What does Maine's data breach law ask a business to do?

Who does this law apply to?

The law applies to any person that keeps computerized personal information, a term that covers businesses, state agencies, municipalities, schools and colleges. On learning of a breach the person must investigate promptly and in good faith, and notify Maine residents if misuse has occurred or is reasonably possible. Information brokers must notify whenever the information was, or is reasonably believed to have been, taken.

If any other person who maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the person shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State if misuse of the personal information has occurred or if it is reasonably possible that misuse will occur.

"Person" means an individual, partnership, corporation, limited liability company, trust, estate, cooperative, association or other entity, including agencies of State Government, municipalities, school administrative units, the University of Maine System, the Maine Community College System, Maine Maritime Academy and private colleges and universities.

What counts as personal information?

Personal information is a first name or first initial and last name together with a Social Security number, a driver's licence or state identification card number, an account or card number usable without more, or account passwords, personal identification numbers or other access codes, when the name or the data is not encrypted or redacted.

"Personal information" means an individual's first name, or first initial, and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:

How fast must people be told?

Notice must be made as expediently as possible and without unreasonable delay. Where there is no law enforcement delay, the notices must be made no more than 30 days after the person becomes aware of the breach and identifies its scope.

If there is no delay of notification due to law enforcement investigation pursuant to subsection 3, the notices must be made no more than 30 days after the person identified in paragraph A or B becomes aware of a breach of security and identifies its scope.

Who else must be told?

The person must also notify the appropriate state regulators within the Department of Professional and Financial Regulation or, if not regulated by that department, the Attorney General. When more than 1,000 people must be notified at a single time, the nationwide consumer reporting agencies must be told too.

When notice of a breach of the security of the system is required under subsection 1, the person shall notify the appropriate state regulators within the Department of Professional and Financial Regulation, or if the person is not regulated by the department, the Attorney General.

If a person discovers a breach of the security of the system that requires notification to more than 1,000 persons at a single time, the person shall also notify, without unreasonable delay, consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 United States Code, Section 1681a(p).

What if a vendor holds the data?

A third party that keeps personal information on behalf of another person must tell that person of a breach immediately after finding it, when the information was or is reasonably believed to have been taken by an unauthorized person.

A 3rd-party entity that maintains, on behalf of a person, computerized data that includes personal information that the 3rd-party entity does not own shall notify the person maintaining personal information of a breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.