An Act to Enact the
Maine Legislature, Session 132, LD 1822
Committee Amendment CA_A_H716 (House)

COMMITTEE AMENDMENT "N' to H.P. 1220, L.D. 1822, "An Act to Enact the 
Maine Online Data Privacy Act" 
Amend the bill in section 1 in c. 1057 in §9601 in the first indented paragraph in the 
first line (page 1, line 6 in L.D.) by striking out the following: "Data Privacy and Protection" 
and inserting the following: 'Online Data Privacy' 
Amend the bill in section 1 inc. 1057 in §9602 in subsection 7 in paragraph A in the 
2nd line (page 2, line 2 in L.D.) by inserting after the following: "the" the following: 
'collection or' 
Amend the bill in section 1 in c. 1057 in §9602 in subsection 7 in paragraph B in 
subparagraph (1) in the 2nd line (page 2, line 7 in L.D.) by inserting after the following: 
"data" the following: 'collection or' 
Amend the bill in section 1 inc, 1057 in §9602 in subsection 11 in the last line (page 
2, line 30 in L.D.) by insetting after the following: "of' the following: 'collecting or' 
Amend the bill in section 1 in c. 1057 in §9602 by striking out all of subsection 14 
(page 2, lines 36 to 41 and page 3, lines 1 to 4 in L.D.) and insetting the following: 
'14, De-identified data, "De-identified data" means data that does not identify, cannot 
reasonably be used to infer information about and cannot otherwise be linked to an 
identified or identifiable consumer. or a device that may be linked to an identified or 
identifiable consumer. if the controller that possesses the data: 
A. Takes reasonable measures to ensure that the de-identified data cannot be linked 
with a consumer: 
B. Commits in a publicly available te1ms and conditions document or in a publicly 
available privacy policy to maintain and use the data in its de-identified format: and 
C, Contractually obligates recipients of the data to satisfy the criteria and commitments 
in paragraphs A and B.' 
COMMITTEE AMENDMENT 
~os., 
COMMITTEE AMENDMENT" fJ( to H.P. 1220, L.D. 1822 
Amend the bill in section 1 in c. 1057 in §9602 in subsection 26 in paragraph A in the 
2nd line (page 4, line 10 in L.D.) by striking out the following: "specific location of a 
Consumer" and insetting the following: 'past or present specific location of a consumer' 
Amend the bill in section 1 in c. 1057 in §9602 in subsection 27 in the last line (page 
4, line 18 in L.D.) by inserting after the following: "data'' the following: 'but not including 
the collection of personal data' 
Amend the bill in section 1 inc. 1057 in §9602 by striking out all of subsection 31 
(page 4, lines 27 to 39 and page 5, lines 1 to 7 in L.D.) and inserting the following: 
'31. Publicly available information. "Publicly available information": 
A. Means info1mation about a consumer that a person: 
(1) Lawfully obtains from a record of a governmental entity; or 
(2) Reasonably believes has been lawfully made available to the general public by 
the consumer or by widely distributed media; and 
B. Does not include: 
(1) Any obscene visual depiction as described in 18 United States Code, Section 
1460; 
(2) Biometric data: 
(3) Genetic data, unless the genetic data has been made available to the general 
public by the consumer; 
(4) Any information that is collated or combined to create a consumer profile that 
is made available to a user of a publicly available Internet website or mobile 
application either for remuneration or free of charge: 
(5) Any infmmation that is made available for sale: 
(6) Inferences derived from information described in subparagraph ( 4) or (5) or 
inferences derived from a combination of publicly available infotmation and other 
personal data: or 
(7) Intimate images a controller or processor knows have been created or shared 
without consent of the consumer depicted in the images. For purposes of this 
subparagraph, "intimate image" means a photograph, videotape, film or digital 
recording of a consumer in a state of nudity or engaged in a sexual act or engaged 
in sexual contact for which there is no public or newswo1thy purpose.' 
Amend the bill in section 1 in c. 1057 in §9602 in subsection 33 in paragraph B in 
subparagraph (4) in the last line (page 5, line 22 in L.D:) by insetting after the following: 
11Pfil1Y_:.
the following: 'or' 
Amend the bill in section 1 in c. 1057 in §9602 in subsection 33 in paragraph B in 
subparagraph (5) in division (b) in the first line (page 5, line 25 in L.D.) by striking out the 
following: "audience; or" and inserting the following: 'audience.' 
Amend the bill in section 1 in c. 1057 in §9602 in subsection 33 in paragraph B by 
striking out all of subparagraph (6) (page 5, lines 26 to 28 in L.D.). 
COMMITTEE AMENDMENT 
1(...0S, 
COMMITTEE AMENDMENT 'A" to H.P. 1220, L.D. 1822 
Amend the bill in section 1 inc. 1057 in §9602 in subsection 34 by striking out all of 
paragraph F (page 5, lines 38 and 39 in L.D.) and inserting the following: 
1F. Account numbers. credit card numbers or debit card numbers, if circumstances exist 
wherein such numbers can be used without additional identifying information, access 
codes or passwords;1 
Amend the bill in section 1 in c. 1057 in §9602 in subsection 37 in paragraph B in 
subparagraph (4) in the first line (page 6, line 21 in L.D.) by striking out the following: 
11Processing
and inserting the following: 1Collecting or processing1 
Amend the bill in section 1 inc. 1057 in §9603 in subsection 1 in the first line (page 6, 
line 28 in L.D.) by striking out the following: 
11July
and inserting the following: 
1September1 
Amend the bill in section 1 in c. 1057 in §9604 in subsection 2 in paragraph O in the 
first line (page 8, line 26 in L.D.) by inserting after the following: "Data" the following: 
'collected,' 
Amend the bill in section 1 in c. 1057 in §9604 in subsection 2 in paragraph O in 
subparagraph (3) in the last line (page 8, line 34 in L.D.) by striking out the following: 
11or
Amend the bill in section 1 inc. 1057 in §9604 in subsection 2 in paragraph P in the 
last line (page 8, line 39 in L.D.) by striking out the following: 
1141713. 
and inserting the 
following: '41713; or
Amend the bill in section 1 in c. 1057 in §9604 in subsection 2 by inse1ting after 
paragraph P the following: 
'O. Personal data collected and used pursuant to the federal Controlled Substances Act, 
United States Code, Section 830.1 
Amend the bill in section 1 inc. 1057 in §9606 by striking out all of subsection 1 (page 
9, lines 19 to 39 in L.D.) and inse1ting the following: 
11. Consumer rights. A consumer has the right to: 
A. Confitm whether a controller is collecting or processing the consumer1s personal 
data: 
B. 
If a controller collects or processes a consumer's personal data. access the 
consumer
1s personal data; 
C. Conect inaccuracies in the consumer1s personal data, taking into account the nature 
of the personal data and the purposes of the processing of the consumer1s personal data; 
D. Require a controller to delete personal data provided by, or obtained about, the 
consumer unless retention of the personal data is required by law: 
E. When processing of personal data is done by automatic means, obtain a copy of the 
consumer's personal data collected and processed by the controller in a po1iable and, 
to the extent technically feasible, readily usable fo11nat that allows the consumer to 
transmit the data to another controller easily and without hindrance: 
F. Obtain a list of the 3rd parties to which the controller has sold the consumer's 
personal data or, if the controller does not maintain information about the 3rd patties 
COMMITTEE AMENDMENT 
~(J"b, 
COMMIITEEAMENDMENT'A"toH.P.1220,L.D.1822 
to which the controller has sold the personal data of the specific consumer, obtain a list 
of the 3rd parties to which the controller has sold any consumer's personal data: and 
G, Opt out of the collection and processing of the consumer's personal data for 
purposes of: 
(1) Targeted adve1tising: 
(2) The sale of personal data: or 
(3) Profiling in fmtherance of any automated decision that produces any legal or 
similarly significant effect concerning the consumer.' 
Amend the bill in section 1 inc. 1057 in §9606 by striking out all of subsection 3 (page 
10, lines 3 to 8 in L.D.) and inserting the following: 
'3. Exercise of consumer rights. This subsection governs the exercise of the 
consumer rights established in subsection 1. 
A. A controller shall establish a secure and reliable method pursuant to section 9608. 
subsection 6 for a consumer to exercise a consumer right under this section. 
B. A consumer may exercise a consumer right under this section, including through 
another individual who has authority under subsection 4 to exercise the consumer's 
rights. using the method established by the controller under paragraph A.' 
Amend the bill in section 1 in c. 1057 in §9606 in subsection 4 in paragraph A in the 
2nd line (page 10, line 12 in L.D.) by insetting after the following: "the" the following: 
'collection and' 
Amend the bill in section 1 inc. 1057 by striking out all of §9607 (page 11, lines 34 to 
and page 12, lines 1 to 6 in L.D.) and insetting the following: 
'§9607. Authorized agent 
1. Authority to designate agent to opt out of collection and processing. A consumer 
may designate another person to serve as the consumer's authorized agent. and act on the 
consumer's behalf. to exercise the consumer's right under section 9606, subsection 1, 
paragraph G to opt out of the collection and processing of personal data. 
2. Method of designating agent. The consumer may designate an authorized agent 
by way of. among other methods, a technology, including. but not lin1ited to, an Internet 
link or a browser setting, browser extension or global device setting. indicating the 
consumer's intent to exercise the consumer's right under section 9606, subsection 1, 
paragraph G to opt out of the collection and processing of personal data. 
3. Authentication of agent's opt-out request. A controller shall comply with a 
request received from an authorized agent to exercise the consumer's right under section 
9606, subsection 1, paragraph G to opt out of the collection and processing of personal data 
if. using commercially reasonable effotts, the controller is able to authenticate: 
A. The identity of the consumer: and 
B. The authorized agent's authority to act on the consumer's behalf.' 
Amend the bill in section 1 in c. 1057 in §9608 in subsection 1 in paragraph C in the 
first line (page 12, line 13 in L.D.) by striking out the following: "Process" and insetting 
the following: 'Collect or process' 
COMMITTEE AMENDMENT 
~os 
COMMITTEE AMENDMENT" A" to H.P. 1220, L.D. 1822 
Amend the bill in section 1 in c. 1057 in §9608 in subsection 1 in paragraph D in 
subparagraph (1) in the first line (page 12, line 16 in L.D.) by striking out the following: 
"Process" and inserting the following: 'Collect or process' 
Amend the bill in section 1 in c. 1057 in §9608 in subsection 2 in paragraph A in the 
last line (page 12, line 3 8 in L.D.) by inserting after the following: "pertains" the following: 
', including any routine administrative, operational, website or account-servicing activity 
that is consistent with the reasonable expectations of the consumer under the circumstances. 
This paragraph does not prevent a controller from processing personal data collected in 
accordance with this paragraph to provide advettising to a consumer based on the 
consumer's activities within the controller's own websites or online applications' 
Amend the bill in section 1 in c. 1057 in §9608 in subsection 4 in paragraph A in the 
first line (page 13, line 25 in L.D.) by insetting after the following: "sensitive data,
the 
following: 'collected or' 
Amend the bill in section 1 inc. 1057 in §9608 in subsection 4 in paragraph Bin the 
first line (page 13, line 27 in L.D.) by insetting after the following: "for" the following: 
'collecting and' 
Amend the bill in section 1 inc, 1057 in §9608 by striking out all of subsection 5 (page 
13, lines 41 and 42 and page 14, lines 1 to 7 in L.D.) and inserting the following: 
15, Notice of sale of personal data, targeted advertising or profiling; opt-out 
mechanism. If a controller sells personal data to 3rd patties, collects or processes personal 
data for the purposes of targeted advettising or processes personal data for the purposes of 
profiling the consumer in fmtherance of decisions that produce legal or similarly significant 
effects conceming the consumer, the controller shall clearly and conspicuously disclose the 
sale, collection or processing, as well as the manner in which a consumer may exercise the 
right to opt out of the sale, collection or processing. The disclosure required under this 
subsection must be prominently displayed on the controller's publicly accessible website 
and the language used must be clear. easy to understand and unambiguous.' 
