Processes personal data, in Maine

35-A M.R.S. sec. 9301 · Read the law's page

• Obtain a Maine broadband customer's express, affirmative, opt-in consent before using, disclosing, selling, or permitting access to their customer personal information, and let them revoke that consent at any time.
• Do not refuse service, or charge a penalty or offer a discount, based on a customer's consent decision under this statute.
• Do not treat this statute as reaching biometric data. Its customer personal information definition never names biometric, fingerprint, voiceprint, or faceprint data.

10 M.R.S. secs. 1347-1349 · Read the law's page

• Notify affected Maine residents of a breach of security as expediently as possible and without unreasonable delay, no more than 30 days after becoming aware of the breach and identifying its scope, absent a law enforcement delay.
• Where a law enforcement investigation delays notice, notify affected Maine residents no later than 7 business days after a law enforcement agency determines that notification will not compromise a criminal investigation (10 M.R.S. 1348(3)).
• Notify the appropriate Department of Professional and Financial Regulation regulator, or the Attorney General if you are not regulated by that department.
• If you maintain computerized personal information on behalf of another person and do not own it, notify that person of a breach of the security of the system immediately following discovery if the information was, or is reasonably believed to have been, acquired by an unauthorized person (10 M.R.S. 1348(2)).
• Where a breach requires notice to more than 1,000 persons at a single time, also notify the nationwide consumer reporting agencies without unreasonable delay, giving the date of the breach, an estimate of the number of persons affected, if known, and the date persons were or will be notified (10 M.R.S. 1348(4)).