Data Breach Notice to Residents and State Authorities in Maine
At a glance
| Covered entity and service provider | Information broker or other person maintaining computerized PI investigates/possibly tells residents; third-party nonowner holder tells the person maintaining PI immediately after discovering unauthorized acquisition (§§ 1347(3), 1348(1)-(2)) |
|---|---|
| Breach and covered information | Unauthorized acquisition, release OR use of computerized PI compromising security/confidentiality/integrity; name plus SSN, state ID, usable financial number or access code; certain standalone elements count (§ 1347(1),(6)-(7)) |
| Risk screen or notice exception | Good-faith prompt misuse investigation; broker tells acquired/reasonably-believed-acquired residents without separate misuse condition; other person tells if misuse occurred or reasonably possible; good-faith employee activity excluded if no further misuse/disclosure (§§ 1347(1), 1348(1)) |
| Individuals who receive notice | ME resident whose PI unauthorized person acquired or likely acquired (broker); ME resident when misuse occurred or reasonably possible (other holder); nonowner third party tells person maintaining PI (§ 1348(1)-(2)) |
| Individual notice deadline and clock | Expeditiously without unreasonable delay; absent law-enforcement delay, no more than 30 days after holder becomes aware of breach AND identifies scope; third party immediately after discovery (§ 1348(1)-(3)) |
| Regulator threshold and deadline | Whenever resident notice under § 1348(1) required, tell appropriate Department of Professional and Financial Regulation regulator, or AG if not department-regulated; no separate fixed regulator day count (§ 1348(5)) |
| Consumer-reporting-agency notice | If required to notify >1,000 persons at one time, tell nationwide consumer-reporting agencies without unreasonable delay; include breach date, affected estimate if known, and actual/anticipated individual-notice date (§ 1348(4)) |
| Individual delivery and content | Written or qualifying federal E-SIGN electronic notice; eligible substitute route. §§ 1347(4), 1348 state no general list of required incident-letter contents (§§ 1347(4), 1348(1)) |
| Substitute notice conditions and channels | Cost >$5,000, class >1,000, or insufficient contact information; use available email, publicly accessible website posting if maintained, AND major statewide media (§ 1347(4)(C)) |
| Delays and alternate compliance | Law-enforcement criminal-investigation delay; once agency determines no compromise, notify within 7 business days. Federal/state breach procedure route qualifies if at least as protective as § 1348 (§§ 1348(3), 1349(4)) |
Requirements one by one
Who investigates and who receives notice
Under 10 M.R.S. § 1348(1), an information broker and another person maintaining computerized personal information both investigate promptly and in good faith. The broker tells a Maine resident whose information an unauthorized person acquired or is reasonably believed to have acquired; the broker's notice clause has no separate misuse condition. For other holders, notice turns on whether misuse occurred or is reasonably possible.
A third-party entity that maintains another person's information has a separate duty under § 1348(2): it tells the person maintaining that information immediately after discovering a breach if unauthorized acquisition occurred or is reasonably believed to have occurred.
Timing and additional recipients
The resident notices must go out as expediently as possible and without unreasonable delay. If there is no law-enforcement delay, § 1348(1) adds an outside limit of 30 days after the person becomes aware of the breach and identifies its scope. Those are the statute's two stated conditions for the clock, not a 30-day period measured from discovery alone.
Whenever resident notice is required under § 1348(1), the holder also notifies its appropriate Department of Professional and Financial Regulation regulator, or the Attorney General if the department does not regulate it (§ 1348(5)). No separate fixed day count is stated for that authority notice.
If notice is required to more than 1,000 persons at one time, § 1348(4) additionally requires nationwide consumer-reporting-agency notice without unreasonable delay. It includes the breach date, estimated affected-person count if known, and actual or anticipated resident-notice date.
Delivery and delay
Section 1347(4) defines notice as writing, qualifying electronic notice under the federal E-SIGN rule, or an eligible substitute. It does not supply a separate list of incident-letter contents. Substitute notice is available if direct notice would cost more than $5,000, the affected class exceeds 1,000, or contact information is insufficient. The entity combines available email, a publicly accessible website posting if it has a site, and major statewide media.
After the required investigation, a criminal-investigation delay under § 1348(3) ends no later than seven business days after law enforcement determines notice will not compromise the investigation. Section 1349(4) also recognizes a qualifying federal or state breach-notification procedure if its protection is at least as strong as § 1348.
What trips people up
The covered data can stand alone. Section 1347(6)(E) includes some listed identifiers even without a name if compromise would suffice for fraudulent identity assumption or attempted assumption. The definition also excludes certain insurer claims databases and public government or widely distributed media information.
Acquisition is not the only breach verb. Section 1347(1) also says unauthorized release or use of computerized personal information can be a security breach.
Common questions
Does an information broker wait for evidence that misuse is possible?
It must investigate likelihood, but § 1348(1)(A) bases the broker's resident notice on acquisition or reasonable belief of acquisition; the separate misuse condition appears in paragraph B for other holders.
Is every third-party holder required to notify residents directly?
Section 1348(2) directs the nonowner third party to notify the person maintaining the information immediately after qualifying discovery. Section 1348(1) separately governs resident notice by brokers and other persons maintaining the information.
Can an affected class of exactly 1,000 use the population substitute route?
The threshold in § 1347(4)(C) is an affected class that exceeds 1,000; other substitute triggers may still apply.
Statutes and sources
- 10 M.R.S. § 1347 — definitions, covered information, and notice methods.
- 10 M.R.S. § 1348 — resident, third-party, authority, and credit-bureau notice.
- 10 M.R.S. § 1349 — alternate federal or state compliance route.
Current official Maine statutes checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Maine law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Maine law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace