Law / United States / 
Maine
Notice of Risk to Personal Data
In force.
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Notify affected Maine residents of a breach of security as expediently as possible and without unreasonable delay, no more than 30 days after becoming aware of the breach and identifying its scope, absent a law enforcement delay.
- Where a law enforcement investigation delays notice, notify affected Maine residents no later than 7 business days after a law enforcement agency determines that notification will not compromise a criminal investigation (10 M.R.S. 1348(3)).
- Notify the appropriate Department of Professional and Financial Regulation regulator, or the Attorney General if you are not regulated by that department.
These lines are LexLint's reading of the law's text. Also read by: Office of the Maine Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Attorney General's page gives the period after law enforcement clears a delay as 7 days, where section 1348 subsection 3 says 7 business days.
- As of
- Guidance link
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/list.html
- Guidance body
- Office of the Maine Attorney General
- Open questions
- Does the 30-day limit in 10 M.R.S. ยง 1348(1) run from the day a person becomes aware of a breach of security, or from the later day it "identifies its scope"?
What it makes you log
Logging duty
Section 1348 requires a person that becomes aware of a security breach to investigate in good faith whether personal information has been or will be misused and to notify affected residents within 30 days of identifying the scope, to notify consumer reporting agencies when more than 1,000 persons are notified, and to notify the Department of Professional and Financial Regulation or the Attorney General. The chapter requires notification and no record of the breach or of the investigation. Section 1347 (definitions) and section 1349 (enforcement and penalties) add no record or log duty. The notice duty is owed to a resident of this State, so the hook is residence.
- Kind
- None
- As of
What this law does
A person must notify affected Maine residents of a breach of security as expediently as possible and without unreasonable delay, no more than 30 days after becoming aware of the breach and identifying its scope absent a law-enforcement delay, and must notify the appropriate state regulator within the Department of Professional and Financial Regulation, or the Attorney General if unregulated by that department.
A violation is a civil violation subject to a fine of not more than $500 per violation, up to a maximum of $2,500 for each day, to equitable relief, or to an order enjoining further violations. The appropriate state regulators within the Department of Professional and Financial Regulation enforce the chapter against persons they license or regulate, and the Attorney General enforces it against all other persons.
The cumulative effect clause, subsection 3 of section 1349, provides that the rights and remedies available under the section are cumulative and do not affect or prevent rights and remedies available under federal or state law. The section's own history note dates enactment to PL 2005, c. 379, sec. 1, amended by PL 2005, c. 583, PL 2009, c. 161, and PL 2019, c. 512. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .