revenues of $250,000,000 or more 
and collected, processed or transferred the covered data of more than 5,000,000 individuals 
or devices that identify or are linked or reasonably linkable to one or more individuals, 
excluding covered data collected and processed solely for the purpose of billing for, 
finalizing or otherwise collecting payment for a requested product or service and sensitive 
data of more than 200,000 individuals or devices that identify or are linked or reasonably 
linkable to one or more individuals. "Large data holder" does not include an instance in 
which the covered entity or service provider would qualify as a large data holder solely on 
the basis of collecting or processing personal e-mail addresses, personal telephone numbers 
or log-in information of an individual or device to allow the individual or device to log in 
to an account administered by the covered entity or service provider.
12. Material.  "Material," with respect to an act, practice or representation of a covered 
entity, including a representation made by the covered entity in a privacy policy or similar 
disclosure to individuals, involving the collection, processing or transfer of covered data, 
means that the act, practice or representation is likely to affect a reasonable individual's 
decisions, conduct or expectations regarding a product or service or processing of personal 
data.
13. Sensitive data.  "Sensitive data" means the following types of covered data:
A.  A government-issued identifier, including a Social Security number, passport 
number or driver's license number, that is not required by law to be displayed in public;
B.  Information that describes or reveals the physical health, mental health, disability, 
diagnosis or health condition or treatment of an individual;
C. A financial account number, debit card number, credit card number or information 
that describes the income level or bank account balances of an individual, except that 
"sensitive data" does not include the last 4 digits of a debit or credit card number;
D.  Biometric information;
E.  Genetic information;
F.  Information that is derived from a device or technology that reveals the past or 
present physical location of an individual or device that identifies or is linked or 
reasonably linkable to one or more individuals, with sufficient precision to identify 
street-level location information of an individual or device or the location of an 
individual or device within a range of 1,850 feet or less, but not geolocation 
information identifiable or derived solely from the visual content of a legally obtained 
image, including the location of the device that captured the image;
G.  An individual's private communications, including voicemails, e-mails, texts, direct 
messages or mail, or information identifying the parties to those communications, 
voice communications, video communications and information that pertains to the 
transmission of those communications, including telephone numbers called, telephone 
numbers from which calls were placed, the time calls were made, call duration and 
location information of the parties to the call, unless the covered entity or a service 
provider acting on behalf of the covered entity is the sender or an intended recipient of 
the communication.  For purposes of this paragraph, communications are not private if 
those communications are made from or to a device provided by an employer to an 
employee and the employer provides conspicuous notice that the employer may access 
communications made on the device;
H.  Account or device log-in credentials or security or access codes for an account or 
device;
I.  Information identifying the sexual behavior of an individual in a manner inconsistent 
with the individual's reasonable expectation regarding the collection, processing or 
transfer of that information;
J.  Calendar information, address book information, phone or text logs, photos, audio 
recordings or videos maintained for private use by an individual, regardless of whether 
that information is stored on the individual's device or is accessible from that device 
and is backed up in a separate location.  For purposes of this paragraph, information is 
not sensitive if the information is sent from or to a device provided by an employer to 
an employee and the employer provides conspicuous notice that the employer may 
access the information on the device;
K. A photograph, film, video recording or other similar medium that shows the naked 
or undergarment-clad genitals of an individual;
L.  Information revealing the video content requested or selected by an individual 
collected by a covered entity, not including covered data used solely for transfers for 
independent video measurement;
M.  Information about an individual when the covered entity or service provider has 
knowledge that the individual is a minor;
N.  An individual's race, color, ethnicity, religion, employment history, immigration 
status or union membership or information about the individual's family or social 
relationships; and
O.  Information identifying an individual's online activities over time and across 3rd-
party websites or online services.
14. Service provider.  "Service provider" means a person that collects, processes or 
transfers and receives covered data on behalf of and at the direction of a covered entity or 
a federal, state, tribal, territorial or local government entity. 
15. Service provider data.  "Service provider data" means covered data that is 
collected or processed by or has been transferred to a service provider by or on behalf of a 
covered entity, another service provider or a federal, state, tribal, territorial or local 
government entity for the purpose of allowing the service provider to whom the covered 
data is transferred to perform a service or function on behalf of and at the direction of the 
covered entity, service provider or a federal, state, tribal, territorial or local government 
entity.
16. Small business.  "Small business" means a covered entity or a service provider that 
meets the following criteria for the period of the 3 preceding calendar years or for the period 
during which the covered entity or service provider has been in existence if the covered 
entity or service provider has been in existence less than 3 years:
A.  The covered entity or service provider's average annual gross revenues during the 
period did not exceed $41,000,000;
B.  The covered entity or service provider, on average, did not annually collect or 
process the covered data of more than 200,000 individuals during the period beyond 
the purpose of initiating, billing for, finalizing or otherwise collecting payment for a 
requested service or product, as long as all covered data for that purpose was deleted 
or de-identified within 90 days, except when necessary to investigate fraud or as 
consistent with a covered entity's return policy; and
C.  Is not a data broker.
17. Substantial privacy risk.  "Substantial privacy risk" means the collection, 
processing or transfer of covered data in a manner that may result in a reasonably 
foreseeable substantial physical injury, economic injury, highly offensive intrusion into the 
privacy expectations of a reasonable individual under the circumstances or discrimination 
on the basis of race, color, religion, national origin, sex or disability.
18. Targeted advertising.  "Targeted advertising" means presenting to an individual 
or device identified by a unique identifier, or groups of individuals or devices identified by 
unique identifiers, an online advertisement that is selected based on known or predicted 
preferences, characteristics or interests associated with the individual or a device identified 
by a unique identifier.  "Targeted advertising" does not include advertising or marketing to 
an individual or an individual's device in response to the individual's specific request for 
information or feedback; an advertisement displayed based on the content or nature of the 
publicly accessible website or service in which the advertisement appears and does not vary 
based on who is viewing the advertisement; or processing covered data strictly necessary 
for the sole purpose of measuring or reporting advertising or content, performance, reach 
or frequency, including independent measurement.
19.  Third party.  "Third party" means a person, including a covered entity, that 
collects, processes or transfers covered data and is not a consumer-facing business with 
which the individual linked or reasonably linkable to that covered data expects and intends 
to interact and is not a service provider with respect to that data.  "Third party" does not 
include a person that collects covered data from another entity if the 2 entities are related 
by common ownership or corporate control unless a reasonable consumer's reasonable 
expectation would be that the entities share information.