Amend the bill in section 1 in c. 1057 in §9608 in subsection 6 by striking out all of 
paragraph C (page 14, lines 21 to 41 and page 15, lines 1 to 8 in L.D.) and insetting the 
following: 
'C. A controller may satisfy the controller's obligation under this subsection to establish 
a secure and reliable mechanism for a consumer to exercise the right to opt out under 
subsection 5 by: 
(1) Providing a clear and conspicuous link on the controller's publicly accessible 
website to a webpage that allows a consumer, an authorized agent of the consumer 
or a person authorized by section 9606, subsection 4 to exercise the consumer's 
rights to opt out of any collection or processing of the consumer's personal data for 
the purposes of targeted adve1tising or profiling or any sale of personal data; and 
(2) No later than September L 2026, allowing a consumer to opt out of any 
collection or processing of the consumer's personal data for the purposes of 
targeted advertising or any sale of personal data through an opt-out preference 
signal sent, with the consumer's consent, by a platform, technology or mechanism 
to the controller indicating the consumer's intent to opt out of the collection, 
COMMITTEE AMENDMENT 
~os 
COMMITTEE AMENDMENT" A• to H.P. 1220, L.D. 1822 
processing or sale as described in section 9607. subsection 2. The platform, 
technology or mechanism: 
(a) Must be consumer-friendly and easy to use by the average consumer: 
(b) Must use clear. easy to understand and unambiguous language: 
(c) 
Must be as consistent as possible with any other similar platform. 
technology or mechanism required by federal or state law. rule or regulation: 
(d) Must enable the controller to reasonably determine whether the consumer 
is a resident of the State. which reasonable determination may be based on the 
location associated with the consumer's Internet protocol address. and whether 
the consumer has made a legitimate request to opt out of any such collection. 
processing or sale of the consumer's personal data: 
(e) May not unfairly disadvantage another controller; and 
(f) May not make use of a default setting but must require the consumer to 
make an affirmative. freely given and unambiguous choice to opt out of any 
such collection. processing or sale of the consumer's personal data. 
A controller that recognizes an opt-out preference signal that has been approved by the 
laws of another state is considered to be in compliance with this paragraph.' 
Amend the bill in section 1 inc. 1057 in §9608 in subsection 6 in paragraph D in the 
first line (page 15, line 9 in L.D.) by inse1iing after the following: 
11any
the following: 
'collection or' 
Amend the bill in section 1 in c. 1057 in §9609 in subsection 1 in paragraph B in 
subparagraph (6) in the first line (page 16, line 4 in L.D.) by striking out the following: 
"After providing the controller an oppotiunit_y to object, engage a" and inse1iing the 
following: 'Engage any' 
Amend the bill in section I inc. 1057 in §9609 in subsection 2 in paragraph C in the 
last line (page 16, line 31 in L.D.) by striking out the following: 
119611
and inse1iing the 
following: '961 O' 
Amend the bill in section 1 in c. 1057 in §9609 in subsection 4 in paragraph C in the 
last line (page 17, line 8 in L.D.) by striking out the following: 
119614
and insetiing the 
following: '9613' 
Amend the bill in section 1 inc. 1057 by striking out all of §9610 (page 17, lines 12 to 
in L.D.). 
