Vote Smart's Synopsis:

Vote to recede and concur with Senate amendments and pass a bill that expands privacy requirements for online data in Maine.

Highlights:

• Exempts certain entities from the provisions of this Act, including (Sec. 1):

• State agencies;

• Tax exempt 501(c) entities;

• Institutions of higher education;

• A national securities association;

• A supervised financial organization or a service corporation;

• A health care facility, practitioner, or affiliate; and

• An internet service provider.

• Exempts certain data from the provisions of this Act, including (Sec. 1):

• Nonpublic personal information regulated under the Gramm-Leach-Bliley Act;

• Protected health information;

• Patient-identifying information;

• Identifiable private information used for the protection of human subjects in research;

• Personal data used or shared in research;

• Certain information related to health care quality improvement;

• Information used for public health activities and purposes;

• Information related to an individual’s creditworthiness; and

• Other information collected under certain federal acts.

• Requires businesses to limit the collection and processing of personal data to what is reasonably necessary to provide or maintain a specific product or service requested by the consumer (Sec. 1).

• Specifies that “sensitive data” includes the following (Sec. 1):

• Race or ethnicity;

• Religious beliefs;

• Mental or physical health conditions;

• Sexual orientation and gender identity;

• Citizenship or immigration status;

• Genetic or biometric data;

• Precise geolocation data;

• Social security, driver’s license, or other identification card numbers;

• Financial or account access information;

• Data of a minor under 18 years of age; or

• Data concerning a consumer’s status as the victim of a crime.

• Establishes that consumers have the right to know whether a business is controlling and processing their data, correct inaccuracies in their personal data, require the controller to delete portions of their data, and obtain a copy of their stored data as well as a list of any 3rd party to which the data has been sold (Sec. 1).

• Prohibits a business from selling a consumer’s sensitive data, processing the data of a minor, or retaliating against any consumer who exercises a right granted under this Act (Sec. 1).

• Prohibits any individual from establishing a geofence within 1,750 feet of any in-person health care facility (Sec. 1).

• Authorizes the Attorney General to enforce this Act, and to provide a potential defendant with a notice of violation at least 60 days prior to enforcement for a violation that occurs prior to April 2, 2027 (Sec. 1).

• Specifies that this Act takes effect July 1, 2026 (Sec. 3).

Full Bill Text

Vote Smart's Synopsis:

Vote to pass a bill in nonconcurrence with House amendments that expands privacy requirements for online data in Maine.

Highlights:

• Exempts certain entities from the provisions of this Act, including (Sec. 1):

• State agencies;

• Tax exempt 501(c) entities;

• Institutions of higher education;

• A national securities association;

• A supervised financial organization or a service corporation;

• A health care facility, practitioner, or affiliate; and

• An internet service provider.

• Exempts certain data from the provisions of this Act, including (Sec. 1):

• Nonpublic personal information regulated under the Gramm-Leach-Bliley Act;

• Protected health information;

• Patient-identifying information;

• Identifiable private information used for the protection of human subjects in research;

• Personal data used or shared in research;

• Certain information related to health care quality improvement;

• Information used for public health activities and purposes;

• Information related to an individual’s creditworthiness; and

• Other information collected under certain federal acts.

• Requires businesses to limit the collection and processing of personal data to what is reasonably necessary to provide or maintain a specific product or service requested by the consumer (Sec. 1).

• Specifies that “sensitive data” includes the following (Sec. 1):

• Race or ethnicity;

• Religious beliefs;

• Mental or physical health conditions;

• Sexual orientation and gender identity;

• Citizenship or immigration status;

• Genetic or biometric data;

• Precise geolocation data;

• Social security, driver’s license, or other identification card numbers;

• Financial or account access information;

• Data of a minor under 18 years of age; or

• Data concerning a consumer’s status as the victim of a crime.

• Establishes that consumers have the right to know whether a business is controlling and processing their data, correct inaccuracies in their personal data, require the controller to delete portions of their data, and obtain a copy of their stored data as well as a list of any 3rd party to which the data has been sold (Sec. 1).

• Prohibits a business from selling a consumer’s sensitive data, processing the data of a minor, or retaliating against any consumer who exercises a right granted under this Act (Sec. 1).

• Prohibits any individual from establishing a geofence within 1,750 feet of any in-person health care facility (Sec. 1).

• Authorizes the Attorney General to enforce this Act, and to provide a potential defendant with a notice of violation at least 60 days prior to enforcement for a violation that occurs prior to April 2, 2027 (Sec. 1).

• Specifies that this Act takes effect July 1, 2026 (Sec. 3).

Full Bill Text