§9603.  Applicability
This chapter does not apply to:
1. Government agencies.  A government agency or service provider to a government 
agency that exclusively and solely processes information provided by government entities; 
or
2. Certain persons.  A person that meets the following criteria for the period of the 3 
preceding calendar years or for the period during which the person has been in existence if 
the person is an entity that has been in existence for less than 3 years:
A.  The person's average annual gross revenues during the period did not exceed 
$20,000,000;
B.  The person, on average, did not annually collect or process the covered data of more 
than 75,000 individuals during the period beyond the purpose of initiating, billing for, 
finalizing or otherwise collecting payment for a requested service or product, as long 
as all covered data for that purpose was deleted or de-identified within 90 days, except 
when necessary to investigate fraud or as consistent with a covered entity's return 
policy; and
C.  No component of the person's revenue comes from transferring covered data during 
a year or part of a year if the person is an entity that has been in existence for less than 
one year.
§9604.  Actions regarding covered data
1. Prohibitions.  Except as provided by subsection 2, a covered entity may not collect, 
process or transfer covered data unless the collection, processing or transfer is limited to 
what is reasonably necessary and proportionate to provide or maintain a specific product 
or service requested by the individual to whom the data pertains.  A covered entity or 
service provider may not engage in deceptive advertising or marketing with respect to a 
product or service offered to an individual.
2. Allowed purposes.  A covered entity may collect, process or transfer covered data 
for any of the following purposes if the collection, processing or transfer is limited to what 
is reasonably necessary and proportionate to that purpose:
A.  To initiate, manage or complete a transaction or fulfill an order for a specific 
product or service requested by an individual, including associated routine 
administrative, operational and account-servicing activity including billing, shipping, 
delivery, storage and accounting;
B.  With respect to covered data previously collected in accordance with this chapter:
(1)  To process the data as necessary to perform system maintenance or diagnostics;
(2)  To develop, maintain, repair or enhance a product or service for which the data 
was collected;
(3)  To conduct internal research or analytics to improve a product or service for 
which the data was collected;
(4)  To perform inventory management or reasonable network management;
(5)  To protect against spam;
(6)  To debug or repair errors that impair the functionality of a service or product 
for which the data was collected;
(7)  To process the data as necessary to provide first-party advertising or marketing 
of products or services provided by the covered entity for individuals who are not 
minors.  For purposes of this subparagraph, "first-party advertising or marketing" 
means advertising or marketing conducted by a covered entity that collects covered 
data from the individual linked or reasonably linkable to that data through either 
direct communications with the individual including direct mail, e-mail or text 
message communications, or advertising or marketing conducted entirely within 
the first-party context, including in a physical location operated by or on behalf of 
the covered entity, or on a website or mobile application operated by or on behalf 
of the covered entity; and
(8)  To provide targeted advertising;
C.  To authenticate users of a product or service;
D.  To fulfill a product or service warranty;
E.  To prevent, detect, protect against or respond to a security incident. For purposes 
of this paragraph, "security incident" means a network security or physical security 
incident, including an intrusion or trespass, medical alert or fire alarm;
F.  To prevent, detect, protect against or respond to fraud, harassment or illegal activity 
targeted at or involving the covered entity or its services. For purposes of this 
paragraph, the term "illegal activity" means a violation of a federal, state or local law 
punishable as a crime that can directly cause harm to another person;
G.  To comply with a legal obligation imposed by federal, tribal, local or state law or 
to investigate, establish, prepare for or defend legal claims involving the covered entity 
or service provider;
H.  To prevent an individual from suffering harm when the covered entity or service 
provider believes in good faith that the individual is at risk of death, serious physical 
injury or other serious health risk;
I.  To carry out a product recall pursuant to federal or state law;
J.  To conduct a public or peer-reviewed scientific, historical or statistical research 
project that:
(1)  Is in the public interest; and
(2)  Adheres to all relevant laws and regulations governing that research, including 
regulations for the protection of human subjects, or is excluded from criteria of the 
institutional review board;
K.  To deliver a communication that is not an advertisement to an individual, if the 
communication is reasonably anticipated by the individual within the context of the 
individual's interactions with the covered entity;
L.  To deliver a communication at the direction of an individual between that individual 
and one or more individuals or entities;
M.  To transfer assets to a 3rd party in the context of a merger, acquisition, bankruptcy 
or similar transaction when the 3rd party assumes control, in whole or in part, of the 
covered entity's assets, only if the covered entity, in a reasonable time prior to the 
transfer, provides an affected individual with:
(1)  A notice describing the transfer, including the name of the entity receiving the 
individual's covered data and the applicable privacy policies; and
(2)  A reasonable opportunity to withdraw previously given consent in accordance 
with the requirements of affirmative consent under section 9609 related to the 
individual's covered data and a reasonable opportunity to request the deletion of 
the individual's covered data;
N.  To ensure the data security and integrity of covered data; and
O.  To support or promote participation by individuals in civic engagement activities 
and democratic governance, including voting, petitioning, engaging with government 
proceedings, providing indigent legal aid services and unionizing.
§9605. Actions regarding sensitive data
A covered entity or service provider may not:
1. Social security numbers.  Process or transfer a social security number, except when 
necessary to facilitate an extension of credit, authentication, fraud and identity fraud 
detection and prevention, the payment or collection of taxes, the enforcement of a contract 
between parties or the prevention, investigation or prosecution of fraud or illegal activity 
or as otherwise required by federal, state or local law;
2. Collections and processing.  Collect or process sensitive data, except when the 
collection or processing is strictly necessary to provide or maintain a specific product or 
service requested by the individual to whom the sensitive data pertains or is strictly 
necessary to achieve a purpose described by section 9604, subsection 2, paragraphs A to 
N;
3. Third parties.  Transfer an individual's sensitive data to a 3rd party, unless:
A.  The transfer is made with the affirmative consent of the individual;
B.  The transfer is necessary to comply with a legal obligation imposed by federal, 
state, tribal or local law or to investigate, establish, exercise or defend legal claims;
C.  The transfer is necessary to prevent an individual from imminent injury when the 
covered entity believes in good faith that the individual is at risk of death, serious 
physical injury or serious health risk;
D.  In the case of the transfer of a password, the transfer is necessary to use a designated 
password manager or the transfer is to a covered entity for the exclusive purpose of 
identifying passwords that are being reused across sites or accounts;
E.  In the case of the transfer of genetic information, the transfer is necessary to perform 
a medical diagnosis or medical treatment specifically requested by an individual or to 
conduct medical research; or
F.  The transfer complies with section 9604, subsection 2, paragraph M;
4.  Communication services.  In the case of a provider of broadcast television service, 
cable service, satellite service, streaming media service or other video programming service 
described in 47 United States Code, Section 613(h)(2), transfer to an unaffiliated 3rd party 
covered data that reveals the video content or services requested or selected by an 
individual from that service, except with the affirmative consent of the individual or 
pursuant to one of the permissible purposes listed in subsection 2; or
5. Targeted advertising.  Process sensitive data for the purposes of targeted 
advertising.
