Text of MD HB 567 (2024)

EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW. [Brackets] indicate matter deleted from existing law. *hb0567* HOUSE BILL 567 I3 4lr1198 CF SB 541 By: Delegates Love, Valderrama, Boafo, Charkoudian, Feldmark, Fraser–Hidalgo, Hill, Kaiser, Kaufman, Lehman, Palakovich Carr, Pena–Melnyk, Shetty, Solomon, Stewart, Taveras, Watson, and Ziegler Introduced and read first time: January 24, 2024 Assigned to: Economic Matters A BILL ENTITLED AN ACT concerning 1 Maryland Online Data Privacy Act of 2024 2 FOR the purpose of regulating the manner in which a controller or a processor in possession 3 of a consumer’s personal data may process the consumer’s personal data; authorizing 4 a consumer to exercise certain rights in regards to the consumer’s personal data; 5 requiring a controller of personal data to establish a method for a consumer to 6 exercise certain rights in regards to the consumer’s personal data; requiring a 7 controller to comply with a request by a consumer to exercise a certain right in a 8 certain manner, except under certain circumstances; authorizing a consumer to 9 designate an authorized agent to act on the consumer’s behalf to opt out of the 10 processing of the consumer’s personal data; requiring a controller to provide a 11 consumer with a certain privacy notice; requiring a controller that uses a processor 12 to process the personal data of consumers to enter into a contract with the processor 13 that governs the processor’s data processing procedures; requiring a controller to 14 conduct and document a data protection assessment for consumer data processing 15 activities that present a heightened risk of harm to a consumer; making a violation 16 of this Act an unfair, abusive, or deceptive trade practice that is subject to 17 enforcement and penalties under the Maryland Consumer Protection Act; and 18 generally relating to online data privacy. 19 BY repealing and reenacting, with amendments, 20 Article – Commercial Law 21 Section 13–301(14)(xl) 22 Annotated Code of Maryland 23 (2013 Replacement Volume and 2023 Supplement) 24 BY repealing and reenacting, without amendments, 25 Article – Commercial Law 26 Section 13–301(14)(xli) 27 2 HOUSE BILL 567 Annotated Code of Maryland 1 (2013 Replacement Volume and 2023 Supplement) 2 BY adding to 3 Article – Commercial Law 4 Section 13–301(14)(xlii); and 14–4601 through 14–4613 to be under the new subtitle 5 “Subtitle 46. Online Data Privacy Act” 6 Annotated Code of Maryland 7 (2013 Replacement Volume and 2023 Supplement) 8 SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 9 That the Laws of Maryland read as follows: 10 Article – Commercial Law 11 13–301. 12 Unfair, abusive, or deceptive trade practices include any: 13 (14) Violation of a provision of: 14 (xl) Title 14, Subtitle 13 of the Public Safety Article; [or] 15 (xli) Title 14, Subtitle 45 of this article; or 16 (XLII) TITLE 14, SUBTITLE 46 OF THIS ARTICLE; OR 17 SUBTITLE 46. ONLINE DATA PRIVACY ACT. 18 14–4601. 19 (A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS 20 INDICATED. 21 (B) “AFFILIATE” MEANS A PERSON THAT: 22 (1) SHARES COMMON BRANDING WITH ANOTHER PERSON; OR 23 (2) CONTROLS, IS CONTROLLED BY, OR IS UNDER COMMON CONTROL 24 WITH ANOTHER PERSON. 25 (C) “AUTHENTICATE” MEANS TO USE REASONABLE MEANS TO DETERMINE 26 THAT A REQUEST TO EXERCISE A CONSUMER RIGHT IN ACCORDANCE WITH § 14-4605 27 OF THIS SUBTITLE IS BEING MADE BY, OR ON BEHALF OF, A CONSUMER WHO IS 28 HOUSE BILL 567 3 ENTITLED TO EXERCISE THE CONSUMER RIGHT WITH RESPECT TO THE PERSONAL 1 DATA AT ISSUE. 2 (D) (1) “BIOMETRIC DATA” MEANS DATA GENERATED BY AUTOMATIC 3 MEASUREMENTS OF THE BIOLOGICAL CHARACTERISTICS OF A CONSUMER THAT CAN 4 BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY. 5 (2) “BIOMETRIC DATA” INCLUDES: 6 (I) A FINGERPRINT; 7 (II) A VOICE PRINT; 8 (III) AN EYE RETINA OR IRIS IMAGE; AND 9 (IV) ANY OTHER UNIQUE BIOLOGICAL CHARACTERISTICS THAT 10 CAN BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY. 11 (3) “BIOMETRIC DATA” DOES NOT INCLUDE: 12 (I) A DIGITAL OR PHYSICAL PHOTOGRAPH; 13 (II) AN AUDIO OR VIDEO RECORDING; OR 14 (III) ANY DATA GENERATED FROM A DIGITAL OR PHYSICAL 15 PHOTOGRAPH OR AN AUDIO OR VIDEO RECORDING, UNLESS THE DATA IS 16 GENERATED TO IDENTIFY A SPECIFIC CONSUMER. 17 (E) “BUSINESS ASSOCIATE” HAS THE MEANING STATED IN HIPAA. 18 (F) “CHILD” HAS THE MEANING STATED IN COPPA. 19 (G) (1) “CONSENT” MEANS A CLEAR AFFIRMATIVE ACT SIGNIFYING A 20 CONSUMER’S FREELY GIVEN, SPECIFIC, INFORMED, AND UNAMBIGUOUS 21 AGREEMENT TO ALLOW THE PROCESSING OF PERSONAL DATA RELATING TO THE 22 CONSUMER FOR A PARTICULAR PURPOSE. 23 (2) “CONSENT” INCLUDES: 24 (I) A WRITTEN STATEMENT; 25 (II) A WRITTEN STATEMENT BY ELECTRONIC MEANS; OR 26 4 HOUSE BILL 567 (III) ANY OTHER UNAMBIGUOUS AFFIRMATIVE ACTION. 1 (3) “CONSENT” DOES NOT INCLUDE: 2 (I) ACCEPTANCE OF A GENERAL OR BROAD TERMS OF USE OR 3 SIMILAR DOCUMENT THAT CONTAINS DESCRIPTIONS OF PERSONAL DATA 4 PROCESSING ALONG WITH OTHER UNRELATED INFORMATION; 5 (II) HOVERING OVER, MUTING, PAUSING, OR CLOSING A PIECE 6 OF CONTENT; OR 7 (III) AGREEMENT OBTAINED THROUGH THE USE OF DARK 8 PATTERNS. 9 (H) (1) “CONSUMER” MEANS AN INDIVIDUAL WHO IS A RESIDENT OF THE 10 STATE. 11 (2) “CONSUMER” DOES NOT INCLUDE: 12 (I) AN INDIVIDUAL ACTING IN A COMMERCIAL OR 13 EMPLOYMENT CONTEXT; OR 14 (II) AN INDIVIDUAL ACTING AS AN EMPLOYEE, AN OWNER, A 15 DIRECTOR, AN OFFICER, OR A CONTRACTOR OF A COMPANY, A PARTNERSHIP, A SOLE 16 PROPRIETORSHIP, A NONPROFIT ORGANIZATION, OR A GOVERNMENT UNIT WHOSE 17 COMMUNICATIONS OR TRANSACTIONS WITH A CONTROLLER OCCUR ONLY WITHIN 18 THE CONTEXT OF THE INDIVIDUAL’S ROLE WITH THE COMPANY, PARTNERSHIP, 19 SOLE PROPRIETORSHIP, NONPROFIT ORGANIZATION, OR GOVERNMENT UNIT. 20 (I) (1) “CONSUMER HEALTH DATA” MEANS PERSONAL DATA THAT A 21 CONTROLLER USES TO IDENTIFY A CONSUMER’S PHYSICAL OR MENTAL HEALTH 22 STATUS. 23 (2) “CONSUMER HEALTH DATA” INCLUDES DATA RELATED TO: 24 (I) GENDER–AFFIRMING CARE; OR 25 (II) REPRODUCTIVE OR SEXUAL HEALTH CARE. 26 (J) “CONTROL” MEANS: 27 (1) OWNERSHIP OF OR THE POWER TO VOTE MORE THAN 50% OF THE 28 OUTSTANDING SHARES OF ANY CLASS OF VOTING SECURITY OF A BUSINESS; 29 HOUSE BILL 567 5 (2) ANY MANNER OF CONTROL OVER THE ELECTION OF A MAJORITY 1 OF THE DIRECTORS OF A BUSINESS, OR INDIVIDUALS EXERCISING SIMILAR 2 FUNCTIONS; OR 3 (3) THE POWER TO EXERCISE A CONTROLLING INFLUENCE OVER THE 4 MANAGEMENT OF A BUSINESS. 5 (K) “CONTROLLER” MEANS A PERSON THAT, ALONE OR JOINTLY WITH 6 OTHERS, DETERMINES THE PURPOSE AND MEANS OF PROCESSING PERSONAL DATA. 7 (L) (1) “COPPA” MEANS THE FEDERAL CHILDREN’S ONLINE PRIVACY 8 PROTECTION ACT OF 1998. 9 (2) “COPPA” INCLUDES REGULATIONS ADOPTED UNDER THE 10 FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT OF 1998. 11 (M) “COVERED ENTITY” HAS THE MEANING STATED IN HIPAA. 12 (N) (1) “DARK PATTERN” MEANS A USER INTERFACE DESIGNED OR 13 MANIPULATED WITH THE SUBSTANTIAL EFFECT OF SUBVERTING USER AUTONOMY, 14 DECISION MAKING, OR CHOICE. 15 (2) “DARK PATTERN” INCLUDES ANY PRACTICE THE FEDERAL 16 TRADE COMMISSION REFERS TO AS A “DARK PATTERN”. 17 (O) “DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT 18 EFFECTS CONCERNING THE CONSUMER” MEANS DECISIONS THAT RESULT IN THE 19 PROVISION OR DENIAL OF: 20 (1) FINANCIAL OR LENDING SERVICES; 21 (2) HOUSING; 22 (3) INSURANCE; 23 (4) EDUCATION ENROLLMENT OR OPPORTUNITY; 24 (5) CRIMINAL JUSTICE; 25 (6) EMPLOYMENT OPPORTUNITIES; 26 (7) HEALTH CARE SERVICES; OR 27 6 HOUSE BILL 567 (8) ACCESS TO ESSENTIAL GOODS OR SERVICES. 1 (P) “DE–IDENTIFIED DATA” MEANS DATA THAT CANNOT REASONABLY BE 2 USED TO INFER INFORMATION ABOUT OR OTHERWISE BE LINKED TO AN IDENTIFIED 3 OR IDENTIFIABLE CONSUMER, OR A DEVICE THAT MAY BE LINKED TO AN IDENTIFIED 4 OR IDENTIFIABLE CONSUMER, IF THE CONTROLLER THAT POSSESSES THAT 5 INFORMATION: 6 (1) TAKES REASONABLE MEASURES TO ENSURE THAT THE 7 INFORMATION CANNOT BE LINKED WITH A CONSUMER; 8 (2) COMMITS IN PUBLICLY AVAILABLE TERMS AND CONDITIONS OR IN 9 A PUBLICLY AVAILABLE PRIVACY POLICY TO MAINTAIN AND USE THE INFORMATION 10 IN DE–IDENTIFIED FORM; AND 11 (3) CONTRACTUALLY OBLIGES ANY RECIPIENTS OF THE 12 INFORMATION TO COMPLY WITH ALL PROVISIONS OF THIS SUBSECTION. 13 (Q) (1) “GENETIC DATA” MEANS DATA IN ANY FORMAT THAT CONCERNS 14 THE GENETIC CHARACTERISTICS OF A CONSUMER. 