How Can We Help?
Reporting Requirements and Penalties
In Maine, any business that experiences a data breach must investigate the likelihood that personal information will be abused. Affected Maine residents must be informed as soon as possible through mail or electronic means. If the breach affects more than 1,000 people, or the cost of notification exceeds $5,000, businesses can use public service announcements to meet their notification obligations. If an event affects more than 1,000 people, all consumer-reporting agencies must be notified. Businesses that don’t comply with these regulations can be fined up to $2,500 a day. For details on ME’s data breach laws, keep reading.
| Name of Law / Statute | Notice of Risk to Personal Data Act |
| Definition of Protected Information | Combination of (1) name or other identifying info, PLUS (2) one or more of these “data” elements: SSN; driver’s license number; or account number, credit card number, debit card number if accompanied by PIN, password, or access codes. |
| Who Is Subject to Law? | Private sector businesses and “information brokers,” defined as “any person or entity who … engages in the business of collecting, assembling, evaluating, compiling, reporting, transmitting,” PI for non-affiliated third parties |
| Notification of Consumers? | Yes |
| By what means? | Written or electronic |
| Substitute Notice Threshold? | If cost of notice >$5000 or for >1000k residents |
| Notification of authorities / regulators required? | Yes |
| By what means? | N/A |
| Regulatory Fines | Up to $500/violation, $2500/day |
| Credit monitoring requirement? | No |
| Private lawsuits allowed? | No |
| Private damages cap? | N/A |
| Regulatory actions allowed? | Yes, for equitable relief or injunction |
| HIPAA Compliance exemption? | N/A |
| Other (e.g., timeframe) | Law does not apply if PI was encrypted or redacted |
| Link to complete law | Maine’s Data Breach Law |
Read the full text of Maine’s data breach law to learn more.