§9606. Policies, practices and procedures
1. Required policies, practices and procedures.  A covered entity and a service 
provider shall establish, implement and maintain reasonable policies, practices and 
procedures that reflect the role of the covered entity or service provider in the collection, 
processing and transferring of covered data and that:
A.  Consider applicable federal and state laws, rules or regulations related to covered 
data that the covered entity or service provider collects, processes or transfers;
B.  Identify, assess and mitigate privacy risks related to minors;
C.  Mitigate privacy risks, including substantial privacy risks, related to the products 
and services of the covered entity or the service provider, including in the design, 
development and implementation of those products and services, taking into account 
the role of the covered entity or service provider and the information available to it; 
and
D.  Implement reasonable training and safeguards within the covered entity and service 
provider to promote compliance with all privacy laws applicable to covered data the 
covered entity collects, processes or transfers or covered data the service provider 
collects, processes or transfers on behalf of the covered entity and mitigate privacy 
risks, including substantial privacy risks, taking into account the role of the covered 
entity or service provider and the information available to it.
2. Requirements.  The policies, practices and procedures established by a covered 
entity and a service provider under subsection 1, must take into account, as applicable:
A.  The size of the covered entity or service provider and the nature, scope and 
complexity of the activities engaged in by the covered entity or service provider, 
including whether the covered entity or service provider is a large data holder, 
nonprofit organization, small business, 3rd party or data broker, taking into account the 
role of the covered entity or service provider and the information available to the 
covered entity or service provider;
B.  The sensitivity of the covered data collected, processed or transferred by the 
covered entity or service provider;
C.  The volume of covered data collected, processed or transferred by the covered entity 
or service provider;
D.  The number of individuals and devices to which the covered data collected, 
processed or transferred by the covered entity or service provider relates; and
E.  The cost of implementing those policies, practices and procedures in relation to the 
risks and nature of the covered data.
§9607.  Prohibition on retaliation against an individual for exercise of rights and 
unlawful pricing
1. Retaliation prohibited.  A covered entity may not retaliate against an individual for 
exercising a right guaranteed by this chapter or by a rule adopted under this chapter or for 
refusing to agree to the collection or processing of covered data for a separate product or 
service.  For purposes of this subsection, retaliation includes denying goods or services, 
charging different prices or rates for goods or services or providing a different level of 
quality of goods or services.
2. Unlawful pricing prohibited.  A covered entity may not offer different types of 
pricing that are unjust, unreasonable, coercive or usurious in nature.
3. Interpretation.  Subsection 1 may not be construed to:
A.  Prohibit the relation of the price of a service or the level of service provided to an 
individual to the provision, by the individual, of financial information that is 
necessarily collected and processed only for the purpose of initiating, billing for or 
collecting payment for a service or product requested by the individual;
B.  Prohibit a covered entity from offering a different price, rate, level, quality or 
selection of goods or services to an individual, including offering goods or services for 
no fee, if the offering is in connection with an individual's voluntary participation in a 
bona fide loyalty, rewards, premium features, discount or club card program, as long 
as the covered entity may not transfer covered data to a 3rd party as part of a program 
unless: 
(1)  The transfer is reasonably necessary to enable the 3rd party to provide a benefit 
to which the individual is entitled;
(2)  The transfer of covered data to the 3rd party is clearly disclosed in the terms 
of the program; and
(3)  The 3rd party uses the covered data only for purposes of facilitating a benefit 
to which the individual is entitled and does not retain or otherwise use or disclose 
the covered data for any other purpose;
C.  Require a covered entity to provide a bona fide loyalty program that would require 
the covered entity to collect, process or transfer covered data that the covered entity 
otherwise would not collect, process or transfer;
D.  Prohibit a covered entity from offering a financial incentive or other consideration 
to an individual for participation in the collection, processing or transfer of covered 
data as reasonably necessary and proportionate to investigate the market for or 
marketing of products, services or ideas, when the covered data is not integrated into a 
product or service otherwise used to contact an individual or individual's device or used 
to advertise or market to an individual or individual's device;
E.  Prohibit a covered entity from offering different types of pricing or functionalities 
with respect to a product or service based on an individual's exercise of a right; or
F.  Prohibit a covered entity from declining to provide a product or service insofar as 
the collection and processing of covered data is strictly necessary for that product or 
service.
§9608.  Privacy policy
1. Privacy policy required.  A covered entity or service provider shall make publicly 
available, in a clear, conspicuous and readily accessible manner, a privacy policy that 
provides a detailed and accurate representation of the data collection, processing and 
transfer activities of the covered entity.  The policy must be provided in a manner that is 
reasonably accessible to and usable by individuals with disabilities.  The covered entity or 
service provider shall make the policy available to the public in each covered language in 
which the covered entity or service provider provides a product or service that is subject to 
the privacy policy or carries out activities related to that product or service. The policy must 
include, at a minimum, the following:
A.  The identity and the contact information of:
(1)  The covered entity or service provider to which the privacy policy applies, 
including the covered entity's or service provider's points of contact and general e-
mail addresses, as applicable, for privacy and data security inquiries; and
(2)  Another entity within the same corporate structure as the covered entity or 
service provider to which covered data is transferred by the covered entity;
B.  The categories of covered data that the covered entity or service provider collects 
or processes;
C.  The processing purposes for each category of covered data the covered entity or 
service provider collects or processes;
D.  Whether the covered entity or service provider transfers covered data and, if so, 
each category of service provider and 3rd party to which the covered entity or service 
provider transfers covered data; the name of each data broker to which the covered 
entity or service provider transfers covered data; and the purposes for which the data 
is transferred to the categories of service providers and 3rd parties except for a transfer 
to a governmental entity pursuant to a court order or law that prohibits the covered 
entity or service provider from disclosing the transfer;
E.  The length of time the covered entity or service provider intends to retain each 
category of covered data, including sensitive covered data, or, if it is not possible to 
identify the length of time, the criteria used to determine the length of time the covered 
entity or service provider intends to retain categories of covered data;
F.  A prominent description of how an individual can exercise the rights described in 
this chapter;
G.  A general description of the covered entity's or service provider's data security 
practices; and
H.  The effective date of the privacy policy.
2. Changes to privacy policies.  If a covered entity makes a material change to its 
privacy policy, the covered entity shall notify each individual affected by the material 
change before implementing the material change with respect to prospectively collected 
covered data and, except as provided in subsection 9604, subsection 2, provide a reasonable 
opportunity for each individual to withdraw consent to further materially different 
collection, processing or transfer of previously collected covered data under the changed 
policy.  The covered entity shall take all reasonable electronic measures to provide direct 
notification regarding material changes to the privacy policy to each affected individual, in 
each covered language in which the privacy policy is made available, and taking into 
account available technology and the nature of the relationship.
