Maine Revised Statutes Title 10 Sec. 1348 – Security breach notice requirements
Current as of: 2023 | Check for updates
|
Other versions
1. Notification to residents. The following provisions apply to notification to residents by information brokers and other persons.
A. If an information broker that maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the information broker shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State whose personal information has been, or is reasonably believed to have been, acquired by an unauthorized person. [PL 2005, c. 583, §6 (NEW); PL 2005, c. 583, §14 (AFF).]
B. If any other person who maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the person shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State if misuse of the personal information has occurred or if it is reasonably possible that misuse will occur. [PL 2005, c. 583, §6 (NEW); PL 2005, c. 583, §14 (AFF).]
The notices required under paragraphs A and B must be made as expediently as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement pursuant to subsection 3 or with measures necessary to determine the scope of the security breach and restore the reasonable integrity, security and confidentiality of the data in the system. If there is no delay of notification due to law enforcement investigation pursuant to subsection 3, the notices must be made no more than 30 days after the person identified in paragraph A or B becomes aware of a breach of security and identifies its scope.
[PL 2019, c. 512, §2 (AMD).]
Terms Used In Maine Revised Statutes Title 10 Sec. 1348
- Discovery: Lawyers' examination, before trial, of facts and documents in possession of the opponents to help the lawyers prepare for trial.
- Information broker: means a person who, for monetary fees or dues, engages in whole or in part in the business of collecting, assembling, evaluating, compiling, reporting, transmitting, transferring or communicating information concerning individuals for the primary purpose of furnishing personal information to nonaffiliated 3rd parties. See Maine Revised Statutes Title 10 Sec. 1347
- Notice: means :
A. See Maine Revised Statutes Title 10 Sec. 1347Person: as used in this chapter may not be construed to require duplicative notice by more than one individual, corporation, trust, estate, cooperative, association or other entity involved in the same transaction. See Maine Revised Statutes Title 10 Sec. 1347 Personal information: means an individual's first name, or first initial, and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
A. See Maine Revised Statutes Title 10 Sec. 1347security breach: means unauthorized acquisition, release or use of an individual's computerized data that includes personal information that compromises the security, confidentiality or integrity of personal information of the individual maintained by a person. See Maine Revised Statutes Title 10 Sec. 1347 System: means a computerized data storage system containing personal information. See Maine Revised Statutes Title 10 Sec. 1347 Unauthorized person: means a person who does not have authority or permission of a person maintaining personal information to access personal information maintained by the person or who obtains access to such information by fraud, misrepresentation, subterfuge or similar deceptive practices. See Maine Revised Statutes Title 10 Sec. 1347 United States: includes territories and the District of Columbia. See Maine Revised Statutes Title 1 Sec. 72
2. Notification to person maintaining personal information. A 3rd-party entity that maintains, on behalf of a person, computerized data that includes personal information that the 3rd-party entity does not own shall notify the person maintaining personal information of a breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
[PL 2005, c. 583, §7 (AMD); PL 2005, c. 583, §14 (AFF).]
3. Delay of notification; criminal investigation by law enforcement. If, after the completion of an investigation required by subsection 1, notification is required under this section, the notification required by this section may be delayed for no longer than 7 business days after a law enforcement agency determines that the notification will not compromise a criminal investigation.
[PL 2009, c. 161, §3 (AMD); PL 2009, c. 161, §5 (AFF).]
4. Notification to consumer reporting agencies. If a person discovers a breach of the security of the system that requires notification to more than 1,000 persons at a single time, the person shall also notify, without unreasonable delay, consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 United States Code § 1681a(p). Notification must include the date of the breach, an estimate of the number of persons affected by the breach, if known, and the actual or anticipated date that persons were or will be notified of the breach.
[PL 2005, c. 583, §8 (AMD); PL 2005, c. 583, §14 (AFF).]
5. Notification to state regulators. When notice of a breach of the security of the system is required under subsection 1, the person shall notify the appropriate state regulators within the Department of Professional and Financial Regulation, or if the person is not regulated by the department, the Attorney General.
[PL 2005, c. 583, §9 (AMD); PL 2005, c. 583, §14 (AFF).]
SECTION HISTORY
PL 2005, c. 379, §1 (NEW). PL 2005, c. 379, §4 (AFF). PL 2005, c. 583, §§6-9 (AMD). PL 2005, c. 583, §14 (AFF). PL 2009, c. 161, §3 (AMD). PL 2009, c. 161, §5 (AFF). PL 2019, c. 512, §2 (AMD).