15 (2) “GENETIC DATA” INCLUDES: 16 (I) RAW SEQUENCE DATA THAT RESULTS FROM SEQUENCING 17 OF A CONSUMER’S COMPLETE EXTRACTED DNA OR A PORTION OF THE CONSUMER’S 18 COMPLETE EXTRACTED DNA; 19 (II) GENOTYPIC AND PHENOTYPIC INFORMATION THAT 20 RESULTS FROM ANALYZING RAW SEQUENCE DATA; 21 (III) INFORMATION EXTRAPOLATED, DERIVED, OR INFERRED 22 FROM THE ANALYSIS OF RAW SEQUENCE DATA; AND 23 (IV) SELF–REPORTED HEALTH INFORMATION SUBMITTED TO A 24 DIRECT–TO–CONSUMER GENETIC TESTING COMPANY BY A CONSUMER REGARDING 25 THE CONSUMER’S HEALTH CONDITIONS: 26 1. THAT IS USED FOR SCIENTIFIC RESEARCH OR 27 PRODUCT DEVELOPMENT; AND 28 2. ANALYZED IN CONNECTION WITH THE CONSUMER’S 29 RAW SEQUENCE DATA. 30 HOUSE BILL 567 7 (R) (1) “GEOFENCE” MEANS TECHNOLOGY THAT ESTABLISHES A 1 VIRTUAL GEOGRAPHICAL BOUNDARY. 2 (2) “GEOFENCE” INCLUDES BOUNDARIES THAT ARE ESTABLISHED 3 OR MONITORED THROUGH THE USE OF: 4 (I) GLOBAL POSITIONING TECHNOLOGY; 5 (II) CELL TOWER CONNECTIVITY; 6 (III) CELLULAR DATA; 7 (IV) RADIO FREQUENCY IDENTIFICATION; 8 (V) WIRELESS FIDELITY TECHNOLOGY; OR 9 (VI) ANY OTHER FORM OF LOCATION DETERMINATION 10 TECHNOLOGY. 11 (S) “HIPAA” MEANS THE FEDERAL HEALTH INSURANCE PORTABILITY 12 AND ACCOUNTABILITY ACT OF 1996. 13 (T) “IDENTIFIED OR IDENTIFIABLE CONSUMER” MEANS A CONSUMER WHO 14 CAN READILY BE IDENTIFIED, EITHER DIRECTLY OR INDIRECTLY. 15 (U) “MENTAL HEALTH FACILITY” MEANS A HEALTH CARE FACILITY IN 16 WHICH NOT LESS THAN 70% OF HEALTH CARE SERVICES OFFERED ARE MENTAL 17 HEALTH SERVICES. 18 (V) (1) “PERSONAL DATA” MEANS ANY INFORMATION THAT IS LINKED OR 19 CAN BE REASONABLY LINKED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER. 20 (2) “PERSONAL DATA” DOES NOT INCLUDE: 21 (I) DE–IDENTIFIED DATA; OR 22 (II) PUBLICLY AVAILABLE INFORMATION. 23 (W) (1) “PRECISE GEOLOCATION DATA” MEANS INFORMATION DERIVED 24 FROM TECHNOLOGY THAT CAN PRECISELY AND ACCURATELY IDENTIFY THE 25 SPECIFIC LOCATION OF A CONSUMER WITHIN A RADIUS OF 1,750 FEET. 26 8 HOUSE BILL 567 (2) “PRECISE GEOLOCATION DATA” INCLUDES GLOBAL POSITIONING 1 SYSTEM LEVEL LATITUDE AND LONGITUDE COORDINATES OR OTHER SIMILAR 2 MECHANISMS. 3 (3) “PRECISE GEOLOCATION DATA” DOES NOT INCLUDE: 4 (I) THE CONTENT OF COMMUNICATIONS DATA GENERATED BY 5 OR CONNECTED TO AN ADVANCED UTILITY METERING INFRASTRUCTURE SYSTEM; 6 OR 7 (II) EQUIPMENT USED BY A UTILITY COMPANY. 8 (X) (1) “PROCESS” MEANS AN OPERATION OR SET OF OPERATIONS 9 PERFORMED BY MANUAL OR AUTOMATED MEANS ON PERSONAL DATA. 10 (2) “PROCESS” INCLUDES COLLECTING, USING, STORING, 11 DISCLOSING, ANALYZING, DELETING, OR MODIFYING PERSONAL DATA. 12 (Y) “PROCESSOR” MEANS A PERSON THAT PROCESSES PERSONAL DATA ON 13 BEHALF OF A CONTROLLER. 14 (Z) “PROFILING” MEANS ANY FORM OF AUTOMATED PROCESSING 15 PERFORMED ON PERSONAL DATA TO EVALUATE, ANALYZE, OR PREDICT PERSONAL 16 ASPECTS RELATED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER’S ECONOMIC 17 SITUATION, HEALTH, DEMOGRAPHIC CHARACTERISTICS, PERSONAL PREFERENCES, 18 INTERESTS, RELIABILITY, BEHAVIOR, LOCATION, OR MOVEMENTS. 19 (AA) “PROTECTED HEALTH INFORMATION” HAS THE MEANING STATED IN 20 HIPAA. 21 (BB) (1) “PUBLICLY AVAILABLE INFORMATION” MEANS INFORMATION 22 THAT: 23 (I) IS LAWFULLY MADE READILY AVAILABLE TO THE GENERAL 24 PUBLIC THROUGH FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS; OR 25 (II) A CONTROLLER HAS A REASONABLE BASIS TO BELIEVE 26 THAT A CONSUMER HAS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC 27 THROUGH WIDELY DISTRIBUTED MEDIA. 28 (2) “PUBLICLY AVAILABLE INFORMATION” DOES NOT INCLUDE 29 BIOMETRIC DATA COLLECTED BY A BUSINESS ABOUT A CONSUMER WITHOUT THE 30 CONSUMER’S KNOWLEDGE. 31 HOUSE BILL 567 9 (CC) (1) “REPRODUCTIVE OR SEXUAL HEALTH CARE” MEANS CARE 1 RELATED TO A CONSUMER’S REPRODUCTIVE SYSTEM OR SEXUAL WELL–BEING. 2 (2) “REPRODUCTIVE OR SEXUAL HEALTH CARE” INCLUDES: 3 (I) A SERVICE OR PRODUCT PROVIDED RELATED TO AN 4 INDIVIDUAL HEALTH CONDITION, STATUS, DISEASE, DIAGNOSIS, TEST, OR 5 TREATMENT; 6 (II) A SOCIAL, PSYCHOLOGICAL, BEHAVIORAL, OR MEDICAL 7 INTERVENTION; 8 (III) A SURGERY OR PROCEDURE; 9 (IV) THE PURCHASE OR USE OF A MEDICATION; 10 (V) A SERVICE OR PRODUCT RELATED TO A BODILY FUNCTION, 11 VITAL SIGN, OR MEASUREMENT THEREOF; 12 (VI) AN ABORTION, WHETHER SURGICAL OR MEDICAL; AND 13 (VII) A SERVICE RELATED TO AN ABORTION. 14 (DD) “REPRODUCTIVE OR SEXUAL HEALTH FACILITY” MEANS A HEALTH 15 CARE FACILITY WHERE NOT LESS THAN 70% OF SERVICES OFFERED ARE 16 REPRODUCTIVE OR SEXUAL HEALTH CARE SERVICES. 17 (EE) (1) “SALE OF PERSONAL DATA” MEANS THE EXCHANGE OF PERSONAL 18 DATA BY A CONTROLLER TO A THIRD PARTY FOR MONETARY OR OTHER VALUABLE 19 CONSIDERATION. 20 (2) “SALE OF PERSONAL DATA” DOES NOT INCLUDE: 21 (I) THE DISCLOSURE OF PERSONAL DATA TO A PROCESSOR 22 THAT PROCESSES PERSONAL DATA ON BEHALF OF A CONTROLLER IF LIMITED TO 23 THE PURPOSES OF THE PROCESSING; 24 (II) THE DISCLOSURE OF PERSONAL DATA TO A THIRD PARTY 25 FOR PURPOSES OF PROVIDING A PRODUCT OR SERVICE AFFIRMATIVELY 26 REQUESTED BY THE CONSUMER; 27 10 HOUSE BILL 567 (III) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO AN 1 AFFILIATE OF THE CONTROLLER FOR THE PURPOSE OF PROVIDING A PRODUCT OR 2 SERVICE AFFIRMATIVELY REQUESTED BY THE CONSUMER; 3 (IV) THE DISCLOSURE OF PERSONAL DATA WHERE THE 4 CONSUMER: 5 1. DIRECTS THE CONTROLLER TO DISCLOSE THE 6 PERSONAL DATA; OR 7 2. INTENTIONALLY USES THE CONTROLLER TO 8 INTERACT WITH A THIRD PARTY; 9 (V) THE DISCLOSURE OF PERSONAL DATA THAT THE 10 CONSUMER: 11 1. INTENTIONALLY MADE AVAILABLE TO THE GENERAL 12 PUBLIC THROUGH A CHANNEL OF MASS MEDIA; AND 13 2. DID NOT RESTRICT TO A SPECIFIC AUDIENCE; OR 14 (VI) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO A 15 THIRD PARTY AS AN ASSET THAT IS PART OF AN ACTUAL OR PROPOSED MERGER, 16 ACQUISITION, BANKRUPTCY, OR OTHER TRANSACTION WHERE THE THIRD PARTY 17 ASSUMES CONTROL OF ALL OR PART OF THE CONTROLLER’S ASSETS. 18 (FF) “SENSITIVE DATA” MEANS PERSONAL DATA THAT INCLUDES: 19 (1) DATA REVEALING: 20 (I) RACIAL OR ETHNIC ORIGIN; 21 (II) RELIGIOUS BELIEFS; 22 (III) CONSUMER HEALTH DATA; 23 (IV) SEX LIFE; 24 (V) SEXUAL ORIENTATION; 25 (VI) STATUS AS TRANSGENDER OR NONBINARY; 26 (VII) NATIONAL ORIGIN; OR 27 HOUSE BILL 567 11 (VIII) CITIZENSHIP OR IMMIGRATION STATUS; 1 (2) GENETIC DATA OR BIOMETRIC DATA; 2 (3) PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER KNOWS 3 OR HAS REASON TO KNOW IS A CHILD; OR 4 (4) PRECISE GEOLOCATION DATA. 5 (GG) (1) “TARGETED ADVERTISING” MEANS DISPLAYING 6 ADVERTISEMENTS TO A CONSUMER OR ON A DEVICE IDENTIFIED BY A UNIQUE 7 IDENTIFIER, WHERE THE ADVERTISEMENT IS SELECTED BASED ON PERSONAL DATA 8 OBTAINED OR INFERRED FROM THE CONSUMER’S ACTIVITIES OVER TIME AND 9 ACROSS WEBSITES OR ONLINE APPLICATIONS THAT ARE UNAFFILIATED WITH EACH 10 OTHER, IN ORDER TO PREDICT THE CONSUMER’S PREFERENCES OR INTERESTS. 11 (2) “TARGETED ADVERTISING” DOES NOT INCLUDE: 12 (I) ADVERTISEMENTS BASED ON THE CONTEXT IN WHICH THE 13 ADVERTISEMENT APPEARS AND DOES NOT VARY BASED ON WHO IS VIEWING THE 14 ADVERTISEMENT; 15 (II) ADVERTISEMENTS BASED ON A CONSUMER’S ACTIVITIES 16 WITHIN A CONTROLLER’S WEBSITES OR ONLINE APPLICATIONS; 17 (III) ADVERTISEMENTS DIRECTED TO A CONSUMER IN 18 RESPONSE TO THE CONSUMER’S REQUEST FOR INFORMATION OR FEEDBACK; OR 19 (IV) PROCESSING PERSONAL DATA SOLELY TO MEASURE OR 20 REPORT ADVERTISING FREQUENCY, PERFORMANCE, OR REACH. 21 (HH) “THIRD PARTY” MEANS A PERSON OTHER THAN THE RELEVANT 22 CONSUMER, CONTROLLER, PROCESSOR, OR AFFILIATE OF THE CONTROLLER OR 23 PROCESSOR OF RELEVANT PERSONAL DATA. 24 (II) (1) “TRADE SECRET” MEANS INFORMATION THAT: 25 (I) DERIVES INDEPENDENT ECONOMIC VALUE, ACTUAL OR 26 POTENTIAL, FROM NOT BEING GENERALLY KNOWN TO, AND NOT BEING READILY 27 ASCERTAINABLE BY PROPER MEANS BY, OTHER PERSONS WHO COULD OBTAIN 28 ECONOMIC VALUE FROM THE INFORMATION’S DISCLOSURE OR USE; AND 29 12 HOUSE BILL 567 (II) IS THE SUBJECT OF EFFORTS THAT ARE REASONABLE 1 UNDER THE CIRCUMSTANCES TO MAINTAIN THE SECRECY OF THE INFORMATION. 2 (2) “TRADE SECRET” INCLUDES A FORMULA, PATTERN, 3 COMPILATION, PROGRAM, DEVICE, METHOD, TECHNIQUE, OR PROCESS. 4 14–4602. 5 THIS SUBTITLE APPLIES TO A PERSON THAT: 6 (1) CONDUCTS BUSINESS IN THE STATE; OR 7 (2) (I) PRODUCES SERVICES OR PRODUCTS THAT ARE TARGETED 8 TO RESIDENTS OF THE STATE; AND 9 (II) DURING THE IMMEDIATELY PRECEDING CALENDAR YEAR: 10 1. CONTROLLED OR PROCESSED THE PERSONAL DATA 11 OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR 12 PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION; 13 OR 14 2. CONTROLLED OR PROCESSED THE PERSONAL DATA 15 OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS 16 REVENUE FROM THE SALE OF PERSONAL DATA. 17 14–4603. 