3. Large data holders.  A large data holder shall retain copies of previous versions of 
its privacy policy for at least 10 years beginning after the effective date of this chapter and 
publish them on the large data holder's publicly accessible website.  A large data holder 
shall make publicly available, in a clear, conspicuous and readily accessible manner, a log 
describing the date and nature of each material change to its privacy policy over the past 
years.  The descriptions must be sufficient for a reasonable individual to understand the 
effect of each material change.  The obligations in this subsection do not apply to a previous 
version of a large data holder's privacy policy or a material change to a privacy policy that 
precede the effective date of this chapter.
In addition to the privacy policy required under subsection 1, a large data holder that is a 
covered entity shall provide a short-form notice of its covered data practices in a manner 
that is:
A.  Concise, clear, conspicuous and not misleading;
B.  Readily accessible to the individual, based on what is reasonably anticipated within 
the context of the relationship between the individual and the large data holder;
C.  Inclusive of an overview of individual rights and disclosures to draw attention to 
data practices that may be unexpected to a reasonable person or that involve sensitive 
covered data; and
D.  Not more than 500 words in length.
§9609.  Affirmative consent
1. Valid consent.  An expression of consent in response to a request from a covered 
entity or service provider is not affirmative consent for purposes of this chapter unless the 
individual gives consent under the following conditions:
A.  The request is provided to the individual in a clear and conspicuous stand-alone 
disclosure made through the primary medium used to offer the covered entity's product 
or service, or, if the product or service is not offered in a medium that permits the 
making of the request under this paragraph, another medium regularly used in 
conjunction with the covered entity's product or service;
B.  The request includes a description of the processing purpose for which the 
individual's consent is sought and:
(1)  Clearly states the specific categories of covered data that the covered entity 
intends to collect, process or transfer necessary to achieve the processing purpose; 
and
(2)  Includes a prominent heading and is written in language that would enable a 
reasonable individual to identify and understand the processing purpose for which 
consent is sought and the covered data to be collected, processed or transferred by 
the covered entity for the processing purpose;
C.  The request clearly explains the individual's rights related to consent;
D.  The request is made in a manner reasonably accessible to and usable by individuals 
with disabilities;
E.  The request is made available to the individual in each covered language in which 
the covered entity provides a product or service for which authorization is sought;
F.  The option to refuse to give consent is at least as prominent as the option to give 
consent and the option to refuse to give consent takes the same number of steps or 
fewer as the option to give consent; and
G.  Affirmative consent to an act or practice is not inferred from the inaction of the 
individual or the individual's continued use of a service or product provided by the 
covered entity.
2. Prohibitions.  A covered entity or service provider may not obtain or attempt to 
obtain affirmative consent through:
A.  The use of a false, fraudulent or materially misleading statement or representation; 
or
B.  The design, modification or manipulation of a user interface with the purpose or 
substantial effect of obscuring, subverting or impairing a reasonable individual's choice 
to provide consent or covered data.
3.  Different processing purpose.  Processing or transferring of covered data collected 
pursuant to affirmative consent for a different processing purpose than that for which 
affirmative consent was obtained requires affirmative consent for the subsequent 
processing purpose.
4. Withdrawal of consent.  A covered entity shall provide an individual with a clear 
and conspicuous means to withdraw affirmative consent previously provided by the 
individual that is as easy to execute by a reasonable individual as the means to provide 
consent.
5. Opt out.  A covered entity may not transfer or direct the transfer of the covered data 
of an individual to a 3rd party unless the individual provides affirmative consent and shall 
provide an opportunity for an individual to object to a transfer through an opt-out 
mechanism.  A covered entity is not required to provide an individual an opportunity to opt 
out of the collection, processing or transfer of covered data made pursuant to section 9604, 
subsection 2.
§9610.  Targeted advertising
1. Affirmative consent required.  Before engaging in targeted advertising to an 
individual or device, a covered entity or service provider that directly delivers a targeted 
advertisement shall obtain the individual's affirmative consent for targeted advertising.  The 
covered entity or service provider shall provide an opportunity for an individual to make 
an opt-out designation with respect to targeted advertising.  The covered entity or service 
provider shall abide by an opt-out designation made by the individual with respect to 
targeted advertising.  A covered entity or service provider that receives an opt-out 
designation made by an individual shall notify any other person that directed the covered 
entity or service provider to serve, deliver or otherwise handle the advertisement of the opt-
out designation.
2. Prohibitions.  A covered entity may not engage in targeted advertising to an 
individual if the covered entity:
A.  Is a covered high-impact social media company and knew or should have known 
the individual was a minor at the time of the advertising; 
B.  Is a large data holder and not a covered high-impact social media company and 
knew or acted in willful disregard of the fact that the individual was a minor at the time 
of the advertising; or
C.  Has knowledge that the individual was a minor at the time of the advertising.
§9611.  Individual rights regarding covered data
1. Access.  Except as provided by this section, after receiving a request from an 
individual, a covered entity shall:
A.  Provide that individual with access to:
(1)  The individual's covered data, except covered data in a backup or archival 
system, that is collected, processed or transferred by the covered entity or a service 
provider of the covered entity within the 24 months preceding the request, in a 
format that a reasonable individual can understand and download from the Internet; 
and
(2)  If applicable:
(a)  The categories of 3rd parties to which the covered entity has transferred 
for consideration the covered data of the individual; 
(b)  An option for consumers to obtain the names of 3rd parties or service 
providers to which the covered entity has transferred for consideration the 
covered data of the individual;
(c)  The categories of sources from which the covered data was collected; and 
(d)  A description of the purpose for which the covered entity transferred the 
covered data of the individual to a 3rd party or service provider;
B.  Correct a verifiable substantial inaccuracy or substantially incomplete information 
with respect to the covered data of the individual that is processed by the covered entity 
and make reasonable efforts to notify all 3rd parties or service providers to which the 
covered entity transferred the covered data of the corrected information.  A small 
business may delete the relevant information instead of making a correction;
C.  Delete covered data of the individual that is processed by the covered entity and 
make reasonable efforts to notify all 3rd parties or service providers to which the 
covered entity transferred the covered data of the individual's deletion request; and
D.  To the extent technically feasible, export to the individual or directly to another 
entity the covered data of the individual that is processed by the covered entity, 
including inferences linked or reasonably linkable to the individual but not including 
derived data:
(1)  Without licensing restrictions that limit transfers;
(2)  In a format that a reasonable individual can understand and download from the 
Internet; and
(3)  In a portable, structured, interoperable and machine-readable format.
