PLEASE NOTE: Legislative Information cannot perform research, provide legal advice, or interpret Maine law. For legal assistance, please contact a qualified attorney.
Amend the bill by striking out all of section 1.
Further amend the bill in section 4 by striking out all of subsection 5 (page 1, lines 35 to 41 in L.D.) and inserting in its place the following:
 
‘5.  Person.   “Person” means an individual, partnership, corporation, limited liability company, trust, estate, cooperative, association or other entity, including agencies of State Government, the University of Maine System, the Maine Community College System, Maine Maritime Academy and private colleges and universities. “Person” as used in this chapter may not be construed to require duplicative notice by more than one individual, corporation, trust, estate, cooperative, association or other entity involved in the same transaction.’
Further amend the bill by inserting after section 4 the following:
‘Sec. 5. 10 MRSA §1347, sub-§6,  as enacted by PL 2005, c. 379, §1 and affected by §4, is amended to read:
 
6.  Personal information.   “Personal information” means an individual’s first name, or first initial, and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
 
A.  Social security number;
 
B.  Driver’s license number or state identification card number;
 
C.  Account number, credit card number or debit card number, if circumstances exist wherein such a number could be used without additional identifying information, access codes or passwords;
 
D.  Account passwords or personal identification numbers or other access codes; or
 
E.  Any of the data elements contained in paragraphs A to D when not in connection with the individual’s first name, or first initial, and last name, if the information if compromised would be sufficient to permit a person to fraudulently assume or attempt to assume the identity of the person whose information was compromised.
 
”Personal information” does not include information from 3rd-party claims databases maintained by property and casualty insurers or publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.’
Further amend the bill in section 8 by striking out all of subsection 4 (page 2, lines 41 and 42 and page 3, lines 1 to 3 in L.D.) and inserting in its place the following:
 
‘4.  Notification to consumer reporting agencies.   If an information brokera person discovers a breach of the security of the system that requires notification to more than 1,000 persons at a single time, the information brokerperson shall also notify, without unreasonable delay, consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 United States Code, Section 1681a(p). Notification must include the date of the breach, an estimate of the number of persons affected by the breach, if known, and the actual or anticipated date that persons were or will be notified of the breach.’
Further amend the bill in section 11 in subsection 2 in paragraph A in the 2nd line (page 3, line 22 in L.D.) by inserting after the following: “chapter” the following: ‘, except that this paragraph does not apply to State Government, the University of Maine System, the Maine Community College System or Maine Maritime Academy’
Further amend the bill by inserting after section 11 the following:
‘Sec. 12. 10 MRSA §1349, sub-§4  is enacted to read:
 
4.  Exceptions.    A person that complies with the security breach notification requirements of rules, regulations, procedures or guidelines established pursuant to federal law or the law of this State is deemed to be in compliance with the requirements of this chapter as long as the law, rules, regulations or guidelines provide for notification procedures at least as protective as the notification requirements of this chapter.’
Further amend the bill by striking out all of section 12.
Further amend the bill by striking out all of section 13 and inserting in its place the following:
‘Sec. 13. 10 MRSA §1350-A  is enacted to read:
§ 1350-A.   Rules; education and compliance 
The following provisions govern rules and education and compliance.
 
1.  Rules.     With respect to persons under the jurisdiction of the regulatory agencies of the Department of Professional and Financial Regulation, the appropriate state regulators within that department may adopt rules as necessary for the administration and implementation of this chapter. With respect to all other persons, the Attorney General may adopt rules as necessary for the administration and implementation of this chapter. Rules adopted pursuant to this subsection are routine technical rules as defined in Title 5, chapter 375, subchapter 2-A. 
 
2.  Education and compliance.     The appropriate state regulators within the Department of Professional and Financial Regulation shall undertake reasonable efforts to inform persons under the department’s jurisdiction of their responsibilities under this chapter. With respect to all other persons, the Attorney General shall undertake reasonable efforts to inform such persons of their responsibilities under this chapter. 
Sec. 14. Effective date. This Act takes effect January 31, 2007.’
Further amend the bill by relettering or renumbering any nonconsecutive Part letter or section number to read consecutively.
 
SUMMARY
This amendment is the majority report of the committee. The amendment makes the following changes to the bill.
1. It removes the section that permits persons to bring a private cause of action for violations of the notice provisions.
2. It adds language to clarify that if an entity complies with file breach notification requirements established pursuant to federal or Maine law, and if those requirements are at least as protective as the protections granted by this legislation, that entity is deemed to be in compliance with the notification requirements of the bill.
3. It specifies that when a person is required to notify consumer reporting agencies of a security breach, the agencies must be informed of the date of the breach, an estimate of the number of individuals affected by the breach, if known, and the actual or anticipated date that the individuals were or will be notified of the breach.
4. It amends the definition of “person” to include State Government, the University of Maine System, the Maine Community College System and Maine Maritime Academy so that those entities are subject to the notification requirements of the bill. The amendment also exempts those parties from the civil fine provisions of the Maine Revised Statutes, Title 10, section 1349, subsection 2 but leaves them subject to equitable and injunctive remedies.
5. It clarifies that the definition of personal information subject to the notice requirements of the bill after a security breach does not apply to information maintained in 3rd-party claims databases of property and casualty insurance companies.
6. It extends authority to the Attorney General’s office with respect to persons not under the jurisdiction of the regulatory agencies within the Department of Professional and Financial Regulation.
7. It requires the Department of Professional and Financial Regulation and the Attorney General to undertake reasonable efforts to inform persons of their responsibilities under this legislation.
8. It delays the effective date of this legislation until January 31, 2007.