18 (A) THIS SUBTITLE DOES NOT APPLY TO: 19 (1) A REGULATORY, ADMINISTRATIVE, ADVISORY, EXECUTIVE, 20 APPOINTIVE, LEGISLATIVE, OR JUDICIAL BODY OF THE STATE, INCLUDING A BOARD, 21 BUREAU, COMMISSION, OR UNIT OF THE STATE OR A POLITICAL SUBDIVISION OF 22 THE STATE; 23 (2) A NATIONAL SECURITIES ASSOCIATION THAT IS REGISTERED 24 UNDER § 15 OF THE FEDERAL SECURITIES EXCHANGE ACT OF 1934 OR A 25 REGISTERED FUTURES ASSOCIATION DESIGNATED IN ACCORDANCE WITH § 17 OF 26 THE FEDERAL COMMODITY EXCHANGE ACT; OR 27 (3) A FINANCIAL INSTITUTION OR AFFILIATE OF A FINANCIAL 28 INSTITUTION THAT IS SUBJECT TO TITLE V OF THE FEDERAL 29 GRAMM–LEACH–BLILEY ACT AND REGULATIONS ADOPTED UNDER THAT ACT. 30 HOUSE BILL 567 13 (B) THE FOLLOWING INFORMATION AND DATA ARE EXEMPT FROM THIS 1 SUBTITLE: 2 (1) PROTECTED HEALTH INFORMATION UNDER HIPAA; 3 (2) PATIENT–IDENTIFYING INFORMATION FOR PURPOSES OF 42 4 U.S.C. § 290DD–2; 5 (3) IDENTIFIABLE PRIVATE INFORMATION THAT IS USED FOR 6 PURPOSES OF THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS IN 7 ACCORDANCE WITH 45 C.F.R. § 46; 8 (4) IDENTIFIABLE PRIVATE INFORMATION TO THE EXTENT THAT IT IS 9 COLLECTED AND USED AS PART OF HUMAN SUBJECTS RESEARCH IN ACCORDANCE 10 WITH THE ICH 36 GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY THE 11 INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICAL REQUIREMENTS 12 FOR PHARMACEUTICALS FOR HUMAN USE OR THE PROTECTION OF HUMAN 13 SUBJECTS UNDER 21 C.F.R. §§ 50 AND 56; 14 (5) PATIENT SAFETY WORK PRODUCT THAT IS CREATED AND USED 15 FOR PURPOSES OF PATIENT SAFETY IMPROVEMENT IN ACCORDANCE WITH 42 16 C.F.R. § 3, ESTABLISHED IN ACCORDANCE WITH 42 U.S.C. §§ 299B–21 THROUGH 17 299B–26; 18 (6) INFORMATION TO THE EXTENT IT IS USED FOR PUBLIC HEALTH, 19 COMMUNITY HEALTH, OR POPULATION HEALTH ACTIVITIES AND PURPOSES, AS 20 AUTHORIZED BY HIPAA, WHEN PROVIDED BY OR TO A COVERED ENTITY OR WHEN 21 PROVIDED BY OR TO A BUSINESS ASSOCIATE IN ACCORDANCE WITH THE BUSINESS 22 ASSOCIATE AGREEMENT WITH A COVERED ENTITY; 23 (7) THE COLLECTION, MAINTENANCE, DISCLOSURE, SALE, 24 COMMUNICATION, OR USE OF PERSONAL INFORMATION BEARING ON A CONSUMER’S 25 CREDITWORTHINESS, CREDIT STANDING, CREDIT CAPACITY, CHARACTER, GENERAL 26 REPUTATION, PERSONAL CHARACTERISTICS, OR MODE OF LIVING BY A CONSUMER 27 REPORTING AGENCY, FURNISHER, OR USER THAT PROVIDES INFORMATION FOR USE 28 IN A CONSUMER REPORT, AND BY A USER OF A CONSUMER REPORT, BUT ONLY TO 29 THE EXTENT THAT THE ACTIVITY IS REGULATED BY AND AUTHORIZED UNDER THE 30 FEDERAL FAIR CREDIT REPORTING ACT; 31 (8) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED 32 IN COMPLIANCE WITH THE FEDERAL DRIVER’S PRIVACY PROTECTION ACT OF 1994; 33 14 HOUSE BILL 567 (9) PERSONAL DATA REGULATED BY THE FEDERAL FAMILY 1 EDUCATIONAL RIGHTS AND PRIVACY ACT; 2 (10) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED 3 IN COMPLIANCE WITH THE FEDERAL FARM CREDIT ACT; 4 (11) DATA PROCESSED OR MAINTAINED: 5 (I) IN THE COURSE OF AN INDIVIDUAL APPLYING TO, 6 EMPLOYED BY, OR ACTING AS AN AGENT OR INDEPENDENT CONTRACTOR OF A 7 CONTROLLER, PROCESSOR, OR THIRD PARTY, TO THE EXTENT THAT THE DATA IS 8 COLLECTED AND USED WITHIN THE CONTEXT OF THE ROLE; 9 (II) AS THE EMERGENCY CONTACT INFORMATION OF A 10 CONSUMER IF THE DATA IS USED FOR EMERGENCY CONTACT PURPOSES; OR 11 (III) THAT IS: 12 1. NECESSARY TO RETAIN TO ADMINISTER BENEFITS 13 FOR ANOTHER INDIVIDUAL RELATING TO THE CONSUMER WHO IS THE SUBJECT OF 14 THE INFORMATION UNDER ITEM (I) OF THIS ITEM; AND 15 2. USED FOR THE PURPOSES OF ADMINISTERING THE 16 BENEFITS; AND 17 (12) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED 18 IN RELATION TO PRICE, ROUTE, OR SERVICE BY AN AIR CARRIER SUBJECT TO THE 19 FEDERAL AIRLINE DEREGULATION ACT TO THE EXTENT THIS SUBTITLE IS 20 PREEMPTED BY THE FEDERAL AIRLINE DEREGULATION ACT. 21 (C) CONTROLLERS AND PROCESSORS THAT COMPLY WITH THE VERIFIABLE 22 PARENTAL CONSENT REQUIREMENTS OF COPPA SHALL BE CONSIDERED 23 COMPLIANT WITH AN OBLIGATION TO OBTAIN PARENTAL CONSENT IN ACCORDANCE 24 WITH THIS SUBTITLE WITH RESPECT TO A CONSUMER WHO IS A CHILD. 25 14–4604. 26 A PERSON MAY NOT: 27 (1) PROVIDE AN EMPLOYEE OR CONTRACTOR ACCESS TO CONSUMER 28 HEALTH DATA UNLESS THE EMPLOYEE OR CONTRACTOR IS SUBJECT TO A 29 CONTRACTUAL OR STATUTORY DUTY OF CONFIDENTIALITY; 30 HOUSE BILL 567 15 (2) PROVIDE A PROCESSOR ACCESS TO CONSUMER HEALTH DATA 1 UNLESS THE PERSON PROVIDING ACCESS TO THE CONSUMER HEALTH DATA AND 2 THE PROCESSOR COMPLY WITH § 14–4607 OF THIS SUBTITLE; 3 (3) USE A GEOFENCE: 4 (I) TO IDENTIFY, TRACK, COLLECT DATA FROM, OR SEND A 5 NOTIFICATION TO A CONSUMER REGARDING THE CONSUMER’S CONSUMER HEALTH 6 DATA; AND 7 (II) WITHIN 1,750 FEET OF A MENTAL HEALTH FACILITY OR 8 REPRODUCTIVE OR SEXUAL HEALTH FACILITY; OR 9 (4) SELL OR OFFER TO SELL CONSUMER HEALTH DATA WITHOUT THE 10 CONSENT OF THE CONSUMER WHOSE HEALTH DATA IS TO BE SOLD OR OFFERED TO 11 BE SOLD. 12 14–4605. 13 (A) NOTHING IN THIS SECTION MAY BE CONSTRUED TO REQUIRE A 14 CONTROLLER TO REVEAL A TRADE SECRET. 15 (B) A CONSUMER SHALL HAVE THE RIGHT TO: 16 (1) CONFIRM WHETHER A CONTROLLER IS PROCESSING THE 17 CONSUMER’S PERSONAL DATA, UNLESS THAT CONFIRMATION WOULD REQUIRE THE 18 DISCLOSURE OF A TRADE SECRET; 19 (2) IF A CONTROLLER IS PROCESSING A CONSUMER’S PERSONAL 20 DATA, ACCESS THE CONSUMER’S PERSONAL DATA UNLESS THAT ACCESS WOULD 21 REQUIRE THE DISCLOSURE OF A TRADE SECRET; 22 (3) CONSIDERING THE NATURE OF THE CONSUMER’S PERSONAL 23 DATA AND THE PURPOSES OF THE PROCESSING OF THE PERSONAL DATA, CORRECT 24 INACCURACIES IN THE CONSUMER’S PERSONAL DATA; 25 (4) REQUIRE A CONTROLLER TO DELETE PERSONAL DATA PROVIDED 26 BY, OR OBTAINED ABOUT, THE CONSUMER; 27 (5) IF THE PROCESSING OF PERSONAL DATA IS DONE BY AUTOMATIC 28 MEANS, OBTAIN A COPY OF THE CONSUMER’S PERSONAL DATA PROCESSED BY THE 29 CONTROLLER IN A PORTABLE AND, TO THE EXTENT TECHNICALLY FEASIBLE, 30 16 HOUSE BILL 567 READILY USABLE FORMAT THAT ALLOWS THE CONSUMER TO EASILY TRANSMIT THE 1 DATA TO ANOTHER CONTROLLER WITHOUT HINDRANCE; 2 (6) OBTAIN A LIST OF THE CATEGORIES OF THIRD PARTIES TO WHICH 3 THE CONTROLLER HAS DISCLOSED THE CONSUMER’S PERSONAL DATA OR A LIST OF 4 THE CATEGORIES OF THIRD PARTIES TO WHICH THE CONTROLLER HAS DISCLOSED 5 ANY CONSUMER’S PERSONAL DATA IF THE CONTROLLER DOES NOT MAINTAIN THIS 6 INFORMATION IN A FORMAT SPECIFIC TO THE CONSUMER; AND 7 (7) OPT OUT OF THE PROCESSING OF PERSONAL DATA FOR PURPOSES 8 OF: 9 (I) TARGETED ADVERTISING; 10 (II) THE SALE OF PERSONAL DATA; OR 11 (III) PROFILING IN FURTHERANCE OF SOLELY AUTOMATED 12 DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS 13 CONCERNING THE CONSUMER. 14 (C) (1) A CONTROLLER SHALL ESTABLISH A SECURE AND RELIABLE 15 METHOD FOR A CONSUMER TO EXERCISE A CONSUMER RIGHT UNDER THIS SECTION. 16 (2) A CONSUMER MAY EXERCISE A CONSUMER RIGHT UNDER THIS 17 SECTION BY THE METHOD ESTABLISHED BY THE CONTROLLER UNDER PARAGRAPH 18 (1) OF THIS SUBSECTION. 19 (D) (1) A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT IN 20 ACCORDANCE WITH § 14–4606 OF THIS SUBTITLE TO OPT OUT OF THE PROCESSING 21 OF THE CONSUMER’S PERSONAL DATA UNDER SUBSECTION (B)(7) OF THIS SECTION 22 ON BEHALF OF A CONSUMER. 23 (2) A PARENT OR LEGAL GUARDIAN OF A CHILD MAY EXERCISE A 24 CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE CHILD’S 25 BEHALF REGARDING THE PROCESSING OF PERSONAL DATA. 26 (3) A GUARDIAN OR CONSERVATOR OF A CONSUMER SUBJECT TO A 27 GUARDIANSHIP, CONSERVATORSHIP, OR OTHER PROTECTIVE ARRANGEMENT MAY 28 EXERCISE A CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE 29 CONSUMER’S BEHALF REGARDING THE PROCESSING OF PERSONAL DATA. 30 HOUSE BILL 567 17 (E) (1) EXCEPT AS OTHERWISE PROVIDED IN THIS SUBTITLE, A 1 CONTROLLER SHALL COMPLY WITH A REQUEST BY A CONSUMER TO EXERCISE A 2 CONSUMER RIGHT LISTED IN THIS SECTION. 3 (2) (I) A CONTROLLER SHALL RESPOND TO A CONSUMER REQUEST 4 NOT LATER THAN 45 DAYS AFTER THE CONTROLLER RECEIVES THE CONSUMER 5 REQUEST. 6 (II) A CONTROLLER MAY EXTEND THE COMPLETION PERIOD BY 7 AN ADDITIONAL 45 DAYS IF: 8 1. IT IS REASONABLY NECESSARY TO COMPLETE THE 9 REQUEST BASED ON THE COMPLEXITY AND NUMBER OF THE CONSUMER’S 10 REQUESTS; AND 11 2. THE CONTROLLER INFORMS THE CONSUMER OF THE 12 EXTENSION AND THE REASON FOR THE EXTENSION WITHIN THE INITIAL 45–DAY 13 RESPONSE PERIOD. 14 (III) A CONTROLLER SHALL NOTIFY THE CONSUMER WITHIN 30 15 DAYS AFTER COMPLYING WITH THE CONSUMER’S REQUEST THAT THE CONTROLLER 16 HAS COMPLIED WITH THE CONSUMER’S REQUEST. 17 (3) IF A CONTROLLER DECLINES TO ACT REGARDING A CONSUMER’S 18 REQUEST, THE CONTROLLER SHALL: 19 (I) INFORM THE CONSUMER WITHOUT UNDUE DELAY, BUT NOT 20 LATER THAN 45 DAYS AFTER RECEIVING THE REQUEST, OF THE JUSTIFICATION FOR 21 DECLINING TO ACT; AND 22 (II) PROVIDE INSTRUCTIONS FOR HOW TO APPEAL THE 23 DECISION. 24 (4) (I) A CONTROLLER SHALL PROVIDE INFORMATION TO A 25 CONSUMER IN RESPONSE TO A CONSUMER’S REQUEST TO EXERCISE RIGHTS UNDER 26 THIS SUBTITLE FREE OF CHARGE ONCE DURING ANY 12–MONTH PERIOD. 27 (II) IF REQUESTS FROM A CONSUMER ARE MANIFESTLY 28 UNFOUNDED, EXCESSIVE, TECHNICALLY INFEASIBLE, OR REPETITIVE, A 29 CONTROLLER MAY: 30 1. CHARGE THE CONSUMER A REASONABLE FEE TO 31 COVER THE ADMINISTRATIVE COSTS OF COMPLYING WITH THE REQUEST; OR 32 18 HOUSE BILL 567 2. DECLINE TO ACT ON THE REQUEST. 1 (III) THE CONTROLLER HAS THE BURDEN OF DEMONSTRATING 2 THE MANIFESTLY UNFOUNDED, EXCESSIVE, TECHNICALLY INFEASIBLE, OR 3 REPETITIVE NATURE OF THE REQUEST. 4 (5) IF A CONTROLLER IS UNABLE TO AUTHENTICATE A REQUEST TO 5 EXERCISE A CONSUMER RIGHT AFFORDED UNDER SUBSECTION (B)(1) THROUGH (5) 6 OF THIS SECTION USING COMMERCIALLY REASONABLE EFFORTS, THE 7 CONTROLLER: 8 (I) MAY NOT BE REQUIRED TO COMPLY WITH A REQUEST TO 9 INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION; AND 10 (II) SHALL PROVIDE NOTICE TO THE CONSUMER THAT THE 11 CONTROLLER IS UNABLE TO AUTHENTICATE THE REQUEST TO EXERCISE THE RIGHT 12 UNTIL THE CONSUMER PROVIDES ADDITIONAL INFORMATION REASONABLY 13 NECESSARY TO AUTHENTICATE THE CONSUMER AND THE CONSUMER’S REQUEST TO 14 EXERCISE THE CONSUMER’S RIGHTS. 15 (6) A CONTROLLER MAY NOT BE REQUIRED TO AUTHENTICATE AN 16 OPT–OUT REQUEST. 17 (7) A CONTROLLER THAT HAS OBTAINED PERSONAL DATA ABOUT A 18 CONSUMER FROM A SOURCE OTHER THAN THE CONSUMER SHALL BE CONSIDERED 19 COMPLIANT WITH THE CONSUMER’S REQUEST TO DELETE THE CONSUMER’S DATA IN 20 ACCORDANCE WITH SUBSECTION (B)(4) OF THIS SECTION BY RETAINING A RECORD 21 OF THE DELETION REQUEST AND THE MINIMUM DATA NECESSARY FOR THE 22 PURPOSE OF ENSURING THAT THE CONSUMER’S PERSONAL DATA: 23 (I) REMAINS DELETED FROM THE CONTROLLER’S RECORDS; 24 AND 25 (II) IS NOT BEING USED FOR ANY OTHER PURPOSE. 26 (F) (1) A CONTROLLER SHALL ESTABLISH A PROCESS FOR A CONSUMER 27 TO APPEAL THE CONTROLLER’S REFUSAL TO ACT ON A CONSUMER RIGHTS REQUEST 28 WITHIN A REASONABLE PERIOD AFTER THE CONSUMER RECEIVES THE DECISION. 29 (2) THE APPEAL PROCESS SHALL BE: 30 (I) CONSPICUOUSLY AVAILABLE; AND 31 HOUSE BILL 567 19 (II) SIMILAR TO THE PROCESS FOR SUBMITTING REQUESTS TO 1 INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION. 2 (3) NOT LATER THAN 60 DAYS AFTER RECEIVING AN APPEAL, A 3 CONTROLLER SHALL INFORM THE CONSUMER IN WRITING OF ANY ACTION TAKEN OR 4 NOT TAKEN IN RESPONSE TO THE APPEAL, INCLUDING A WRITTEN EXPLANATION OF 5 THE REASONS FOR THE DECISIONS. 6 (4) IF A CONTROLLER DENIES AN APPEAL, THE CONTROLLER SHALL 7 PROVIDE THE CONSUMER WITH AN ONLINE MECHANISM, IF AVAILABLE, THROUGH 8 WHICH THE CONSUMER MAY CONTACT THE DIVISION TO SUBMIT A COMPLAINT. 9 14–4606. 10 (A) (1) A CONSUMER MAY DESIGNATE AN INDIVIDUAL TO SERVE AS THE 11 CONSUMER’S AUTHORIZED AGENT AND ACT ON THE CONSUMER’S BEHALF TO OPT 12 OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR ONE OR MORE 13 OF THE PURPOSES SPECIFIED IN § 14–4605(B)(7) OF THIS SUBTITLE. 14 (2) A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT BY AN 15 INTERNET LINK OR A BROWSER SETTING, BROWSER EXTENSION, GLOBAL DEVICE 16 SETTING, OR OTHER SIMILAR TECHNOLOGY, INDICATING A CONSUMER’S INTENT TO 17 OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA. 18 (B) A CONTROLLER SHALL COMPLY WITH AN OPT–OUT REQUEST RECEIVED 19 FROM AN AUTHORIZED AGENT IF, USING COMMERCIALLY REASONABLE EFFORTS, 20 THE CONTROLLER IS ABLE TO AUTHENTICATE THE: 21 (1) IDENTITY OF THE CONSUMER; AND 22 (2) AUTHORIZED AGENT’S AUTHORITY TO ACT ON THE CONSUMER’S 23 BEHALF. 24 14–4607. 25 (A) A CONTROLLER MAY NOT: 26 (1) COLLECT PERSONAL DATA FOR THE SOLE PURPOSE OF CONTENT 27 PERSONALIZATION OR MARKETING WITHOUT THE CONSENT OF THE CONSUMER 28 WHOSE PERSONAL DATA IS COLLECTED; 29 20 HOUSE BILL 567 (2) EXCEPT WHERE THE COLLECTION OR PROCESSING IS STRICTLY 1 NECESSARY TO PROVIDE OR MAINTAIN A SPECIFIC PRODUCT OR SERVICE 2 REQUESTED BY THE CONSUMER TO WHOM THE PERSONAL DATA PERTAINS AND 3 UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT, COLLECT, 4 PROCESS, OR SHARE SENSITIVE DATA CONCERNING A CONSUMER; 5 (3) SELL SENSITIVE DATA; 6 (4) PROCESS PERSONAL DATA IN VIOLATION OF STATE OR FEDERAL 7 LAWS THAT PROHIBIT UNLAWFUL DISCRIMINATION; 8 (5) PROCESS THE PERSONAL DATA OF A CONSUMER FOR THE 9 PURPOSES OF TARGETED ADVERTISING IF THE CONTROLLER KNEW OR SHOULD 10 HAVE KNOWN THAT THE CONSUMER IS AT LEAST 13 YEARS OLD AND UNDER THE AGE 11 OF 18 YEARS; 12 (6) SELL THE PERSONAL DATA OF A CONSUMER WITHOUT THE 13 CONSUMER’S CONSENT IF THE CONTROLLER KNEW OR SHOULD HAVE KNOWN THAT 14 THE CONSUMER IS AT LEAST 13 YEARS OLD AND UNDER THE AGE OF 18 YEARS; 15 (7) DISCRIMINATE AGAINST A CONSUMER FOR EXERCISING A 16 CONSUMER RIGHT CONTAINED IN THIS SUBTITLE, INCLUDING DENYING GOODS OR 17 SERVICES, CHARGING DIFFERENT PRICES OR RATES FOR GOODS OR SERVICES, OR 18 PROVIDING A DIFFERENT LEVEL OF QUALITY OF GOODS OR SERVICES TO THE 19 CONSUMER; 20 (8) COLLECT, PROCESS, OR TRANSFER PERSONAL DATA OR PUBLICLY 21 AVAILABLE DATA IN A MANNER THAT UNLAWFULLY DISCRIMINATES IN OR 22 OTHERWISE UNLAWFULLY MAKES UNAVAILABLE THE EQUAL ENJOYMENT OF GOODS 23 OR SERVICES ON THE BASIS OF RACE, COLOR, RELIGION, NATIONAL ORIGIN, SEX, 24 SEXUAL ORIENTATION, GENDER IDENTITY, OR DISABILITY, UNLESS THE 25 COLLECTION, PROCESSING, OR TRANSFER OF PERSONAL DATA IS FOR: 26 (I) THE CONTROLLER’S SELF–TESTING TO PREVENT OR 27 MITIGATE UNLAWFUL DISCRIMINATION; 28 (II) THE CONTROLLER’S DIVERSIFYING OF AN APPLICANT, 29 PARTICIPANT, OR CUSTOMER POOL; OR 30 (III) A PRIVATE CLUB OR GROUP NOT OPEN TO THE PUBLIC, AS 31 DESCRIBED IN § 201(E) OF THE CIVIL RIGHTS ACT OF 1964; OR 32 HOUSE BILL 567 21 (9) UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT, 1 PROCESS PERSONAL DATA FOR A PURPOSE THAT IS NEITHER REASONABLY 2 NECESSARY TO, NOR COMPATIBLE WITH, THE DISCLOSED PURPOSES FOR WHICH 3 THE PERSONAL DATA IS PROCESSED, AS DISCLOSED TO THE CONSUMER. 4 (B) (1) A CONTROLLER SHALL: 5 (I) LIMIT THE COLLECTION OF PERSONAL DATA TO WHAT IS 6 REASONABLY NECESSARY AND PROPORTIONATE TO PROVIDE OR MAINTAIN A 7 SPECIFIC PRODUCT OR SERVICE REQUESTED BY THE CONSUMER TO WHOM THE 8 DATA PERTAINS; 9 (II) ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE 10 ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO 11 PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL 12 DATA APPROPRIATE TO THE VOLUME AND NATURE OF THE PERSONAL DATA AT 13 ISSUE; AND 14 (III) PROVIDE AN EFFECTIVE MECHANISM FOR A CONSUMER TO 15 REVOKE THE CONSUMER’S CONSENT UNDER THIS SECTION THAT IS AT LEAST AS 16 EASY AS THE MECHANISM BY WHICH THE CONSUMER PROVIDED THE CONSUMER’S 17 CONSENT. 18 (2) IF A CONSUMER REVOKES CONSENT UNDER THIS SECTION, THE 19 CONTROLLER SHALL STOP PROCESSING THE CONSUMER’S PERSONAL DATA AS SOON 20 AS PRACTICABLE, BUT NOT LATER THAN 15 DAYS AFTER RECEIVING THE REQUEST. 21 (C) NOTHING IN SUBSECTION (A) OR (B) OF THIS SECTION MAY BE 22 CONSTRUED TO: 23 (1) REQUIRE A CONTROLLER TO PROVIDE A PRODUCT OR SERVICE 24 THAT REQUIRES THE PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER 25 DOES NOT COLLECT OR MAINTAIN; OR 26 (2) PROHIBIT A CONTROLLER FROM OFFERING A DIFFERENT PRICE, 27 RATE, LEVEL, QUALITY, OR SELECTION OF GOODS OR SERVICES TO A CONSUMER, 28 INCLUDING OFFERING GOODS OR SERVICES FOR NO FEE, IF THE OFFERING IS IN 29 CONNECTION WITH A CONSUMER’S VOLUNTARY PARTICIPATION IN A BONA FIDE 30 LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNTS, OR CLUB CARD PROGRAM. 31 (D) A CONTROLLER SHALL PROVIDE A CONSUMER WITH A REASONABLY 32 ACCESSIBLE, CLEAR, AND MEANINGFUL PRIVACY NOTICE THAT INCLUDES: 33 22 HOUSE BILL 567 (1) THE CATEGORIES OF PERSONAL DATA PROCESSED BY THE 1 CONTROLLER, INCLUDING SENSITIVE DATA; 2 (2) THE CONTROLLER’S PURPOSE FOR PROCESSING PERSONAL DATA; 3 (3) HOW A CONSUMER MAY EXERCISE THE CONSUMER’S RIGHTS 4 UNDER THIS SUBTITLE, INCLUDING HOW A CONSUMER MAY APPEAL A 5 CONTROLLER’S DECISION REGARDING THE CONSUMER’S REQUEST OR MAY REVOKE 6 CONSENT; 7 (4) THE CATEGORIES OF THIRD PARTIES WITH WHICH THE 8 CONTROLLER SHARES PERSONAL DATA WITH A LEVEL OF DETAIL THAT ENABLES A 9 CONSUMER TO UNDERSTAND WHAT TYPE OF ENTITY EACH THIRD PARTY IS AND, TO 10 THE EXTENT POSSIBLE, HOW EACH THIRD PARTY MAY PROCESS THE PERSONAL 11 DATA; 12 (5) THE CATEGORIES OF PERSONAL DATA, INCLUDING SENSITIVE 13 DATA, THAT THE CONTROLLER SHARES WITH THIRD PARTIES; AND 14 (6) AN ACTIVE E–MAIL ADDRESS OR OTHER ONLINE MECHANISM 15 THAT A CONSUMER MAY USE TO CONTACT THE CONTROLLER. 16 (E) IF A CONTROLLER SELLS PERSONAL DATA TO THIRD PARTIES OR 17 PROCESSES PERSONAL DATA FOR TARGETED ADVERTISING OR FOR THE PURPOSES 18 OF PROFILING THE CONSUMER IN FURTHERANCE OF DECISIONS THAT PRODUCE 19 LEGAL OR SIMILARLY SIGNIFICANT EFFECTS, THE CONTROLLER SHALL CLEARLY 20 AND CONSPICUOUSLY DISCLOSE THE PROCESSING, AS WELL AS THE MANNER IN 21 WHICH A CONSUMER MAY EXERCISE THE RIGHT TO OPT OUT OF THE PROCESSING. 22 (F) (1) THE PRIVACY NOTICE UNDER SUBSECTION (D) OF THIS SECTION 23 SHALL ESTABLISH ONE OR MORE SECURE AND RELIABLE METHODS FOR A 24 CONSUMER TO SUBMIT A REQUEST TO EXERCISE A CONSUMER RIGHT IN 25 ACCORDANCE WITH THIS SUBTITLE THAT TAKE INTO ACCOUNT: 26 (I) THE WAYS IN WHICH CONSUMERS NORMALLY INTERACT 27 WITH THE CONTROLLER; 28 (II) THE NEED FOR SECURE AND RELIABLE COMMUNICATION 29 OF CONSUMER REQUESTS; AND 30 (III) THE ABILITY OF THE CONTROLLER TO VERIFY THE 31 IDENTITY OF A CONSUMER MAKING THE REQUEST. 32 HOUSE BILL 567 23 (2) (I) A CONTROLLER MAY NOT REQUIRE A CONSUMER TO 1 CREATE A NEW ACCOUNT IN ORDER TO EXERCISE A CONSUMER RIGHT. 2 (II) A CONTROLLER MAY REQUIRE A CONSUMER TO USE AN 3 EXISTING ACCOUNT TO EXERCISE A CONSUMER RIGHT. 4 (3) A CONTROLLER MAY UTILIZE THE FOLLOWING METHODS TO 5 SATISFY PARAGRAPH (1) OF THIS SUBSECTION: 6 (I) PROVIDING A CLEAR AND CONSPICUOUS LINK ON THE 7 CONTROLLER’S WEBSITE TO A WEBPAGE THAT ALLOWS A CONSUMER, OR AN 8 AUTHORIZED AGENT OF THE CONSUMER, TO OPT OUT OF THE TARGETED 9 ADVERTISING OR THE SALE OF THE CONSUMER’S PERSONAL DATA; OR 10 (II) ON OR BEFORE OCTOBER 1, 2025, ALLOWING A CONSUMER 11 TO OPT OUT OF ANY PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR THE 12 PURPOSES OF TARGETED ADVERTISING, OR ANY SALE OF PERSONAL DATA, 13 THROUGH AN OPT–OUT PREFERENCE SIGNAL SENT, WITH THE CONSUMER’S 14 CONSENT, BY A PLATFORM, TECHNOLOGY, OR MECHANISM TO THE CONTROLLER 15 INDICATING THE CONSUMER’S INTENT TO OPT OUT OF THE PROCESSING OR SALE. 16 (4) A PLATFORM, TECHNOLOGY, OR MECHANISM USED IN 17 ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION SHALL: 18 (I) BE CONSUMER–FRIENDLY AND EASY TO USE BY THE 19 AVERAGE CONSUMER; 20 (II) USE CLEAR, EASY TO UNDERSTAND, AND UNAMBIGUOUS 21 LANGUAGE; 22 (III) BE AS CONSISTENT AS POSSIBLE WITH ANY OTHER SIMILAR 23 PLATFORM, TECHNOLOGY, OR MECHANISM REQUIRED BY ANY FEDERAL OR STATE 24 LAW OR REGULATION; 25 (IV) ENABLE THE CONTROLLER TO REASONABLY DETERMINE 26 WHETHER THE CONSUMER: 27 1. IS A RESIDENT OF THE STATE; AND 28 2. HAS MADE A LEGITIMATE REQUEST TO OPT OUT OF 29 ANY SALE OF THE CONSUMER’S PERSONAL DATA OR TARGETED ADVERTISING; AND 30 24 HOUSE BILL 567 (V) REQUIRE A CONSUMER TO MAKE AN AFFIRMATIVE, 1 UNAMBIGUOUS, AND VOLUNTARY CHOICE IN ORDER TO OPT OUT OF ANY 2 PROCESSING OF THE CONSUMER’S PERSONAL DATA. 3 (5) A PLATFORM, TECHNOLOGY, OR MECHANISM USED IN 4 ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION MAY NOT: 5 (I) UNFAIRLY DISADVANTAGE ANOTHER CONTROLLER; OR 6 (II) USE A DEFAULT SETTING TO OPT A CONSUMER OUT OF ANY 7 PROCESSING OF THE CONSUMER’S PERSONAL DATA. 8 (G) IF A CONSUMER’S DECISION TO OPT OUT OF THE PROCESSING OF THE 9 CONSUMER’S PERSONAL DATA FOR THE PURPOSES OF TARGETED ADVERTISING, OR 10 THE SALE OF PERSONAL DATA THROUGH AN OPT–OUT PREFERENCE SIGNAL SENT IN 11 ACCORDANCE WITH SUBSECTION (F)(3) OF THIS SECTION CONFLICTS WITH THE 12 CONSUMER’S EXISTING CONTROLLER–SPECIFIC PRIVACY SETTING OR THE 13 CONSUMER’S VOLUNTARY PARTICIPATION IN A CONTROLLER’S BONA FIDE LOYALTY, 14 REWARDS, PREMIUM FEATURES, DISCOUNTS, OR CLUB CARD PROGRAM, THE 15 CONTROLLER MAY NOTIFY THE CONSUMER OF A CONFLICT AND PROVIDE THE 16 CHOICE TO CONFIRM CONTROLLER–SPECIFIC PRIVACY SETTINGS OR 17 PARTICIPATION IN A PROGRAM LISTED IN THIS PARAGRAPH. 18 14–4608. 19 (A) (1) IF A CONTROLLER USES A PROCESSOR TO PROCESS THE 20 PERSONAL DATA OF CONSUMERS, THE CONTROLLER AND THE PROCESSOR SHALL 21 ENTER INTO A CONTRACT THAT GOVERNS THE PROCESSOR’S DATA PROCESSING 22 PROCEDURES WITH RESPECT TO PROCESSING PERFORMED ON BEHALF OF THE 23 CONTROLLER. 24 (2) THE CONTRACT SHALL BE BINDING AND CLEARLY SET FORTH 25 INSTRUCTIONS FOR: 26 (I) PROCESSING DATA; 27 (II) THE NATURE AND PURPOSE OF PROCESSING; 28 (III) THE TYPE OF DATA SUBJECT TO PROCESSING; 29 (IV) THE DURATION OF PROCESSING; AND 30 (V) THE RIGHTS AND OBLIGATIONS OF BOTH PARTIES. 31 HOUSE BILL 567 25 (3) THE CONTRACT SHALL REQUIRE THAT THE PROCESSOR: 1 (I) ENSURE THAT EACH PERSON PROCESSING PERSONAL DATA 2 IS SUBJECT TO A DUTY OF CONFIDENTIALITY WITH RESPECT TO THE PERSONAL 3 DATA; 4 (II) ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE 5 ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO 6 PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL 7 DATA, CONSIDERING THE VOLUME AND NATURE OF THE PERSONAL DATA; 8 (III) STOP PROCESSING DATA ON REQUEST BY THE CONTROLLER 9 MADE IN ACCORDANCE WITH A CONSUMER’S AUTHENTICATED REQUEST; 10 (IV) AT THE CONTROLLER’S DIRECTION, DELETE OR RETURN 11 ALL PERSONAL DATA TO THE CONTROLLER AS REQUESTED AT THE END OF THE 12 PROVISION OF SERVICE, UNLESS RETENTION OF THE PERSONAL DATA IS REQUIRED 13 BY LAW; 14 (V) ON THE REASONABLE REQUEST OF THE CONTROLLER, 15 MAKE AVAILABLE TO THE CONTROLLER ALL INFORMATION IN THE PROCESSOR’S 16 POSSESSION NECESSARY TO DEMONSTRATE THE PROCESSOR’S COMPLIANCE WITH 17 THE OBLIGATIONS IN THIS SUBTITLE; 18 (VI) AFTER PROVIDING THE CONTROLLER AN OPPORTUNITY TO 19 OBJECT, ENGAGE A SUBCONTRACTOR TO ASSIST WITH PROCESSING PERSONAL DATA 20 ON THE CONTROLLER’S BEHALF ONLY IN ACCORDANCE WITH A WRITTEN CONTRACT 21 THAT REQUIRES THE SUBCONTRACTOR TO MEET THE PROCESSOR’S OBLIGATIONS 22 REGARDING THE PERSONAL DATA UNDER THE PROCESSOR’S CONTRACT WITH THE 23 CONTROLLER; AND 24 (VII) ALLOW AND COOPERATE WITH REASONABLE ASSESSMENTS 25 BY THE CONTROLLER, THE CONTROLLER’S DESIGNATED ASSESSOR, OR A QUALIFIED 26 AND INDEPENDENT ASSESSOR ARRANGED FOR BY THE PROCESSOR TO ASSESS THE 27 PROCESSOR’S POLICIES AND TECHNICAL AND ORGANIZATIONAL MEASURES IN 28 SUPPORT OF THE OBLIGATIONS UNDER THIS SUBTITLE. 29 (4) (I) ON REQUEST, THE PROCESSOR SHALL PROVIDE A REPORT 30 OF AN ASSESSMENT REQUIRED BY PARAGRAPH (3)(V) OF THIS SUBSECTION TO THE 31 CONTROLLER. 32 26 HOUSE BILL 567 (II) AN ASSESSMENT CONDUCTED IN ACCORDANCE WITH 1 PARAGRAPH (3)(V) OF THIS SUBSECTION SHALL BE CONDUCTED USING AN 2 APPROPRIATE AND ACCEPTED CONTROL STANDARD OR FRAMEWORK AND 3 ASSESSMENT PROCEDURE FOR THE ASSESSMENTS. 4 (B) (1) IF A CONTROLLER USES A PROCESSOR TO PROCESS THE 5 PERSONAL DATA OF CONSUMERS, THE CONTROLLER SHALL PROVIDE THE 6 PROCESSOR WITH INSTRUCTIONS ON HOW TO PROCESS PERSONAL DATA. 7 (2) A PROCESSOR SHALL: 8 (I) ADHERE TO THE CONTRACT AND INSTRUCTIONS OF A 9 CONTROLLER; 10 (II) ASSIST THE CONTROLLER IN MEETING THE CONTROLLER’S 11 OBLIGATIONS UNDER THIS SUBTITLE, INCLUDING, CONSIDERING THE NATURE OF 12 PROCESSING AND THE INFORMATION AVAILABLE TO THE PROCESSOR: 13 1. BY APPROPRIATE TECHNICAL AND ORGANIZATIONAL 14 MEASURES AS MUCH AS REASONABLY PRACTICABLE TO FULFILL THE 15 CONTROLLER’S OBLIGATION TO RESPOND TO CONSUMER RIGHTS REQUESTS; AND 16 2. BY ASSISTING THE CONTROLLER IN MEETING THE 17 CONTROLLER’S OBLIGATIONS IN RELATION TO THE SECURITY OF PROCESSING THE 18 PERSONAL DATA AND IN RELATION TO THE NOTIFICATION OF A BREACH OF THE 19 SECURITY OF A SYSTEM, AS DEFINED IN § 14–3504 OF THIS TITLE; AND 20 (III) PROVIDE NECESSARY INFORMATION TO ENABLE THE 21 CONTROLLER TO CONDUCT AND DOCUMENT DATA PROTECTION ASSESSMENTS. 22 (C) NOTHING IN THIS SECTION MAY BE CONSTRUED TO RELIEVE A 23 CONTROLLER OR A PROCESSOR FROM THE LIABILITIES IMPOSED ON THE 24 CONTROLLER OR PROCESSOR BY VIRTUE OF THE CONTROLLER’S OR PROCESSOR’S 25 ROLE IN THE PROCESSING RELATIONSHIP IN ACCORDANCE WITH THIS SECTION. 26 (D) (1) THE DETERMINATION OF WHETHER A PERSON IS ACTING AS A 27 CONTROLLER OR A PROCESSOR WITH RESPECT TO A SPECIFIC PROCESSING OF DATA 28 IS A FACT–BASED DETERMINATION THAT DEPENDS ON THE CONTEXT IN WHICH 29 PERSONAL DATA IS BEING PROCESSED. 30 (2) A PERSON IS CONSIDERED TO BE A CONTROLLER IF THE PERSON: 31 HOUSE BILL 567 27 (I) IS NOT LIMITED IN THE PERSON’S PROCESSING OF SPECIFIC 1 PERSONAL DATA IN ACCORDANCE WITH A CONTROLLER’S INSTRUCTIONS; OR 2 (II) FAILS TO ADHERE TO A CONTROLLER’S INSTRUCTIONS 3 WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA. 4 (3) A PROCESSOR THAT CONTINUES TO ADHERE TO A CONTROLLER’S 5 INSTRUCTIONS WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA 6 REMAINS A PROCESSOR. 7 (4) IF A PROCESSOR OR THIRD PARTY BEGINS, ALONE OR JOINTLY 8 WITH OTHERS, DETERMINING THE PURPOSES AND MEANS OF THE PROCESSING OF 9 PERSONAL DATA, THE PROCESSOR: 10 (I) IS A CONTROLLER WITH RESPECT TO THE PROCESSING; AND 11 (II) MAY BE SUBJECT TO AN ENFORCEMENT ACTION UNDER 12 THIS SUBTITLE. 13 (E) NOTHING IN THIS SECTION MAY BE CONSTRUED TO ALTER A 14 CONTROLLER’S OBLIGATION TO LIMIT A PERSON’S PROCESSING OF PERSONAL DATA 15 OR TO TAKE STEPS TO ENSURE THAT A PROCESSOR ADHERES TO THE CONTROLLER’S 16 INSTRUCTIONS. 17 14–4609. 18 (A) IF A THIRD PARTY USES OR SHARES A CONSUMER’S INFORMATION IN A 19 MANNER INCONSISTENT WITH PROMISES MADE TO THE CONSUMER AT THE TIME OF 20 COLLECTION OF THE INFORMATION, THE THIRD PARTY SHALL PROVIDE AN 21 AFFECTED CONSUMER WITH NOTICE OF THE NEW OR CHANGED PRACTICE BEFORE 22 IMPLEMENTING THE NEW OR CHANGED PRACTICE. 23 (B) THE NOTICE PROVIDED UNDER SUBSECTION (A) OF THIS SECTION 24 SHALL BE PROVIDED IN A MANNER AND AT A TIME REASONABLY CALCULATED TO 25 ALLOW A CONSUMER TO EXERCISE THE RIGHTS PROVIDED UNDER THIS SUBTITLE. 26 14–4610. 27 (A) IN THIS SECTION, “PROCESSING ACTIVITIES THAT PRESENT A 28 HEIGHTENED RISK OF HARM TO A CONSUMER” MEANS: 29 (1) THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF 30 TARGETED ADVERTISING; 31 28 HOUSE BILL 567 (2) THE SALE OF PERSONAL DATA; 1 (3) THE PROCESSING OF SENSITIVE DATA; AND 2 (4) THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF 3 PROFILING, IN WHICH THE PROFILING PRESENTS A REASONABLY FORESEEABLE 4 RISK OF: 5 (I) UNFAIR, ABUSIVE, OR DECEPTIVE TREATMENT OF A 6 CONSUMER; 7 (II) HAVING AN UNLAWFUL DISPARATE IMPACT ON A 8 CONSUMER; 9 (III) FINANCIAL, PHYSICAL, OR REPUTATIONAL INJURY TO A 10 CONSUMER; 11 (IV) A PHYSICAL OR OTHER INTRUSION ON THE SOLITUDE OR 12 SECLUSION OR THE PRIVATE AFFAIRS OR CONCERNS OF A CONSUMER IN WHICH THE 13 INTRUSION WOULD BE OFFENSIVE TO A REASONABLE PERSON; OR 14 (V) OTHER SUBSTANTIAL INJURY TO A CONSUMER. 15 (B) A CONTROLLER SHALL CONDUCT AND DOCUMENT, ON A REGULAR 16 BASIS, A DATA PROTECTION ASSESSMENT FOR EACH OF THE CONTROLLER’S 17 PROCESSING ACTIVITIES THAT PRESENT A HEIGHTENED RISK OF HARM TO A 18 CONSUMER, INCLUDING AN ASSESSMENT FOR EACH ALGORITHM THAT IS USED. 19 (C) (1) A DATA PROTECTION ASSESSMENT CONDUCTED IN ACCORDANCE 20 WITH THIS SECTION SHALL IDENTIFY AND WEIGH THE BENEFITS THAT MAY FLOW 21 DIRECTLY AND INDIRECTLY FROM THE PROCESSING TO THE CONTROLLER, THE 22 CONSUMER, OTHER INTERESTED PARTIES, AND THE PUBLIC AGAINST: 23 (I) THE POTENTIAL RISKS TO THE RIGHTS OF THE CONSUMER 24 ASSOCIATED WITH THE PROCESSING AS MITIGATED BY SAFEGUARDS THAT MAY BE 25 EMPLOYED BY THE CONTROLLER TO REDUCE THESE RISKS; AND 26 (II) THE NECESSITY AND PROPORTIONALITY OF PROCESSING IN 27 RELATION TO THE STATED PURPOSE OF THE PROCESSING. 28 (2) THE CONTROLLER SHALL FACTOR INTO A DATA PROTECTION 29 ASSESSMENT: 30 HOUSE BILL 567 29 (I) THE USE OF DE–IDENTIFIED DATA; 1 (II) THE REASONABLE EXPECTATIONS OF CONSUMERS; 2 (III) THE CONTEXT OF THE PROCESSING; AND 3 (IV) THE RELATIONSHIP BETWEEN THE CONTROLLER AND THE 4 CONSUMER WHOSE PERSONAL DATA WILL BE PROCESSED. 5 (D) (1) THE DIVISION MAY REQUIRE THAT A CONTROLLER MAKE 6 AVAILABLE TO THE DIVISION A DATA PROTECTION ASSESSMENT THAT IS RELEVANT 7 TO AN INVESTIGATION CONDUCTED BY THE DIVISION. 8 (2) (I) THE DIVISION MAY EVALUATE A DATA PROTECTION 9 ASSESSMENT FOR COMPLIANCE WITH THE RESPONSIBILITIES ESTABLISHED IN THIS 10 SUBTITLE. 11 (II) A CONTROLLER’S DATA PROTECTION ASSESSMENT MAY BE 12 USED IN AN ACTION TO ENFORCE THIS SUBTITLE. 13 (3) A DATA PROTECTION ASSESSMENT IS CONFIDENTIAL AND IS 14 EXEMPT FROM DISCLOSURE UNDER THE FEDERAL FREEDOM OF INFORMATION ACT 15 OR THE PUBLIC INFORMATION ACT. 16 (E) A SINGLE DATA PROTECTION ASSESSMENT MAY ADDRESS A 17 COMPARABLE SET OF PROCESSING OPERATIONS THAT INCLUDE SIMILAR 18 ACTIVITIES. 19 (F) IF A CONTROLLER CONDUCTS A DATA PROTECTION ASSESSMENT FOR 20 THE PURPOSE OF COMPLYING WITH ANOTHER APPLICABLE LAW OR REGULATION, 21 THE DATA PROTECTION ASSESSMENT SHALL BE CONSIDERED TO SATISFY THE 22 REQUIREMENTS ESTABLISHED IN THIS SECTION IF THE DATA PROTECTION 23 ASSESSMENT IS REASONABLY SIMILAR IN SCOPE AND EFFECT TO THE DATA 24 PROTECTION ASSESSMENT THAT WOULD OTHERWISE BE CONDUCTED IN 25 ACCORDANCE WITH THIS SECTION. 26 (G) TO THE EXTENT THAT ANY INFORMATION CONTAINED IN A DATA 27 PROTECTION ASSESSMENT DISCLOSED TO THE DIVISION INCLUDES INFORMATION 28 SUBJECT TO ATTORNEY–CLIENT PRIVILEGE OR WORK PRODUCT PROTECTION, THE 29 DISCLOSURE MAY NOT CONSTITUTE A WAIVER OF THAT PRIVILEGE OR PROTECTION. 30 14–4611. 31 30 HOUSE BILL 567 (A) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A 1 CONTROLLER OR A PROCESSOR TO: 2 (1) RE–IDENTIFY DE–IDENTIFIED DATA; 3 (2) MAINTAIN DATA IN AN IDENTIFIABLE FORM; OR 4 (3) COLLECT, OBTAIN, RETAIN, OR ACCESS ANY DATA OR 5 TECHNOLOGY IN ORDER TO BE CAPABLE OF ASSOCIATING AN AUTHENTICATED 6 CONSUMER REQUEST WITH PERSONAL DATA. 7 (B) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A 8 CONTROLLER OR PROCESSOR TO COMPLY WITH AN AUTHENTICATED CONSUMER 9 RIGHTS REQUEST IF THE CONTROLLER: 10 (1) IS NOT REASONABLY CAPABLE OF ASSOCIATING THE REQUEST 11 WITH THE PERSONAL DATA OR IT WOULD BE UNREASONABLY BURDENSOME FOR THE 12 CONTROLLER TO ASSOCIATE THE REQUEST WITH THE PERSONAL DATA; 13 (2) DOES NOT USE THE PERSONAL DATA TO RECOGNIZE OR RESPOND 14 TO THE SPECIFIC CONSUMER WHO IS THE SUBJECT OF THE PERSONAL DATA OR 15 ASSOCIATE THE PERSONAL DATA WITH OTHER PERSONAL DATA ABOUT THE SAME 16 SPECIFIC CONSUMER; AND 17 (3) DOES NOT SELL THE PERSONAL DATA TO A THIRD PARTY OR 18 OTHERWISE VOLUNTARILY DISCLOSE THE PERSONAL DATA TO A THIRD PARTY 19 OTHER THAN A PROCESSOR, EXCEPT AS OTHERWISE ALLOWED IN THIS SUBTITLE. 20 (C) (1) A CONTROLLER THAT DISCLOSES DE–IDENTIFIED DATA SHALL: 21 (I) EXERCISE REASONABLE OVERSIGHT TO MONITOR 22 COMPLIANCE WITH ANY CONTRACTUAL COMMITMENTS TO WHICH THE 23 DE–IDENTIFIED DATA IS SUBJECT; AND 24 (II) TAKE APPROPRIATE STEPS TO ADDRESS ANY BREACHES OF 25 ANY CONTRACTUAL COMMITMENTS. 26 (2) THE DETERMINATION OF WHETHER OVERSIGHT IS REASONABLE 27 AND WHETHER APPROPRIATE STEPS WERE TAKEN IN ACCORDANCE WITH 28 PARAGRAPH (1) OF THIS SUBSECTION SHALL TAKE INTO ACCOUNT WHETHER THE 29 DISCLOSED DATA INCLUDES DATA THAT WOULD BE CONSIDERED SENSITIVE DATA IF 30 THE DATA WERE RE–IDENTIFIED. 31 HOUSE BILL 567 31 14–4612. 1 (A) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO RESTRICT A 2 CONTROLLER’S OR PROCESSOR’S ABILITY TO: 3 (1) COMPLY WITH FEDERAL, STATE, OR LOCAL LAWS OR 4 REGULATIONS; 5 (2) COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, 6 INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL, STATE, LOCAL, OR OTHER 7 GOVERNMENTAL AUTHORITY; 8 (3) COOPERATE WITH LAW ENFORCEMENT AGENCIES CONCERNING 9 CONDUCT OR ACTIVITY THAT THE CONTROLLER OR PROCESSOR REASONABLY AND 10 IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR LOCAL LAWS OR 11 REGULATIONS; 12 (4) INVESTIGATE, ESTABLISH, EXERCISE, PREPARE FOR, OR DEFEND 13 A LEGAL CLAIM; 14 (5) PROVIDE A PRODUCT OR SERVICE SPECIFICALLY REQUESTED BY 15 A CONSUMER; 16 (6) PERFORM UNDER A CONTRACT TO WHICH A CONSUMER IS A 17 PARTY, INCLUDING FULFILLING THE TERMS OF A WRITTEN WARRANTY; 18 (7) TAKE STEPS AT THE REQUEST OF A CONSUMER BEFORE 19 ENTERING INTO A CONTRACT; 20 (8) TAKE IMMEDIATE STEPS TO PROTECT AN INTEREST THAT IS 21 ESSENTIAL FOR THE LIFE OR PHYSICAL SAFETY OF A CONSUMER OR ANOTHER 22 INDIVIDUAL AND WHEN THE PROCESSING CANNOT BE MANIFESTLY BASED ON 23 ANOTHER LEGAL BASIS; 24 (9) PREVENT, DETECT, PROTECT AGAINST, INVESTIGATE, 25 PROSECUTE THOSE RESPONSIBLE, OR OTHERWISE RESPOND TO A SECURITY 26 INCIDENT, IDENTITY THEFT, FRAUD, HARASSMENT, MALICIOUS OR DECEPTIVE 27 ACTIVITY, OR ANY OTHER TYPE OF ILLEGAL ACTIVITY; 28 (10) PRESERVE THE INTEGRITY OR SECURITY OF SYSTEMS; OR 29 32 HOUSE BILL 567 (11) ASSIST ANOTHER CONTROLLER, PROCESSOR, OR THIRD PARTY 1 WITH AN OBLIGATION UNDER THIS SUBTITLE. 2 (B) (1) THIS SUBSECTION DOES NOT APPLY TO AN OBLIGATION 3 REQUIRED UNDER § 14–4611 OF THIS SUBTITLE. 4 (2) AN OBLIGATION IMPOSED ON A CONTROLLER OR PROCESSOR 5 UNDER THIS SUBTITLE MAY NOT RESTRICT A CONTROLLER’S OR PROCESSOR’S 6 ABILITY TO COLLECT, USE, OR RETAIN PERSONAL DATA FOR INTERNAL USE TO: 7 (I) EFFECTUATE A PRODUCT RECALL; 8 (II) IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR 9 EXISTING OR INTENDED FUNCTIONALITY; OR 10 (III) PERFORM INTERNAL OPERATIONS THAT ARE: 11 1. REASONABLY ALIGNED WITH THE EXPECTATIONS OF 12 THE CONSUMER OR CAN BE REASONABLY ANTICIPATED BASED ON THE CONSUMER’S 13 EXISTING RELATIONSHIP WITH THE CONTROLLER; OR 14 2. OTHERWISE COMPATIBLE WITH PROCESSING DATA IN 15 FURTHERANCE OF: 16 A. THE PROVISION OF A PRODUCT OR SERVICE 17 SPECIFICALLY REQUESTED BY A CONSUMER; OR 18 B. THE PERFORMANCE OF A CONTRACT TO WHICH THE 19 CONSUMER IS A PARTY. 20 (C) (1) AN OBLIGATION IMPOSED ON A CONTROLLER OR A PROCESSOR 21 UNDER THIS SUBTITLE DOES NOT APPLY WHEN COMPLIANCE BY THE CONTROLLER 22 OR PROCESSOR WITH THE SUBTITLE WOULD VIOLATE AN EVIDENTIARY PRIVILEGE 23 UNDER STATE LAW. 24 (2) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO PREVENT A 25 CONTROLLER OR PROCESSOR FROM PROVIDING PERSONAL DATA CONCERNING A 26 CONSUMER TO A PERSON COVERED BY AN EVIDENTIARY PRIVILEGE UNDER STATE 27 LAW AS PART OF A PRIVILEGED COMMUNICATION. 28 (D) A THIRD–PARTY CONTROLLER OR PROCESSOR THAT RECEIVES 29 PERSONAL DATA FROM A CONTROLLER OR PROCESSOR IN COMPLIANCE WITH THIS 30 SUBTITLE IS NOT IN VIOLATION OF THIS SUBTITLE FOR THE INDEPENDENT 31 HOUSE BILL 567 33 MISCONDUCT OF THE CONTROLLER OR PROCESSOR FROM WHICH THE 1 THIRD–PARTY CONTROLLER OR PROCESSOR RECEIVED THE PERSONAL DATA. 2 (E) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO: 3 (1) IMPOSE AN OBLIGATION ON A CONTROLLER OR A PROCESSOR 4 THAT ADVERSELY AFFECTS THE RIGHTS OR FREEDOMS OF ANY PERSON, INCLUDING 5 THE RIGHTS OF A PERSON TO FREEDOM OF SPEECH OR FREEDOM OF THE PRESS AS 6 GUARANTEED IN THE FIRST AMENDMENT TO THE U.S. CONSTITUTION; OR 7 (2) APPLY TO A PERSON’S PROCESSING OF PERSONAL DATA DURING 8 THE PERSON’S PERSONAL OR HOUSEHOLD ACTIVITIES. 9 (F) IF A CONTROLLER PROCESSES PERSONAL DATA IN ACCORDANCE WITH 10 AN EXEMPTION UNDER THIS SECTION, THE CONTROLLER SHALL DEMONSTRATE 11 THAT THE PROCESSING: 12 (1) QUALIFIES FOR AN EXEMPTION; AND 13 (2) COMPLIES WITH THE REQUIREMENTS OF SUBSECTION (G) OF THIS 14 SECTION. 15 (G) PERSONAL DATA PROCESSED BY A CONTROLLER IN ACCORDANCE WITH 16 THIS SECTION: 17 (1) SHALL BE SUBJECT TO REASONABLE ADMINISTRATIVE, 18 TECHNICAL, AND PHYSICAL MEASURES TO: 19 (I) PROTECT THE CONFIDENTIALITY, INTEGRITY, AND 20 ACCESSIBILITY OF THE PERSONAL DATA; AND 21 (II) REDUCE REASONABLY FORESEEABLE RISKS OF HARM TO 22 CONSUMERS RELATING TO THE COLLECTION, USE, OR RETENTION OF PERSONAL 23 DATA; AND 24 (2) MAY BE PROCESSED TO THE EXTENT THAT THE PROCESSING IS: 25 (I) REASONABLY NECESSARY AND PROPORTIONATE TO THE 26 PURPOSES LISTED IN THIS SECTION; AND 27 (II) ADEQUATE, RELEVANT, AND LIMITED TO WHAT IS 28 NECESSARY IN RELATION TO THE SPECIFIC PURPOSES LISTED IN THIS SECTION. 29 34 HOUSE BILL 567 (H) A PERSON THAT PROCESSES PERSONAL DATA FOR A PURPOSE 1 EXPRESSLY IDENTIFIED IN THIS SECTION MAY NOT BE CONSIDERED A CONTROLLER 2 SOLELY BASED ON THE PROCESSING OF PERSONAL DATA. 3 14–4613. 4 (A) EXCEPT AS PROVIDED IN SUBSECTION (B) OF THIS SECTION, A 5 VIOLATION OF THIS SUBTITLE IS: 6 (1) AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE PRACTICE WITHIN 7 THE MEANING OF TITLE 13 OF THIS ARTICLE; AND 8 (2) SUBJECT TO THE ENFORCEMENT AND PENALTY PROVISIONS 9 CONTAINED IN TITLE 13 OF THIS ARTICLE, EXCEPT FOR § 13–408 OF THIS ARTICLE. 10 (B) THIS SECTION DOES NOT PREVENT A CONSUMER FROM PURSUING ANY 11 OTHER REMEDY PROVIDED BY LAW. 12 SECTION 2. AND BE IT FURTHER ENACTED, That § 14–4612 of the Commercial 13 Law Article, as enacted by Section 1 of this Act, shall be construed to apply only 14 prospectively and may not be applied or interpreted to have any effect on or application to 15 any personal data processing activities before April 1, 2025. 16 SECTION 3. AND BE IT FURTHER ENACTED, That this Act shall take effect 17 October 1, 2024. 18

WES MOORE, Governor Ch. 454 – 1 – Chapter 454 (House Bill 567) AN ACT concerning Maryland Online Data Privacy Act of 2024 FOR the purpose of regulating the manner in which a controller or a processor in possession of a consumer’s personal data may process the consumer’s personal data; authorizing a consumer to exercise certain rights in regards to the consumer’s personal data; requiring a controller of personal data to establish a method for a consumer to exercise certain rights in regards to the consumer’s personal data; requiring a controller to comply with a request by a consumer to exercise a certain right in a certain manner, except under certain circumstances; authorizing a consumer to designate an authorized agent to act on the consumer’s behalf to opt out of the processing of the consumer’s personal data; requiring a controller to provide a consumer with a certain privacy notice; requiring a controller that uses a processor to process the personal data of consumers to enter into a contract with the processor that governs the processor’s data processing procedures; requiring a controller to conduct and document a data protection assessment for consumer data processing activities that present a heightened risk of harm to a consumer; making a violation of this Act an unfair, abusive, or deceptive trade practice that is subject to enforcement and penalties under the Maryland Consumer Protection Act; and generally relating to online data privacy. BY repealing and reenacting, with amendments, Article – Commercial Law Section 13–301(14)(xl) Annotated Code of Maryland (2013 Replacement Volume and 2023 Supplement) BY repealing and reenacting, without amendments, Article – Commercial Law Section 13–301(14)(xli) Annotated Code of Maryland (2013 Replacement Volume and 2023 Supplement) BY adding to Article – Commercial Law Section 13–301(14)(xlii); and 14–4601 through 14–4613 14–4614 to be under the new subtitle “Subtitle 46. Online Data Privacy Act” Annotated Code of Maryland (2013 Replacement Volume and 2023 Supplement) SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, That the Laws of Maryland read as follows: Ch. 454 2024 LAWS OF MARYLAND – 2 – Article – Commercial Law 13–301. Unfair, abusive, or deceptive trade practices include any: (14) Violation of a provision of: (xl) Title 14, Subtitle 13 of the Public Safety Article; [or] (xli) Title 14, Subtitle 45 of this article; or (XLII) TITLE 14, SUBTITLE 46 OF THIS ARTICLE; OR SUBTITLE 46. ONLINE DATA PRIVACY ACT. 14–4601. (A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS INDICATED. (B) “AFFILIATE” MEANS A PERSON THAT, DIRECTLY OR INDIRECTLY THROUGH ONE OR MORE INTERMEDIARIES, CONTROLS, IS CONTROLLED BY, OR IS UNDER COMMON CONTROL WITH ANOTHER PERSON, SUCH THAT THE PERSON: (1) SHARES COMMON BRANDING WITH ANOTHER PERSON; OR (2) CONTROLS, IS CONTROLLED BY, OR IS UNDER COMMON CONTROL WITH ANOTHER PERSON. (1) OWNS OR HAS THE POWER TO VOTE MORE THAN 50 PERCENT % OF THE OUTSTANDING SHARES OF ANY VOTING CLASS OF THE OTHER PERSON’S SECURITIES; (2) HAS THE POWER TO ELECT OR INFLUENCE THE ELECTION OF A MAJORITY OF THE DIRECTORS, MEMBERS, OR MANAGERS OF THE OTHER PERSON; (3) HAS THE POWER TO DIRECT THE MANAGEMENT OF THE OTHER PERSON; OR (4) IS SUBJECT TO THE OTHER PERSON’S EXERCISE OF THE POWERS DESCRIBED IN ITEM (1), (2), OR (3) OF THIS SUBSECTION. WES MOORE, Governor Ch. 454 – 3 – (C) “AUTHENTICATE” MEANS TO USE REASONABLE MEANS TO DETERMINE THAT A REQUEST TO EXERCISE A CONSUMER RIGHT IN ACCORDANCE WITH § 14–4605 OF THIS SUBTITLE IS BEING MADE BY, OR ON BEHALF OF, A CONSUMER WHO IS ENTITLED TO EXERCISE THE CONSUMER RIGHT WITH RESPECT TO THE PERSONAL DATA AT ISSUE. (D) (1) “BIOMETRIC DATA” MEANS DATA GENERATED BY AUTOMATIC MEASUREMENTS OF THE BIOLOGICAL CHARACTERISTICS OF A CONSUMER THAT CAN BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY. (2) “BIOMETRIC DATA” INCLUDES: (I) A FINGERPRINT; (II) A VOICE PRINT; (III) AN EYE RETINA OR IRIS IMAGE; AND (IV) ANY OTHER UNIQUE BIOLOGICAL CHARACTERISTICS THAT CAN BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY. (3) “BIOMETRIC DATA” DOES NOT INCLUDE: (I) A DIGITAL OR PHYSICAL PHOTOGRAPH; (II) AN AUDIO OR VIDEO RECORDING; OR (III) ANY DATA GENERATED FROM A DIGITAL OR PHYSICAL PHOTOGRAPH OR AN AUDIO OR VIDEO RECORDING, UNLESS THE DATA IS GENERATED TO IDENTIFY A SPECIFIC CONSUMER. (E) “BUSINESS ASSOCIATE” HAS THE MEANING STATED IN HIPAA. (F) “CHILD” HAS THE MEANING STATED IN COPPA. (G) (1) “CONSENT” MEANS A CLEAR AFFIRMATIVE ACT SIGNIFYING A CONSUMER’S FREELY GIVEN, SPECIFIC, INFORMED, AND UNAMBIGUOUS AGREEMENT TO ALLOW THE PROCESSING OF PERSONAL DATA RELATING TO THE CONSUMER FOR A PARTICULAR PURPOSE. (2) “CONSENT” INCLUDES: (I) A WRITTEN STATEMENT; Ch. 454 2024 LAWS OF MARYLAND – 4 – (II) A WRITTEN STATEMENT BY ELECTRONIC MEANS; OR (III) ANY OTHER UNAMBIGUOUS AFFIRMATIVE ACTION. (3) “CONSENT” DOES NOT INCLUDE: (I) ACCEPTANCE OF A GENERAL OR BROAD TERMS OF USE OR SIMILAR DOCUMENT THAT CONTAINS DESCRIPTIONS OF PERSONAL DATA PROCESSING ALONG WITH OTHER UNRELATED INFORMATION; (II) HOVERING OVER, MUTING, PAUSING, OR CLOSING A PIECE OF CONTENT; OR (III) AGREEMENT OBTAINED THROUGH THE USE OF DARK PATTERNS. (H) (1) “CONSUMER” MEANS AN INDIVIDUAL WHO IS A RESIDENT OF THE STATE. (2) “CONSUMER” DOES NOT INCLUDE: (I) AN INDIVIDUAL ACTING IN A COMMERCIAL OR EMPLOYMENT CONTEXT; OR (II) AN INDIVIDUAL ACTING AS AN EMPLOYEE, AN OWNER, A DIRECTOR, AN OFFICER, OR A CONTRACTOR OF A COMPANY, A PARTNERSHIP, A SOLE PROPRIETORSHIP, A NONPROFIT ORGANIZATION, OR A GOVERNMENTAL UNIT WHOSE COMMUNICATIONS OR TRANSACTIONS WITH A CONTROLLER OCCUR ONLY WITHIN THE CONTEXT OF THE INDIVIDUAL’S ROLE WITH THE COMPANY, PARTNERSHIP, SOLE PROPRIETORSHIP, NONPROFIT ORGANIZATION, OR GOVERNMENTAL UNIT. (I) (1) “CONSUMER HEALTH DATA” MEANS PERSONAL DATA THAT A CONTROLLER USES TO IDENTIFY A CONSUMER’S PHYSICAL OR MENTAL HEALTH STATUS. (2) “CONSUMER HEALTH