Maine's Notice of Risk to Personal Data Act, 10 M.R.S. 1348: Two Triggers, a Scope-Based 30-Day Clock and a Regulator Split

Who 10 M.R.S. Chapter 210-B Reaches

Section 1346 names the chapter "the Notice of Risk to Personal Data Act," and its history line traces it to Public Law 2005, chapter 379. The duties fall on a "person," which section 1347(5) defines as an individual or any entity, "including agencies of State Government, municipalities, school administrative units, the University of Maine System, the Maine Community College System, Maine Maritime Academy and private colleges and universities." The same subsection adds that the definition may not be read to require duplicative notice by more than one party to the same transaction. The text contains no requirement that the person do business in Maine; the duty is tied to Maine residents whose data is involved.

Maine's definitions are wider than the bare name-plus-number formula in two places. A breach under section 1347(1) is the "unauthorized acquisition, release or use" of computerized data containing personal information that compromises its security, confidentiality or integrity; the words "release or use" came in with Public Law 2009, chapter 161, according to the section history. Personal information under section 1347(6) includes, alongside a Social Security number and a driver's license or state ID number, an account or card number usable without additional codes, and "account passwords or personal identification numbers or other access codes." Paragraph E then reaches any of those elements without a name at all, "if the information if compromised would be sufficient to permit a person to fraudulently assume or attempt to assume the identity" of the individual. Third-party claims databases kept by property and casualty insurers are excluded.

Section 1347(3) defines an information broker as a person who, for fees or dues, collects, compiles or communicates information about individuals "for the primary purpose of furnishing personal information to nonaffiliated 3rd parties," excluding government agencies whose records are kept mainly for traffic safety, law enforcement or licensing. The distinction matters because section 1348(1) gives brokers a different trigger.

• Paragraph A: a broker that becomes aware of a breach investigates "in good faith" the likelihood of misuse, then notifies each resident whose information "has been, or is reasonably believed to have been, acquired by an unauthorized person." The notice trigger in this paragraph is acquisition, not the outcome of the investigation.
• Paragraph B: any other person conducts the same investigation and notifies a resident only "if misuse of the personal information has occurred or if it is reasonably possible that misuse will occur."

Separately, section 1347-A, added in 2009, makes it a violation of the chapter for an unauthorized person "to release or use an individual's personal information acquired through a security breach." That reaches the person who took the data, not only the holder.

The 30-Day Deadline

Notices under both paragraphs are due "as expediently as possible and without unreasonable delay," consistent with law enforcement needs or with measures necessary to determine the scope of the breach and restore the integrity, security and confidentiality of the data. The day count follows in a separate sentence: absent a law enforcement delay, notices "must be made no more than 30 days after the person identified in paragraph A or B becomes aware of a breach of security and identifies its scope." The clock therefore has two conditions, awareness and scope identification, and the text does not set a limit on how long scope identification may take.

That sentence was added by Public Law 2019, chapter 512, enacted from LD 696 (SP 209) of the 129th Legislature, sponsored by Senator Breen of Cumberland and signed June 28, 2019. Its title, An Act To Require Municipalities and School Districts To Provide Notice of Breaches in Personal Data Security, describes its other change: the chaptered text underlines "municipalities, school administrative units" as new words in both the definition of person and the fine exemption.

Law enforcement delay is capped. Under section 1348(3), if notice is required after the investigation, it "may be delayed for no longer than 7 business days after a law enforcement agency determines that the notification will not compromise a criminal investigation." A third party that maintains data it does not own notifies the person maintaining it "immediately following discovery" under subsection 2. Notice may be written, electronic consistent with 15 U.S.C. 7001, or substitute notice where cost would exceed $5,000, more than 1,000 individuals are affected, or contact information is lacking; substitute notice combines email, a website posting and major statewide media. The chapter prescribes no content for the notice to residents.

Notice to Regulators

Section 1348(5) attaches a regulator notice to every resident notice, with no headcount threshold: "When notice of a breach of the security of the system is required under subsection 1, the person shall notify the appropriate state regulators within the Department of Professional and Financial Regulation, or if the person is not regulated by the department, the Attorney General." The subsection specifies no deadline and no content for that report.

The same division of labor runs through the chapter. Section 1350-A lets the department's regulators adopt rules for persons under their jurisdiction and the Attorney General adopt rules for all others, as routine technical rules, and directs each to make reasonable efforts to inform the persons it covers of their responsibilities. No rules adopted under the section were reviewed for this post.

Notice to Consumer Reporting Agencies

Under section 1348(4), a person whose breach requires notice "to more than 1,000 persons at a single time" also notifies, without unreasonable delay, the nationwide consumer reporting agencies defined in 15 U.S.C. 1681a(p). Maine specifies the contents: "the date of the breach, an estimate of the number of persons affected by the breach, if known, and the actual or anticipated date that persons were or will be notified of the breach." The threshold counts persons notified, not Maine residents specifically.

Civil Violations and Enforcement

Section 1349(1) assigns enforcement along the regulator line: department regulators for the persons they license or regulate, the Attorney General "for all other persons." A violation is a civil violation under subsection 2, subject to one or more of a fine "of not more than $500 per violation, up to a maximum of $2,500 for each day the person is in violation," equitable relief, or an injunction. The fine paragraph does not apply to State Government, municipalities, school administrative units, the University of Maine System, the Maine Community College System or Maine Maritime Academy; private colleges, which are persons under section 1347(5), are not in that list. Subsection 3 makes the remedies cumulative with other federal and state remedies. The chapter neither creates nor bars a private right of action.

Subsection 4 treats a person that follows breach notification requirements "established pursuant to federal law or the law of this State" as compliant with section 1348, but only where those requirements are "at least as protective as" section 1348. The chapter closes with section 1350-B, which entitles a person who believes their information was misused in identity theft under Title 17-A, section 905-A to a police report from the local law enforcement agency.

The Maine Attorney General's website, including its consumer protection pages on data breaches, returned HTTP 403 to every request made for this post, so no notice list, guidance or enforcement release from the office was read. The enforcement record recorded here is therefore zero, as a gap in what could be retrieved rather than a finding that no action exists.

Frequently Asked Questions