Data Breach Requirements: 10 M.R.S.A § 1346 et seq.
The numbering and internal citations herein are derived from the applicable state statute.
Personal Information
The term “personal information” means an individual’s first name, or first initial, and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
A. Social Security number;
B. Driver’s license number or state identification card number;
C. Account number, credit card number, or debit card number, if circumstances exist wherein such a number could be used without additional identifying information, access codes, or passwords;
D. Account passwords or personal identification numbers or other access codes; or
E. Any of the data elements contained in paragraphs A to D when not in connection with the individual’s first name, or first initial, and last name, if the information if compromised would be sufficient to permit a person to fraudulently assume or attempt to assume the identity of the person whose information was compromised.
Security Breach Definition
The term “breach of the security of the system” or “security breach” means unauthorized acquisition, release, or use of an individual’s computerized data that includes personal information that compromises the security, confidentiality, or integrity of personal information of the individual maintained by a person.
Good Faith Exception
Good faith acquisition, release, or use of personal information by an employee or agent of a person on behalf of the person is not a breach of the security of the system if the personal information is not used for or subject to further unauthorized disclosure to another person.
Risk of Harm Analysis
See Other Information (a “misuse” standard for non-information brokers).
Notification Timeline
A breach notification must be made as expediently as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or with measures necessary to determine the scope of the security breach and restore the reasonable integrity, security, and confidentiality of the data in the system. If there is no delay of notification due to law enforcement investigation, the notices must be made no more than 30 days after the person becomes aware of a breach of security and identifies its scope.
Security and Investigation Exceptions
If, after the completion of an investigation (see Other Information), a breach notification is required, the notification may be delayed for no longer than seven business days after a law enforcement agency determines that the notification will not compromise a criminal investigation.
Notification Content Requirements
See Consumer Reporting Agencies.
Delivery Methods
A breach notice may be provided by one of the following methods:
A. Written notice;
B. Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act); or
C. Substitute notice, if the person maintaining personal information demonstrates that the cost of providing notice would exceed $5,000, that the affected class of individuals to be notified exceeds 1,000, or that the person maintaining personal information does not have sufficient contact information to provide written or electronic notice to those individuals.
Substitute Notice
Substitute notice must consist of all of the following:
(1) Email notice, if the person has email addresses for the individuals to be notified;
(2) Conspicuous posting of the notice on the person’s publicly accessible website, if the person maintains one; and
(3) Notification to major statewide media.
Notice to Government Agencies
When notice of a breach is required by this law, the person shall notify the appropriate state regulators within the Department of Professional and Financial Regulation, or if the person is not regulated by the department, the attorney general.
Consumer Reporting Agencies
If a person discovers a breach of the security of the system that requires notification to more than 1,000 persons at a single time, the person shall also notify, without unreasonable delay, consumer reporting agencies. Notification must include the date of the breach, an estimate of the number of persons affected by the breach, if known, and the actual or anticipated date that persons were or will be notified of the breach.
Preemption and Compliance
A person that complies with the security breach notification requirements of rules, regulations, procedures, or guidelines established pursuant to federal law or the law of this state is deemed to be in compliance with the requirements of section 1348 as long as the law, rules, regulations, or guidelines provide for notification procedures at least as protective as the notification requirements of section 1348.
Data Processor Obligations
A third-party entity that maintains, on behalf of a person, computerized data that includes personal information that the third-party entity does not own, shall notify the person maintaining personal information of a breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
Other Information
An “information broker” means a person who, for monetary fees or dues, engages in whole or in part in the business of collecting, assembling, evaluating, compiling, reporting, transmitting, transferring, or communicating information concerning individuals for the primary purpose of furnishing personal information to nonaffiliated third parties. “Information broker” does not include a governmental agency whose records are maintained primarily for traffic safety, law enforcement, or licensing purposes.
If an information broker that maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the information broker shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this state whose personal information has been, or is reasonably believed to have been, acquired by an unauthorized person.
If any other person who maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the person shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this state if misuse of the personal information has occurred or if it is reasonably possible that misuse will occur.