Amend the bill in section 1 inc. 1057 in §9611 in subsection 1 in paragraph A in the 
first line (page 17, line 24 in L.D.) by inserting after the following: "The" the following: 
'collection or' 
Amend the bill in section 1 inc. 1057 in §9611 in subsection 1 in paragraph C in the 
first line (page 17, line 26 in L.D.) by inse1iing after the following: 
11The
the following: 
'collection or' 
Amend the bill in section 1 inc. 1057 in §9611 by striking out all of subsection 2 (page 
17, lines 36 to 40 in L.D.) and inse1iing the following: 
COMMITTEE AMENDMENT 
COMMITTEE AMENDMENT "A" to H.P. 1220, L.D. 1822 
'2. Data protection assessments required, A controller shall conduct and document 
a data protection assessment for each of the controller's collection or processing activities 
that present a heightened risk of harm to a consumer. A single data protection assessment 
may address a comparable set of collection or processing operations that include similar 
activities, 1 
Amend the bill in section 1 inc, 1057 in §9611 by striking out all of subsection 3 (page 
18, lines 1 to 16 in L.D,) and inserting the following: 
13. Required elements. A data protection assessment required by subsection 2 must 
be conducted in accordance with the requirements of this subsection, 
A, The data protection assessment must identify and weigh the benefits that may flow 
directly and indirectly from the collection or processing to the controller, the consumer, 
other interested parties and the public against: 
(1) The potential risks to the rights of the consumer associated with the collection 
or processing as mitigated by safeguards that may be employed by the controller 
to reduce these risks; and 
(2) The necessity and proportionality of collection or processing in relation to the 
stated purpose of the collection or processing, 
B, The controller shall factor into a data protection assessment: 
(1) The use of de-identified data; 
(2) The reasonable expectations of consumers; 
(3) The context of the collection or processing: and 
(4) The relationship between the controller and the consumer whose personal data 
will be collected or processed.' 
Amend the bill in section 1 in c. 1057 in §9611 by striking out all of subsection 7 (page 
18, lines 33 to 3 8 in L.D.) and inserting the following: 
'7, Deadlines for performing data protection assessments. A controller shall 
conduct and document a data protection assessment as required by this section: 
A. Within 6 months of the date that the controller first engages in a collection or 
processing activity that presents a heightened risk of harm to a consumer; and 
B. Within 6 months of making a material change to any collection or processing 
activity that presents a heightened risk of harm to a consumer,' 
Amend the bill in section 1 inc, 1057 in §9611 by striking out all of subsection 8 (page 
18, lines 39 and 40 in L.D.) and inse1ting the following: 
18. Application. The requirement to conduct a data protection assessment under this 
section applies only to collection or processing activities that occur on or after September 
1, 2026.' 
Amend the bill in section 1 inc, 1057 in §9613 in subsection 1 in paragraph Jin the 
first line (page 20, line 7 in L.D.) by striking out the following: 
: or" and inserting the 
following: 
~
COMMITTEE AMENDMENT 
o'b 
~ 
.16 
COMMITTEE AMENDMENT "A" to H.P. 1220, L.D. 1822 
Amend the bill in section 1 inc. 1057 in §9613 in subsection 1 in paragraph K in the 
last line (page 20, line 9 in L.D.) by striking out the following: ",." and insetting the 
following: ';_gr' 
Amend the bill in section 1 in c. 1057 in §9613 in subsection 1 by insetting after 
paragraph K the following: 
'L. Transfer assets to a 3rd party in the context of a merger. acquisition, banlm1ptcy or 
similar transaction when the 3rd party assumes control, in whole or in part. of the 
controller's assets. but only if the controller. in a reasonable time prior to the transfer. 
provides an affected consumer with: 
(1) A notice describing the transfer, including the name of the entity receiving the 
consumer's personal data and the applicable privacy policies of the receiving entity; 
and 
(2) A reasonable opportunity to: 
(a) Withdraw any previous consent related to the consumer's personal data; 
and 
(b) Request deletion of the consumer's personal data.' 
Amend the bill in section 1 in c. 1057 in §9613 in subsection 5 in paragraph B tn the 
first line (page 21, line 7 in L.D.) by inserting after the following: "an individual's" the 
following: 'collection or' 
Amend the bill in section 1 inc, 1057 in §9613 by striking out all of subsection 6 (page 
21, lines 9 to 11 in L.D.) and inse1ting the following: 
'6. Burden of proof. If a controller collects or processes personal data pursuant to an 
exemption in this section, the controller bears the burden of demonstrating that the 
collection or processing qualifies for the exemption and complies with the limitations in 
subsection 7.' 
Amend the bill in section 1 in c. 1057 in §9613 by striking out all of subsection 7 (page 
21, lines 12 to 20 in L.D.) and insetting the following: 
'7, Limitations. Personal data collected or processed by a controller or processor 
pursuant to an exemption in this section may be collected or processed only to the extent 
that the collection or processing is: 
A. Subject to reasonable administrative, technical and physical measures to protect the 
confidentiality. integrity and accessibility of the personal data and reduce reasonably 
foreseeable risks of hatm to consumers relating to the collection, use or retention of 
personal data; 
B. Reasonably necessary and_ prop01tionate to the purposes listed in this section; and 
C. Adequate, relevant and limited to what is necessaty in relation to the specific 
purposes listed in this section.' 
Amend the bill in section 1 inc. 1057 in §9613 by striking out all of subsection 8 (page 
21, lines 21 to 23 in L.D.) and insetting the following: 
COMMITTEE AMENDMENT 
~os, 
COMMITTEE AMENDMENT "A' to H.P. 1220, L.D. 1822 
18. Collecting or processing personal data pursuant to an exemption. A person 
that collects or processes personal data pursuant to an exemption in this section may not be 
considered a controller solely based on that collection or processing of personal data.' 
Amend the bill in section 1 inc, 1057 in §9614 in subsection 2 in paragraph C in the 
first line (page 21, line 42 in L.D.) by inserting after the following: 
11processor1s
the 
following: 'collection or' 
Amend the bill in section 1 inc, 1057 by inserting after §9614 the following: 
1§9615. Report 
By February 1. 2027 and annually thereafter, the Attomey General shall submit a repo1t 
to the joint standing committee of the Legislature having jurisdiction over judicia1y matters 
regarding the implementation and operation of this chapter. The repo1t must include. at a 
minimum, the following information: 
1. Number of notices. The number of notices the Attomey General has issued under 
section 9613, subsection 2 and the nature of the violations alleged in the notices; 
2, Number of persons sent a notice. The number of persons sent a notice described 
in subsection 1 that conferred with the Attomey General during the notice period described 
in section 9613. subsection 2 in a manner that alleviated the need for a civil action under 
the Maine Unfair Trade Practices Act: 
3. Number of civil actions. The number of civil actions brought by the Attorney 
General under the Maine Unfair Trade Practices Act to enforce violations of this chapter; 
and 
4. Recommendations. Any recommendations the Attorney General has for improving 
the operation of this chapter, 
The joint standing committee of the Legislature having jurisdiction over judicia1y 
matters may repmt out legislation related to the rep01t. 1 
Amend the bill in section 1 in chapter 1057 by renumbering the sections to read 
consecutively, 
Amend the bill by striking out all of sections 2 and 3 and inserting the following: 
'Sec. 2. Appropriations and allocations. The following appropriations and 
allocations are made, 
ATTORNEY GENERAL, DEPARTMENT OF THE 
Administration - Attorney General 0310 
Initiative: Provides funding for one Assistant Attorney General position, one Paralegal 
position, one Technician position and related costs to administer and enforce the Maine 
Online Data Privacy Act. 
GENERAL FUND 
POSITIONS - LEGISLATIVE COUNT 
Personal Services 
All Other 
GENERAL FUND TOTAL 
2025-26 
0,000 
$0 
$0 
$0 
COMMITTEE AMENDMENT 
2026-27 
3,000 
$420,508 
$20,000 
$440,508 
~ 
~os. 
COMMITTEE AMENDMENT 'A" to H.P. 1220, L.D. 1822 
Sec. 3. Effective date. This Act takes effect September 1, 2026.' 
Amend the bill by relettering or renumbering any nonconsecutive Part letter or section 
number to read consecutively. 
SUMMARY 
This amendment, which is the majority report of the committee, makes the following 
changes to the bill. 
1. It changes the effective date of the Maine Online Data Privacy Act from July 1, 2026 
to September 1, 2026. 
2. It clarifies that the term "process" does not include the collection of personal data 
and makes technical changes throughout the bill to address the difference between 
collection and processing of personal data and sensitive data. 
3. It amends the definition of "publicly available infonnation" to exclude any 
information used to create a consumer profile, any information made available for sale and 
inferences derived from these types of info1mation. 
4. It clarifies the types of consumer financial information that are considered "sensitive 
data" under the Act. 
5. It provides that the Act does not prohibit the transfer of personal data as pa1t of the 
transfer of assets to a 3rd party in the context of a merger, acquisition or bankruptcy as long 
as the controller provides an affected consumer with a notice describing the transfer, 
including the name of the entity acquiring the personal data and the entity's privacy policies 
as well as a reasonable opp01tunity for the consumer to withdraw any previous consent 
related to the consumer's personal data and to request deletion of the consumer's personal 
data. 
6. It exempts personal data collected and used pursuant to the federal Controlled 
Substances Act, 21 United States Code, Section 830, from the scope of the Act. 
7. It provides that, although a controller must limit the collection of personal data to 
what is reasonably necessary and proportionate to provide or maintain a specific product 
or service requested by the consumer, such services include routine administrative, 
operational, website or account-servicing activities that are consistent with the reasonable 
expectations of the consumer under the circumstances, including collection of the 
consumer's personal data to provide advettising to the consumer based on the consumer's 
activities within the controller's own websites or online applications. 
8. It removes the provision of the bill that requires a processor to provide a controller 
an oppo1tunity to object to the processor's engaging of a subcontractor, but retains the 
provision of the bill requiring the processor to require any subcontractor to assist with 
processing only in accordance with a written contract that requires the subcontractor to 
meet the processor's obligations regarding the personal data under the processor's contract 
with the controller. 
9. It removes the provision of the bill requiring 3rd patties to provide specific notices 
to consumers. 
COMMITTEE AMENDMENT 
COMMITTEE AMENDMENT "A" to H.P. 1220, L.D. 1822 
10. It removes the requirement that controllers conduct data protection assessments for 
each algorithm used on personal data. 
11. Unlike the bill, which requires only a single report on February 1, 2027, it requires 
the Attorney General to submit, beginning February 1, 2027, an annual report to the joint 
standing committee of the Legislature having jurisdiction over judiciary matters regarding 
the implementing and operation of the Act. 
FISCAL NOTE REQUIRED 
(See attached) 
COMMITTEE AMENDMENT 
Approved: 06/04/25 LRL 
LD 1822 
LR 14(02) 
An Act to Enact the Maine Online Data Privacy Act 
Fiscal Note for Bill as Ame~ded by c.o~mittee Amendment ;t\'~➔-1 lb' 
Committee: Judiciary 
LI 
'2>) 
Net Cost (Savings) 
General Fund 
Appropriations/ Allocations 
General Fund 
Correctional and Judicial Impact Statements 
Fiscal Note Required: Yes 
Fiscal Note 
FY 2025-26 
$0 
$0 
FY 2026-27 
$440,508 
$440,508 
Projections 
FY 2027-28 
$457,416 
$457,416 
Projections 
FY.2028-29 
• $489,920 
$489,920 
This bill may increase the number of civil suits filed in the court system, The additional workload associated with the 
minimal number of new cases filed in.the court system does not require additional funding at this time. The collection 
· of additional filing fees will increase General Fund revenue by minor amounts. 
Fiscal Detail and Notes 
The bill includes a General Fund appropriation to the Office of the Attorney General of $440,508 in fiscal year 2026-
for one Assistant Attorney General position, one Paralegal position, one Technician position and related costs to 
administer and enforce tlie Maine Consumer Privacy Act. 
LR0014(02) - Fiscal Note - Page 1 of 1