A small business is not required to comply with subparagraph (2) or (3). 
2. Conditions.  A covered entity may not condition, effectively condition, attempt to 
condition or attempt to effectively condition an action required in subsection 1 through:
A.  The use of a false, fraudulent or materially misleading statement or representation; 
or
B.  The design, modification or manipulation of a user interface with the purpose or 
substantial effect of obscuring, subverting or impairing a reasonable individual's 
choice.
3. Response periods.  A covered entity or service provider shall comply with a request 
to perform an action under subsection 1 within the following response periods:
A.  For a large data holder, no later than the 45th day after the date of the request by an 
individual, unless it is demonstrably impracticable or impracticably costly to verify the 
identity of the individual; or
B.  For a covered entity that is not a large data holder, no later than the 60th day after 
the date of the request by an individual, unless it is demonstrably impracticable or 
impracticably costly to verify the identity of the individual.
A response period described in this subsection may be extended once by 45 additional days 
when reasonably necessary, considering the complexity and number of the individual's 
requests, as long as the covered entity informs the individual of the extension within the 
initial 45-day or 60-day response period, together with the reason for the extension.
4. Multiple requests from one individual.  A covered entity shall perform the actions 
described in subsection 1 free of charge with respect to the first 2 times that an individual 
makes a request in a 12-month period.  Beyond the first 2 requests in a 12-month period, 
the covered entity or service provider may charge a reasonable fee for each request.
5. Verification.  If a covered entity cannot reasonably verify that a request to take an 
action under subsection 1 is made by the individual whose covered data is the subject of 
the request, or an individual authorized to make a request on the individual's behalf, the 
covered entity:
A.  May request that the individual making the request provide additional information 
necessary for the sole purpose of verifying the identity of the individual; and
B.  May not process or transfer additional information provided under paragraph A for 
any other purpose.
6. Exceptions.  A covered entity is not required to take an action described by 
subsection 1 if:
A.  The covered entity cannot reasonably verify that the individual making the request 
is the individual whose covered data is the subject of the request or an individual 
authorized to make a request on the individual's behalf;
B.  The covered entity reasonably believes that:
(1)  The request is made to interfere with a contract between the covered entity and 
another individual;
(2)  The action would require the covered entity to engage in an unfair or deceptive 
practice under 15 United States Code, Section 45 or state law; or
(3)  The request is made to further fraud or support criminal activity or the action 
presents a data security threat;
C.  The covered entity determines that the action would require access to or correction 
of another individual's sensitive data; or
D.  The action:
(1)  Requires the covered entity to retain covered data collected for a single, one-
time transaction, if that covered data is not processed or transferred by the covered 
entity for any purpose other than completing the transaction;
(2)  Is demonstrably impracticable or prohibitively costly to take, in which case the 
covered entity shall provide a description to the requestor detailing the inability to 
comply with the request.  The receipt of a large number of verified requests, on its 
own, may not be considered to render compliance with a request demonstrably 
impracticable;
(3)  Requires the covered entity to attempt to re-identify de-identified data;
(4)  Requires the covered entity to maintain covered data in an identifiable form or 
collect, retain or access data in order to be capable of associating a request with the 
covered data of the individual who made the request;
(5)  Would result in the release of privileged or confidential business information;
(6)  Requires the covered entity to correct covered data that cannot be reasonably 
verified as being inaccurate or incomplete;
(7) Violates federal or state law or the rights of another individual, including the 
rights under the United States Constitution;
(8)  Prevents a covered entity from being able to maintain a confidential record of 
deletion requests, maintained solely for the purpose of preventing covered data of 
an individual from being recollected after the individual submitted a deletion 
request and requested that the covered entity no longer collect, process or transfer 
the data; or
(9)  With respect to a request for deletion:
(a)  Would unreasonably interfere with the provision of products or services 
by the covered entity to another person it currently serves;
(b)  Would require the deletion of covered data that relates to a public figure, 
public official or limited-purpose public feature and for which the requesting 
individual has no reasonable expectation of privacy with respect to that 
covered data;
(c)  Would require the deletion of covered data reasonably necessary to 
perform a contract between the covered entity and the individual;
(d)  Would require the deletion of covered data that the covered entity needs 
to retain in order to comply with professional ethical obligations;
(e)  Would require the deletion of covered data that the covered entity 
reasonably believes may be evidence of unlawful activity or an abuse of the 
covered entity's products or services; or
(f)  For private elementary and secondary schools and private institutions of 
higher education as defined by Title I of the federal Higher Education Act of 
1965, would require the deletion of covered data that would unreasonably 
interfere with the provision of education services by or the ordinary operation 
of the school or institution.
With respect to a request that is subject to an exception described by this subsection, a 
covered entity shall partially comply with the remainder of the request if it is possible and 
not unduly burdensome to do so.
7. Languages.  A covered entity shall provide an opportunity to make a request under 
this section in a covered language in which the covered entity provides a product or service.  
The mechanisms by which a covered entity enables individuals to make requests under this 
section must be readily accessible and usable by individuals with disabilities.
8. Transfer of certain covered data.  A covered entity may not transfer or direct the 
transfer of the covered data of a minor to a 3rd party if the covered entity has knowledge 
that the individual is a minor and has not obtained affirmative consent from the minor or 
the minor's parent or guardian.  A covered entity or service provider may collect, process 
or transfer covered data of an individual the covered entity or service provider knows is a 
minor in order to submit information relating to child victimization to law enforcement 
agencies or to the nonprofit, national resource center and clearinghouse designated by the 
United States Congress to assist victims, families, child-serving professionals and the 
general public on issues pertaining to missing and exploited children.
§9612.  Requirements for large data holders
1. Reporting required.  For each calendar year in which it was a large data holder, a 
covered entity shall:
A.  Compile the following metrics for the prior calendar year:
(1)  The number of verified requests to access information;
(2)  The number of verified requests to delete information;
(3)  The number of requests to opt out of covered data transfers;
(4)  The number of requests to opt out of targeted advertising;
(5)  The number of requests under subparagraphs (1) to (4) that the large data 
holder complied with in whole or in part or denied; and
(6)  The median and mean number of days within which the large data holder 
substantively responded to the requests under subparagraphs (1) to (4); and
B.  Disclose by July 1st of each applicable calendar year the information compiled in 
paragraph A within the large data holder's privacy policy or on the publicly accessible 
website of the large data holder that is accessible from a hyperlink included in the 
privacy policy.
2. Certification.  An executive officer of a large data holder shall certify annually, in 
good faith, to the Attorney General that the entity maintains:
A.  Internal controls reasonably designed to comply with this chapter; and
B.  Internal reporting structures to ensure that the certifying executive officer is 
involved in and responsible for the decisions that impact the compliance by the large 
data holder with this chapter.
