Part 3: REGULATION OF TRADE
Chapter 210-B: NOTICE OF RISK TO PERSONAL DATA
1. Notification to residents. The following provisions apply to notification to residents by information brokers and other persons.
A. If an information broker that maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the information broker shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State whose personal information has been, or is reasonably believed to have been, acquired by an unauthorized person. [2005, c. 583, §14 (AFF); 2005, c. 583, §6 (NEW).]
B. If any other person who maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the person shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State if misuse of the personal information has occurred or if it is reasonably possible that misuse will occur. [2005, c. 583, §14 (AFF); 2005, c. 583, §6 (NEW).]
The notices required under paragraphs A and B must be made as expediently as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement pursuant to subsection 3 or with measures necessary to determine the scope of the security breach and restore the reasonable integrity, security and confidentiality of the data in the system.
[ 2005, c. 583, §14 (AFF); 2005, c. 583, §6 (RPR) .]
2. Notification to person maintaining personal information. A 3rd-party entity that maintains, on behalf of a person, computerized data that includes personal information that the 3rd-party entity does not own shall notify the person maintaining personal information of a breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
[ 2005, c. 583, §14 (AFF); 2005, c. 583, §7 (AMD) .]
3. Delay of notification; criminal investigation by law enforcement. If, after the completion of an investigation required by subsection 1, notification is required under this section, the notification required by this section may be delayed for no longer than 7 business days after a law enforcement agency determines that the notification will not compromise a criminal investigation.
[ 2009, c. 161, §3 (AMD); 2009, c. 161, §5 (AFF) .]
4. Notification to consumer reporting agencies. If a person discovers a breach of the security of the system that requires notification to more than 1,000 persons at a single time, the person shall also notify, without unreasonable delay, consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 United States Code, Section 1681a(p). Notification must include the date of the breach, an estimate of the number of persons affected by the breach, if known, and the actual or anticipated date that persons were or will be notified of the breach.
[ 2005, c. 583, §14 (AFF); 2005, c. 583, §8 (AMD) .]
5. Notification to state regulators. When notice of a breach of the security of the system is required under subsection 1, the person shall notify the appropriate state regulators within the Department of Professional and Financial Regulation, or if the person is not regulated by the department, the Attorney General.
[ 2005, c. 583, §14 (AFF); 2005, c. 583, §9 (AMD) .]
SECTION HISTORY
2005, c. 379, §1 (NEW). 2005, c. 379, §4 (AFF). 2005, c. 583, §§6-9 (AMD). 2005, c. 583, §14 (AFF). 2009, c. 161, §3 (AMD). 2009, c. 161, §5 (AFF).
Source: http://www.mainelegislature.org/legis/statutes/10/title10sec1348.html
DATA/PRIVACY BREACH. A MATTER OF WHEN – NOT IF
One of the fastest growing claim areas in our industry is loss from data/privacy breach. Perpetrators of hacking, mal-ware, phishing, spyware, etc. began by targeting larger companies with their attacks. Nationwide Insurance had an attack that affected 1.1 million customers! The larger companies had the resources to fight back with stronger software and firewalls. Now the attacks are being directed toward smaller businesses that have fewer resources to purchase the stronger security.
- It is estimated that over 20% of small businesses have suffered a data breach
- Number of attacks are rising while breach size is declining
- Malicious attacks (hacking or inside theft) constitute 40% of recorded breaches in 2011
- Visa reports 80% of all card breaches arise from merchants with fewer then 50 employees
- The average cost to the business per compromised document is $214.00 (Some of the direct costs are defense, notification, credit monitoring, and regulatory fees.)
In 2005, Maine passed L.D. 2017 and H.P. 1417 “An Act to Amend the Notice of Risk to Personal Data.” This act states that if an information broker (business that has personal information of its clients) becomes aware of a breach of their security system after an investigation (forensic consultant) they MUST notify ALL customers, in this State, of this breach within 7 business days.
Depending on how many customers the business has this could result in huge costs to the business. One small 3 person service firm paid out over $20,000 in notification and investigation costs alone!
This type of loss is not covered unless specifically endorsed on the business’ package policy or written as a separate policy. While once very expensive, the cost for this coverage has come down considerably over the last few years.
Our renewal advisory letters will now offer this coverage as an option; but if your renewal is not coming right up, we encourage you to call us to discuss. Don’t let this type of loss sneak up on you and potentially cripple your business.