HP0133, LD 158, item 2, Document Text

Amend the bill by striking out everything after the enacting clause and before the summary and inserting the following:

‘Sec. 1. 10 MRSA §1347, sub-§1, as amended by PL 2009, c. 161, §1 and affected by §5, is further amended to read:

1. Breach of the security of the system. "Breach of the security of the system" or "security breach" means unauthorized acquisition, release or use of an individual's computerized data or lost, misplaced or unaccounted for computerized data that includes personal information that compromises the security, confidentiality or integrity of personal information of the individual maintained by a person. Good faith acquisition, release or use of personal information by an employee or agent of a person on behalf of the person is not a breach of the security of the system if the personal information is not used for or subject to further unauthorized disclosure to another person.

Sec. 2. 10 MRSA §1348, sub-§1, as repealed and replaced by PL 2005, c. 583, §6 and affected by §14, is amended to read:

1. Notification to residents. The following provisions apply to notification to residents by information brokers and other persons.

A. If an information broker that maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the information broker shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will may be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State whose personal information has been, or is reasonably believed to have been, acquired by an unauthorized person if misuse of the personal information has occurred or if it is reasonably possible that misuse may occur.

B. If any other person who maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the person shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will may be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State if misuse of the personal information has occurred or if it is reasonably possible that misuse will may occur.

The notices required under paragraphs A and B must be made as expediently as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement pursuant to subsection 3 or with measures necessary to determine the scope of the security breach and restore the reasonable integrity, security and confidentiality of the data in the system. Notice must be provided no later than 60 days after the discovery of the breach of the security of the system, except that, if lost, misplaced or unaccounted for computerized data is accounted for within 60 days of discovery of the breach of the security of the system, notice is not required.

Sec. 3. 10 MRSA §1348, sub-§3, as amended by PL 2009, c. 161, §3 and affected by §5, is further amended to read:

3. Delay of notification; criminal investigation by law enforcement. If, after the completion of an investigation required by subsection 1, notification is required a person is required to provide notice under this section, a law enforcement agency may make a written request to that person to delay the notification required by this section may be delayed for no longer than 7 business days after a law enforcement agency determines so that the notification will not compromise a criminal investigation.

Sec. 4. 10 MRSA §1348, sub-§5, as amended by PL 2005, c. 583, §9 and affected by §14, is further amended to read:

5. Notification to state regulators. When notice Within 10 days after the discovery of a breach of the security of the system is required under subsection 1, the person shall notify the appropriate state regulators within the Department of Professional and Financial Regulation, or if the person is not regulated by the department, the Attorney General.’

summary

This amendment is the minority report of the committee and replaces the bill. This amendment does the following with respect to the Notice of Risk to Personal Data Act.

1. It clarifies the definition of "breach of the security of the system" to include lost, misplaced or unaccounted for computerized data that includes personal information and requires notice to be provided to residents affected by a breach within 60 days unless the computerized data becomes accounted for prior to the 60-day deadline.

2. It requires that notice of a breach must be provided to state regulators no later than 10 days after discovery of the breach.

3. It clarifies that a notice to residents affected by a breach may be delayed only pursuant to a written request from a law enforcement agency.

4. It does not include the provision in the bill increasing the penalties for violations.

FISCAL NOTE REQUIRED

(See attached)

HP0133 LD 158	Session - 126th Maine Legislature C "A", Filing Number H-151, Sponsored by		LR 157 Item 2
	Bill Tracking, Additional Documents	Chamber Status

Bill Tracking		Chamber Status
Amendments	Testimony, Public Hearings & Work Sessions		Committee Information
Other Documents			Title & Section

Search Bill Text		Search Bill Status
Bill Directory	Session Information		Legislative Information
Download MS-Word, Printed PDF		Maine Legislature

Office of Legislative Information 100 State House Station Augusta, ME 04333		voice: (207) 287-1692 fax: (207) 287-1580 tty: (207) 287-6826
Word Viewer for Windows		Disclaimer