Maine | Data Breach Law

January 3, 2018

Maine | Data Breach Law

You are here:
< Back

Reporting Requirements and Penalties

In Maine, any business that experiences a data breach must investigate the likelihood that personal information will be abused. Affected Maine residents must be informed as soon as possible through mail or electronic means. If the breach affects more than 1,000 people, or the cost of notification exceeds $5,000, businesses can use public service announcements to meet their notification obligations. If an event affects more than 1,000 people, all consumer-reporting agencies must be notified. Businesses that don’t comply with these regulations can be fined up to $2,500 a day. For details on ME’s data breach laws, keep reading.

Name of Law / Statute Notice of Risk to Personal Data Act
Definition of Protected Information Combination of (1) name or other identifying info, PLUS (2) one or more of these “data” elements: SSN; driver’s license number; or account number, credit card number, debit card number if accompanied by PIN, password, or access codes.
Who Is Subject to Law? Private sector businesses and “information brokers,” defined as “any person or entity who … engages in the business of collecting, assembling, evaluating, compiling, reporting, transmitting,” PI for non-affiliated third parties
Notification of Consumers? Yes
By what means? Written or electronic
Substitute Notice Threshold? If cost of notice >$5000 or for >1000k residents
Notification of authorities / regulators required? Yes
By what means? N/A
Regulatory Fines Up to $500/violation, $2500/day
Credit monitoring requirement? No
Private lawsuits allowed? No
Private damages cap? N/A
Regulatory actions allowed? Yes, for equitable relief or injunction
HIPAA Compliance exemption? N/A
Other  (e.g., timeframe) Law does not apply if PI was encrypted or redacted
Link to complete law Maine’s Data Breach Law

Read the full text of Maine’s data breach law to learn more.