On May 18, 2023, Legislative Document 1973 for An Act to Enact the Maine Consumer Privacy Act was ordered to the Maine Senate.

Scope

The bill would apply to persons that conduct business in Maine or that produce products or services that are targeted to Maine residents, and that during the preceding calendar year:

• controlled or processed the personal data of not less than 100,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
• controlled or processed the personal data of not less than 25,000 consumers and derived more than 25% of gross revenue from the sale of personal data.

Consumer rights

The bill would entitle consumers to:

• confirm whether or not a controller is processing their personal data and to access that personal data, unless confirmation or access would require the controller to reveal a trade secret;
• correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes of the processing of their personal data;
• have personal data provided by or obtained about them deleted; and
• obtain a copy of their personal data which has been processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows them to transmit the data to another controller without hindrance, when the processing is carried out by automated means, as long as the controller is not required to reveal a trade secret.

Controller obligations

Lastly, the bill imposes several obligations on controllers, including:

• to limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed, as disclosed to the consumer;
• to establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data;
• in the case of the processing of sensitive data concerning a child, to process the data in accordance with the federal Children's Online Privacy Protection Act (COPPA), and the regulations, rules, guidance, and exemptions adopted pursuant to COPPA; and
• to provide an effective mechanism for a consumer to revoke the consumer's consent that is at least as easy as the mechanism by which the consumer provided the consumer's consent and, upon revocation of the consent, cease to process the data as soon as practicable, but not later than 45 days after the receipt of the request.

You can read the bill here and track its progress here.

Update: May 30, 2023

Bill for the Maine Consumer Privacy Act referred to Judiciary Committee

On May 25, 2023, the bill was referred to the Judiciary Committee of the Maine House of Representatives.

You can read the bill here and track its progress here.

Update: August 1, 2023

Bill for the Maine Consumer Privacy Act carried over to subsequent session by Senate

On July 26, 2023, the bill was carried over by the Senate, in the same posture, to any special or regular session of the 131st Legislature.

You can read the bill here and track its progress here.

Update: April 17, 2024

Bill received divided report from Judiciary Committee 

On April 16, 2024, the bill was reported back to the House after receiving a divided report on March 26, 2024, after the work sessions of the Judiciary Committee. The divided report shows that the bill received a majority vote not to pass, although some Committee members voted that the bill should pass with amendments.  

You can read the bill and track its progress here. 

Update: April 18, 2024

Bill dies in House

On April 17, 2024, the bill died in the House. 

You can read the bill and view its legislative history here.