A certification submitted under this subsection must be based on a review of the 
effectiveness of the internal controls and reporting structures of the large data holder that 
is conducted by the certifying executive officer not earlier than the 90th day before the date 
of the submission of the certification.  A certification is made in good faith if the certifying 
executive officer, after a reasonable investigation, had reasonable grounds to believe and 
did believe, at the time that certification was submitted, that the statements in the 
certification were true and that there was no omission of a material fact or a fact necessary 
to make the statements in the certification not misleading.
§9613.  Data brokers
1. Notice required.  A data broker shall place a clear, conspicuous, not misleading and 
readily accessible notice on the publicly accessible website or mobile application of the 
data broker that notifies individuals that the entity is a data broker and includes a link to a 
website through which an individual may easily exercise the rights provided under this 
chapter.
2. Registration required.  No later than January 31st of each calendar year that follows 
a calendar year during which a covered entity acted as a data broker and processed covered 
data pertaining to more than 5,000 individuals or devices that identify or are linked or 
reasonably linkable to an individual, the covered entity shall register with the Attorney 
General in accordance with this subsection. In registering with the Attorney General, a data 
broker shall:
A.  Pay to the Attorney General a registration fee of $100; and
B.  Provide the Attorney General with the following information:
(1)  The legal name and primary physical mailing address, e-mail address and 
publicly accessible website address of the data broker;
(2)  A description of the categories of covered data the data broker processes and 
transfers;
(3)  The contact information of the data broker, including a contact person, a 
telephone number, an e-mail address, a publicly accessible website address and a 
physical mailing address.
The Attorney General shall establish and maintain on a publicly accessible website a 
searchable central registry of data brokers that are registered with the Attorney General.
A data broker that fails to register or provide the notice as required under this subsection is 
liable for a civil penalty of $100 for each day the data broker fails to register or provide 
notice as required under this subsection, not to exceed a total of $10,000 per year, and an 
amount equal to the registration fees due under this section for each year that the data broker 
failed to register as required pursuant to this section.
§9614.  Discrimination prohibited
1. Discrimination prohibited.  A covered entity or a service provider may not collect, 
process or transfer covered data in a manner that discriminates against individuals, or 
otherwise makes unavailable the equal enjoyment of goods or services, on the basis of race, 
color, religion, national origin, sex or disability.
2. Exceptions.  This section does not apply to:
A.  The collection, processing or transfer of covered data for the purpose of:
(1)  A covered entity's or a service provider's self-testing to prevent or mitigate 
unlawful discrimination; or
(2)  Diversifying an applicant, participant or customer pool; or
B.  A private establishment, as described in 42 United States Code, Section 2000a(e).
§9615.  Algorithms
1. Assessment required.  A covered entity that is not a small business and that uses a 
covered algorithm in a manner that poses a consequential risk of harm to an individual or 
group of individuals and uses the covered algorithm solely or in part to collect, process or 
transfer covered data or publicly available data annually shall conduct an impact 
assessment of the algorithm. The impact assessment must include the following 
information:
A.  A detailed description of the design process and methodologies of the covered 
algorithm;
B.  A statement of the purpose and reasonably foreseeable uses of the covered 
algorithm;
C.  The types of data used by the covered algorithm, including the specific categories 
and sources of data that will be processed as input and data used to train the model that 
the covered algorithm relies on, if applicable;
D.  A description of the outputs produced by the covered algorithm;
E.  An assessment of the necessity and proportionality of the covered algorithm in 
relation to its stated purpose;
F.  A detailed description of steps the covered entity has taken or will take to mitigate 
potential harm from the covered algorithm to an individual or group of individuals, 
including steps related to:
(1)  Minors;
(2)  Making or facilitating advertising for, determining access to or restrictions on 
the use of housing, education, employment, healthcare, insurance or credit 
opportunities;
(3)  Determining access to or restrictions on the use of a place of public 
accommodation, particularly as the harm relates to the protected characteristics of 
individuals, including race, color, religion, national origin, sex or disability;
(4)  Disparate impact on the basis of individuals' race, color, religion, national 
origin, sex or disability status; or
(5)  Disparate impact on the basis of individuals' political party registration status; 
and
G.  Any other information as required by the Attorney General.
2. Design evaluation.  A covered entity or service provider that develops a covered 
algorithm that is designed to collect, process or transfer covered data shall perform, before 
deploying the covered algorithm, an algorithmic design evaluation to evaluate the design, 
structure and inputs of the covered algorithm, including training data used to develop the 
covered algorithm, to reduce the risk of the potential harms identified under this section.
3. Focus.  In complying with this section, a covered entity and a service provider may 
focus the impact assessment or evaluation on a covered algorithm, or portions of a covered 
algorithm, that will be put to use and may reasonably contribute to the risk of the potential 
harms identified under this section.
4. Report.  No later than 30 days after completing an impact assessment or evaluation 
under this section, a covered entity or a service provider shall submit a report of the impact 
assessment or evaluation to the Attorney General.  The report must include a summary of 
the impact assessment or evaluation and the covered entity or service provider shall make 
the summary publicly available in a place that is easily accessible to consumers. Covered 
entities and service providers may redact a trade secret, as defined in 18 United States Code, 
Section 1839(3), or other confidential or proprietary information, from the report.
§9616.  Data security
1. Practices and procedures.  A covered entity or service provider shall establish, 
implement and maintain reasonable administrative, technical and physical data security 
practices and procedures to protect covered data against unauthorized access.  The practices 
must be appropriate to:
A.  The size and complexity of the covered entity or service provider;
B.  The nature and scope of the covered entity or the service provider's collecting, 
processing or transferring of covered data;
C.  The volume and nature of the covered data collected, processed or transferred by 
the covered entity or service provider;
D.  The sensitivity of the covered data collected, processed or transferred;
E.  The current state-of-the-art administrative, technical and physical safeguards for 
protecting covered data; and
F.  The cost of available tools to improve security and reduce vulnerabilities to 
unauthorized access of covered data in relation to the risks and nature of the covered 
data.
2. Requirements.  The data security practices of the covered entity and of the service 
provider required under this subsection must include, for the respective entity's own 
system, at a minimum, the following practices:
A.  Identifying and assessing internal and external risk to the security of each system 
maintained by the covered entity that collects, processes or transfers covered data, or 
service provider that collects, processes or transfers covered data on behalf of the 
covered entity;
B.  With respect to large data holders, a plan to receive and reasonably respond to 
unsolicited reports of vulnerabilities by an entity or individual by performing a 
reasonable investigation of those reports;
C.  Taking preventive and corrective action designed to mitigate reasonably foreseeable 
risks or vulnerabilities to covered data identified by the covered entity or service 
provider, consistent with the nature of the risk or vulnerability and the entity's role in 
collecting, processing or transferring the data.  Corrective action may include 
implementing administrative, technical or physical safeguards or changes to data 
security practices or the architecture, installation or implementation of network or 
operating software;
D.  Disposing of covered data in accordance with a retention schedule that requires the 
deletion of covered data when the data is required to be deleted by law or is no longer 
necessary for the purpose for which the data was collected, processed or transferred, 
unless an individual has provided affirmative consent to that retention.  Disposal may 
include destroying, permanently erasing or otherwise modifying the covered data to 
make the data permanently unreadable or indecipherable and unrecoverable to ensure 
ongoing compliance with this section.  A service provider shall establish practices to 
delete or return covered data to a covered entity as requested at the end of the provision 
of services unless retention of the covered data is required by law;
E.  Training each employee with access to covered data on how to safeguard covered 
data and updating the training as necessary;
F.  Designating an officer or employee to maintain and implement the practices 
described in this subsection; and
G.  Implementing procedures to detect, respond to or recover from security incidents, 
including breaches.
A small business is not required to comply with paragraph E, F or G.
§9617.  Officers
1. Privacy and data security officers required.  A covered entity or service provider 
that is not a small business shall designate at least one qualified employee as a privacy 
officer and at least one qualified employee as a data security officer.
2. Privacy officer and data security officer duties.  An employee who is designated 
by a covered entity or a service provider as a privacy officer or a data security officer shall, 
at a minimum:
A.  Implement a data privacy program and data security program to safeguard the 
privacy and security of covered data in compliance with the requirements of this 
chapter; and
B.  Facilitate the covered entity or service provider's ongoing compliance with this 
chapter.
3. Large data holders.  A large data holder shall designate at least one of the officers 
described in subsection 1 to report directly to the highest official at the large data holder as 
a privacy protection officer who, in addition to the requirements in subsection 2, either 
directly or through a supervised designee, shall:
A.  Establish processes to periodically review and update the privacy and security 
policies, practices and procedures of the large data holder, as necessary;
B.  Conduct biennial and comprehensive audits to ensure that the policies, practices 
and procedures of the large data holder ensure the large data holder is in compliance 
with this chapter and ensure the audits are accessible to the Attorney General upon 
request;
C.  Develop a program to educate and train employees about compliance requirements 
of this chapter;
D.  Maintain updated, accurate, clear and understandable records of all material privacy 
and data security practices undertaken by the large data holder; and
E.  Serve as the point of contact between the large data holder and enforcement 
authorities.
4. Privacy impact assessment.  A covered entity that is not a small business shall 
conduct a privacy impact assessment every other year.  The assessment must weigh the 
benefits of the covered entity's covered data collecting, processing and transfer practices 
that may cause a substantial privacy risk against the potential material adverse 
consequences of the practices to individual privacy.  The covered entity shall make a 
summary of the privacy impact assessment publicly available in a place that is easily 
accessible and available to the Attorney General on request.  The privacy impact 
assessment must:
A.  Be reasonable and appropriate in scope given:
(1)  The nature of the covered data collected, processed and transferred by the 
covered entity;
(2)  The volume of the covered data collected, processed and transferred by the 
covered entity; and
(3)  The potential risks posed to the privacy of individuals by the collecting, 
processing and transfer of covered data by the covered entity; 
B.  Be in written form and maintained by the covered entity unless rendered out of date 
by a subsequent assessment;
C.  Include additional information required by the Attorney General; and
D.  If the covered entity is a large data holder, be approved by the privacy protection 
officer.
§9618.  Service providers
1. Contract.  A service provider shall follow the instructions of a covered entity and 
may only collect, process and transfer service provider data to the extent necessary and 
proportionate to provide a service requested by the covered entity, as set out in the contract 
between the covered entity and the service provider.  A service provider is not required to 
collect, process or transfer covered data if the service provider would not otherwise do so.  
A person may only act as a service provider pursuant to a written contract between the 
covered entity and the service provider, or a written contract between one service provider 
and a second service provider if the contract:
A.  Clearly sets forth:
(1)  The data processing procedures of the service provider with respect to 
collection, processing or transfer performed on behalf of the covered entity or 
service provider;
(2)  Instructions for collecting, processing or transferring data;
(3)  The nature and purpose of collecting, processing or transferring data;
(4)  The type of data subject to collecting, processing or transferring;
(5)  The duration of processing; and
(6)  The rights and obligations of both parties, including a method by which the 
service provider shall notify the covered entity of material changes to its privacy 
practices;
B.  Does not relieve a covered entity or a service provider of a requirement or liability 
imposed on a covered entity or service provider under this chapter; and
C.  Prohibits:
(1)  Collecting, processing or transferring covered data in contravention to the 
requirements set forth under paragraph A; and
(2)  Combining service provider data with covered data which the service provider 
receives from or on behalf of another person or collects from the interaction of the 
service provider with an individual, provided that the combining is not necessary 
to achieve a purpose described in subsection 9604, subsection 2 and is otherwise 
permitted under a required contract.
A service provider shall retain copies of previous contracts entered into in compliance with 
this subsection with each covered entity to which it provides requested products or services.
2. Prohibition on certain actions.  A service provider may not collect, process or 
transfer service provider data if the service provider has actual knowledge that a covered 
entity violated this chapter with respect to that data.
3. Assisting covered entity. A service provider shall assist a covered entity in 
responding to a request made by an individual regarding service provider data, by either:
A.  Providing appropriate technical and organizational measures, taking into account 
the nature of the processing and the information reasonably available to the service 
provider, for the covered entity to comply with the request for service provider data; or
B.  Fulfilling a request by a covered entity by either complying with the request 
pursuant to the covered entity's instructions or providing written verification to the 
covered entity that:
(1)  The service provider does not hold covered data related to the request; 
(2)  Complying with the request would be inconsistent with its legal obligations; 
or
(3)  The request falls within an exception to section 9611.
4. Engagement of other service providers.  A service provider may engage another 
service provider for purposes of processing service provider data on behalf of a covered 
entity only after providing that covered entity with notice and pursuant to a written contract 
that requires the other service provider to satisfy the obligations of the original service 
provider with respect to the service provider data, including that the other service provider 
be treated as a service provider under this chapter.
5. Compliance information.  In response to a reasonable request by a covered entity, 
a service provider shall make available to the covered entity information necessary to 
demonstrate the compliance of the service provider with the requirements of this chapter, 
including a report of an independent assessment arranged by the service provider on terms 
agreed to by the service provider and the covered entity, provide information necessary to 
enable the covered entity to conduct and document a privacy impact assessment required 
under this chapter and make available the algorithmic design evaluation required under 
section 9615.
6. Deletion or return of covered data.  At the covered entity's direction, a service 
provider shall delete or return all covered data to the covered entity at the end of the 
provision of services, unless retention of the covered data is required by law.
7. Safeguards.  A service provider shall develop, implement and maintain reasonable 
administrative, technical and physical safeguards that are designed to protect the security 
and confidentiality of covered data the service provider processes consistent with section 
9616.
8. Assessments.  A service provider shall allow and cooperate with reasonable 
assessments by the covered entity or the covered entity's designated assessor.  The service 
provider may arrange for a qualified and independent assessor to conduct an assessment of 
the service provider's policies and technical and organizational measures in support of the 
obligations under this chapter using an appropriate and accepted control standard or 
framework and assessment procedure for the assessments.  The service provider shall 
provide a report of the assessment to the covered entity on request.
9. Service provider relationship determination.  Determining whether a person is 
acting as a covered entity or service provider with respect to a specific processing of 
covered data is a fact-based determination that depends upon the context in which that data 
is processed.  A person that is not limited in the person's processing of covered data 
pursuant to the instructions of a covered entity, or that fails to adhere to those instructions, 
is a covered entity and not a service provider with respect to a specific processing of 
covered data.  A service provider that continues to adhere to the instructions of a covered 
entity with respect to a specific processing of covered data remains a service provider.  If 
a service provider begins, alone or jointly with others, determining the purposes and means 
of the processing of covered data, it is a covered entity and not a service provider with 
respect to the processing of that data.
10. Liability.  A covered entity that transfers covered data to a service provider or a 
service provider that transfers covered data to a covered entity or another service provider, 
in compliance with the requirements of this chapter, is not liable for a violation of this 
chapter by the service provider or covered entity to which the covered data was transferred, 
if at the time of transferring the covered data, the covered entity or service provider did not 
have knowledge that the service provider or covered entity would violate this chapter.  A 
covered entity or service provider that receives covered data in compliance with the 
requirements of this chapter is not in violation of this Act as a result of a violation by a 
covered entity or service provider from which that data was received.
11. Due diligence required.  A covered entity or service provider shall exercise 
reasonable due diligence in selecting a service provider.
12. Service provided to government entities.  Solely for the purposes of this section, 
the requirements for service providers to contract with, assist and follow the instructions of 
covered entities must include requirements to contract with, assist and follow the 
instructions of a government entity if the service provider is providing a service to a 
government entity.
§9619.  Third parties
1. Processing.  A 3rd party may not process 3rd-party data for a processing purpose 
other than, in the case of sensitive data and covered data, the processing purpose for which 
the individual gave affirmative consent or to effect a purpose enumerated in section 9604, 
subsection 2, paragraph A, C or E and, in the case of nonsensitive data, the processing 
purpose for which the covered entity made a disclosure pursuant to section 9608, subsection 
1, paragraph D.  A 3rd party may reasonably rely on representations made by the covered 
entity that transferred the 3rd-party data if the 3rd party conducts reasonable due diligence 
on the representations of the covered entity and finds those representations to be credible.
2. Contract required.  A covered entity that transfers covered data to a 3rd party shall 
enter into a written contract with the 3rd party that:
A.  Identifies the specific purposes for which the covered data is being made available 
to the 3rd party;
B.  Specifies that the covered entity is transferring the covered data to the 3rd party 
solely for the specific purposes set forth in the contract and that the 3rd party may only 
use the covered data for those specific purposes; and
C.  Requires the 3rd party to comply with all applicable provisions of and rules adopted 
under this chapter with respect to the covered data that the covered entity transfers to 
the 3rd party and to provide the same level of privacy and security protection for the 
covered data as required by covered entities under this chapter.
3. Due diligence required.  A covered entity or service provider shall exercise 
reasonable due diligence in deciding to transfer covered data to a 3rd party.
§9620.  Enforcement
1. By government official.  The Attorney General, a district attorney or a counsel for 
a municipality may bring a civil action in the name of the State or on behalf of the residents 
of the State against a covered entity or service provider that violates this chapter to:
A. Enjoin the act or practice that is in violation of this chapter;
B. Enforce compliance with this chapter or a rule adopted under this chapter;
C. Obtain damages, civil penalties, restitution or other compensation on behalf of the 
residents of the State; or
D. Obtain reasonable attorney's fees and other litigation costs reasonably incurred.
2. By individual.  A violation of this chapter or a rule adopted under this chapter with 
respect to the covered data of an individual constitutes an injury to that individual.  The 
injured individual may bring a civil action against the party that commits the violation, 
except that an individual may not bring a civil action against a small business. In a civil 
action brought under this subsection in which a plaintiff prevails, the court may award the 
plaintiff:
A.  Damages in an amount not less than $5,000 per individual per violation, as adjusted 
annually to reflect an increase in the Consumer Price Index, or actual damages, 
whichever is greater;
B.  Punitive damages;
C.  Injunctive relief;
D.  Declaratory relief; and
E.  Reasonable attorney's fees and litigation costs.
3. Arbitration agreement or waiver.  Notwithstanding any provision of law to the 
contrary, no predispute arbitration agreement or predispute joint-action waiver is valid or 
enforceable with respect to a dispute arising under this chapter.  A determination as to 
whether this subsection applies to a dispute must be made by a court, rather than an 
arbitrator, without regard to whether an applicable agreement purports to delegate that 
determination to an arbitrator.  For purposes of this subsection, "predispute arbitration 
agreement" means an agreement to arbitrate a dispute that has not arisen at the time of the 
making of the agreement and "predispute joint-action waiver" means an agreement that 
would prohibit a party from participating in a joint, class or collective action in a judicial, 
arbitral, administrative or other forum, concerning a dispute that has not yet arisen at the 
time of the making of the agreement.
Sec. 2.  Deadlines for certain actions. The first algorithm assessment or design 
evaluation required by the Maine Revised Statutes, Title 10, section 9615 is required to be 
completed not later than the 2nd anniversary of the effective date of this Act.  The first 
certification required by Title 10, section 9612, subsection 2 and the first privacy impact 
assessment required by Title 10, section 9617, subsection 4 are required to be completed 
not later than the first anniversary of the effective date of this Act.
Sec. 3.  Effective date.  This Act takes effect 180 days after the adjournment of the  
SUMMARY
This bill enacts the Data Privacy and Protection Act, which:
1. Governs the collection, processing and transfer of certain personal data, including 
imposing requirements for consent to use the data, the use of personal data in targeted 
advertising and the use of the personal data of minors;
2. Requires policies, practices and procedures for data privacy; and
3. Prohibits retaliation for the exercise of a right relating to personal data and prohibits 
discriminatory practices in the collection, processing or transfer of personal data.