DATA” INCLUDES DATA RELATED TO: (I) GENDER–AFFIRMING CARE TREATMENT; OR (II) REPRODUCTIVE OR SEXUAL HEALTH CARE. (J) “CONTROL” MEANS: WES MOORE, Governor Ch. 454 – 5 – (1) OWNERSHIP OF OR THE POWER TO VOTE MORE THAN 50% OF THE OUTSTANDING SHARES OF ANY CLASS OF VOTING SECURITY OF A BUSINESS; (2) ANY MANNER OF CONTROL OVER THE ELECTION OF A MAJORITY OF THE DIRECTORS OF A BUSINESS, OR INDIVIDUALS EXERCISING SIMILAR FUNCTIONS; OR (3) THE POWER TO EXERCISE A CONTROLLING INFLUENCE OVER THE MANAGEMENT OF A BUSINESS. (K) “CONTROLLER” MEANS A PERSON THAT, ALONE OR JOINTLY WITH OTHERS, DETERMINES THE PURPOSE AND MEANS OF PROCESSING PERSONAL DATA. (L) (1) “COPPA” MEANS THE FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT OF 1998 AND THE REGULATIONS, RULES, GUIDANCE, AND EXEMPTIONS ADOPTED UNDER THE ACT, AND AS THE ACT AND THE REGULATIONS, RULES, GUIDANCE, AND EXEMPTIONS MAY BE AMENDED. (2) “COPPA” INCLUDES REGULATIONS ADOPTED UNDER THE FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT OF 1998. (M) “COVERED ENTITY” HAS THE MEANING STATED IN HIPAA. (N) (1) “DARK PATTERN” MEANS A USER INTERFACE DESIGNED OR MANIPULATED WITH THE SUBSTANTIAL EFFECT OF SUBVERTING USER AUTONOMY, DECISION MAKING, OR CHOICE. (2) “DARK PATTERN” INCLUDES ANY PRACTICE THE FEDERAL TRADE COMMISSION REFERS TO AS A “DARK PATTERN”. (O) “DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING THE CONSUMER” MEANS DECISIONS THAT RESULT IN THE PROVISION OR DENIAL OF: (1) FINANCIAL OR LENDING SERVICES; (2) HOUSING; (3) INSURANCE; (4) (3) EDUCATION ENROLLMENT OR OPPORTUNITY; (5) (4) CRIMINAL JUSTICE; Ch. 454 2024 LAWS OF MARYLAND – 6 – (6) (5) EMPLOYMENT OPPORTUNITIES; (7) (6) HEALTH CARE SERVICES; OR (8) (7) ACCESS TO ESSENTIAL GOODS OR SERVICES. (P) “DE–IDENTIFIED DATA” MEANS DATA THAT CANNOT REASONABLY BE USED TO INFER INFORMATION ABOUT OR OTHERWISE BE LINKED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER, OR A DEVICE THAT MAY BE LINKED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER, IF THE CONTROLLER THAT POSSESSES THAT INFORMATION: (1) TAKES REASONABLE MEASURES TO ENSURE THAT THE INFORMATION CANNOT BE LINKED WITH A CONSUMER; (2) COMMITS IN PUBLICLY AVAILABLE TERMS AND CONDITIONS OR IN A PUBLICLY AVAILABLE PRIVACY POLICY TO MAINTAIN AND USE THE INFORMATION IN DE–IDENTIFIED FORM; AND (3) CONTRACTUALLY OBLIGES ANY RECIPIENTS OF THE INFORMATION TO COMPLY WITH ALL PROVISIONS OF THIS SUBSECTION HAS THE MEANING STATED IN § 14–4401 OF THIS TITLE. (Q) “GENDER–AFFIRMING TREATMENT” HAS THE MEANING STATED IN § 15–151(A) OF THE HEALTH – GENERAL ARTICLE. (Q) (R) (1) “GENETIC DATA” MEANS DATA IN ANY FORMAT THAT CONCERNS THE GENETIC CHARACTERISTICS OF A CONSUMER. (2) “GENETIC DATA” INCLUDES: (I) RAW SEQUENCE DATA THAT RESULTS FROM SEQUENCING OF A CONSUMER’S COMPLETE EXTRACTED DNA OR A PORTION OF THE CONSUMER’S COMPLETE EXTRACTED DNA; (II) GENOTYPIC AND PHENOTYPIC INFORMATION THAT RESULTS FROM ANALYZING RAW SEQUENCE DATA; (III) INFORMATION EXTRAPOLATED, DERIVED, OR INFERRED FROM THE ANALYSIS OF RAW SEQUENCE DATA; AND WES MOORE, Governor Ch. 454 – 7 – (IV) SELF–REPORTED HEALTH INFORMATION SUBMITTED TO A DIRECT–TO–CONSUMER GENETIC TESTING COMPANY BY A CONSUMER REGARDING THE CONSUMER’S HEALTH CONDITIONS: 1. THAT IS USED FOR SCIENTIFIC RESEARCH OR PRODUCT DEVELOPMENT; AND 2. ANALYZED IN CONNECTION WITH THE CONSUMER’S RAW SEQUENCE DATA HAS THE MEANING STATED IN § 14–4401 OF THIS TITLE. (R) (S) (1) “GEOFENCE” MEANS TECHNOLOGY THAT ESTABLISHES A VIRTUAL GEOGRAPHICAL BOUNDARY. (2) “GEOFENCE” INCLUDES BOUNDARIES THAT ARE ESTABLISHED OR MONITORED THROUGH THE USE OF: (I) GLOBAL POSITIONING TECHNOLOGY; (II) CELL TOWER CONNECTIVITY; (III) CELLULAR DATA; (IV) RADIO FREQUENCY IDENTIFICATION; (V) WIRELESS FIDELITY TECHNOLOGY; OR (VI) ANY OTHER FORM OF LOCATION DETERMINATION TECHNOLOGY. (S) (T) “HIPAA” MEANS THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996. (T) (U) “IDENTIFIED OR IDENTIFIABLE CONSUMER” MEANS A CONSUMER WHO CAN READILY BE IDENTIFIED, EITHER DIRECTLY OR INDIRECTLY. (U) (V) “MENTAL HEALTH FACILITY” MEANS A HEALTH CARE FACILITY IN WHICH NOT LESS THAN 70% OF HEALTH CARE SERVICES OFFERED ARE MENTAL HEALTH SERVICES. (V) (W) (1) “PERSONAL DATA” MEANS ANY INFORMATION THAT IS LINKED OR CAN BE REASONABLY LINKED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER. (2) “PERSONAL DATA” DOES NOT INCLUDE: Ch. 454 2024 LAWS OF MARYLAND – 8 – (I) DE–IDENTIFIED DATA; OR (II) PUBLICLY AVAILABLE INFORMATION. (W) (X) (1) “PRECISE GEOLOCATION DATA” MEANS INFORMATION DERIVED FROM TECHNOLOGY THAT CAN PRECISELY AND ACCURATELY IDENTIFY THE SPECIFIC LOCATION OF A CONSUMER WITHIN A RADIUS OF 1,750 FEET. (2) “PRECISE GEOLOCATION DATA” INCLUDES GLOBAL POSITIONING SYSTEM LEVEL LATITUDE AND LONGITUDE COORDINATES OR OTHER SIMILAR MECHANISMS. (3) “PRECISE GEOLOCATION DATA” DOES NOT INCLUDE: (I) THE CONTENT OF COMMUNICATIONS DATA; (II) DATA GENERATED BY OR CONNECTED TO AN ADVANCED UTILITY METERING INFRASTRUCTURE SYSTEM; OR (II) (III) EQUIPMENT DATA GENERATED BY EQUIPMENT USED BY A UTILITY COMPANY. (X) (Y) (1) “PROCESS” MEANS AN OPERATION OR SET OF OPERATIONS PERFORMED BY MANUAL OR AUTOMATED MEANS ON PERSONAL DATA. (2) “PROCESS” INCLUDES COLLECTING, USING, STORING, DISCLOSING, ANALYZING, DELETING, OR MODIFYING PERSONAL DATA. (Y) (Z) “PROCESSOR” MEANS A PERSON THAT PROCESSES PERSONAL DATA ON BEHALF OF A CONTROLLER. (Z) (AA) “PROFILING” MEANS ANY FORM OF AUTOMATED PROCESSING PERFORMED ON PERSONAL DATA TO EVALUATE, ANALYZE, OR PREDICT PERSONAL ASPECTS RELATED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER’S ECONOMIC SITUATION, HEALTH, DEMOGRAPHIC CHARACTERISTICS, PERSONAL PREFERENCES, INTERESTS, RELIABILITY, BEHAVIOR, LOCATION, OR MOVEMENTS. (AA) (BB) “PROTECTED HEALTH INFORMATION” HAS THE MEANING STATED IN HIPAA. (BB) (CC) (1) “PUBLICLY AVAILABLE INFORMATION” MEANS INFORMATION THAT A PERSON: WES MOORE, Governor Ch. 454 – 9 – (I) IS LAWFULLY MADE READILY AVAILABLE TO THE GENERAL PUBLIC THROUGH FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS; OR (II) A CONTROLLER HAS A REASONABLE BASIS TO BELIEVE THAT A CONSUMER HAS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC THROUGH WIDELY DISTRIBUTED MEDIA. (I) LAWFULLY OBTAINS FROM A RECORD OF A GOVERNMENTAL ENTITY; (II) REASONABLY BELIEVES A CONSUMER OR WIDELY DISTRIBUTED MEDIA HAS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC; OR (III) IF THE CONSUMER HAS NOT RESTRICTED THE INFORMATION TO A SPECIFIC AUDIENCE, OBTAINS FROM A PERSON TO WHOM THE CONSUMER DISCLOSED THE INFORMATION. (2) “PUBLICLY AVAILABLE INFORMATION” DOES NOT INCLUDE BIOMETRIC DATA COLLECTED BY A BUSINESS ABOUT A CONSUMER WITHOUT THE CONSUMER’S KNOWLEDGE. (CC) (DD) (1) “REPRODUCTIVE OR SEXUAL HEALTH CARE” MEANS CARE RELATED TO A HEALTH CARE–RELATED SERVICE OR PRODUCT RENDERED OR PROVIDED CONCERNING A CONSUMER’S REPRODUCTIVE SYSTEM OR SEXUAL WELL–BEING., INCLUDING: (2) “REPRODUCTIVE OR SEXUAL HEALTH CARE” INCLUDES: (I) (1) A SERVICE OR PRODUCT PROVIDED RELATED TO AN INDIVIDUAL HEALTH CONDITION, STATUS, DISEASE, DIAGNOSIS, TEST, OR TREATMENT; (II) (2) A SOCIAL, PSYCHOLOGICAL, BEHAVIORAL, OR MEDICAL INTERVENTION; (III) (3) A SURGERY OR PROCEDURE; (IV) (4) THE PURCHASE OR USE OF A MEDICATION, INCLUDING A MEDICATION PURCHASED OR USED FOR THE PURPOSES OF AN ABORTION; (V) (5) A SERVICE OR PRODUCT RELATED TO A BODILY FUNCTION, VITAL SIGN, OR MEASUREMENT THEREOF SYMPTOM; Ch. 454 2024 LAWS OF MARYLAND – 10 – (6) A MEASUREMENT OF A BODILY FUNCTION, VITAL SIGN, OR SYMPTOM; AND (VI) (7) AN ABORTION, WHETHER SURGICAL OR MEDICAL; AND (VII) A SERVICE RELATED TO AN ABORTION AND MEDICAL AND NONMEDICAL SERVICES, PRODUCTS, DIAGNOSTICS, COUNSELING, AND FOLLOW–UP SERVICES FOR AN ABORTION. (DD) (EE) “REPRODUCTIVE OR SEXUAL HEALTH FACILITY” MEANS A HEALTH CARE FACILITY WHERE NOT LESS THAN 70% OF SERVICES OFFERED ARE REPRODUCTIVE OR SEXUAL HEALTH CARE SERVICES. (EE) (FF) (1) “SALE OF PERSONAL DATA” MEANS THE EXCHANGE OF PERSONAL DATA BY A CONTROLLER, A PROCESSOR, OR AN AFFILIATE OF A CONTROLLER OR PROCESSOR TO A THIRD PARTY FOR MONETARY OR OTHER VALUABLE CONSIDERATION. (2) “SALE OF PERSONAL DATA” DOES NOT INCLUDE: (I) THE DISCLOSURE OF PERSONAL DATA TO A PROCESSOR THAT PROCESSES PERSONAL DATA ON BEHALF OF A CONTROLLER IF LIMITED TO THE PURPOSES OF THE PROCESSING; (II) THE DISCLOSURE OF PERSONAL DATA TO A THIRD PARTY FOR PURPOSES OF PROVIDING A PRODUCT OR SERVICE AFFIRMATIVELY REQUESTED BY THE CONSUMER; (III) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO AN AFFILIATE OF THE CONTROLLER FOR THE PURPOSE OF PROVIDING A PRODUCT OR SERVICE AFFIRMATIVELY REQUESTED BY THE CONSUMER; (IV) THE DISCLOSURE OF PERSONAL DATA WHERE THE CONSUMER: 1. DIRECTS THE CONTROLLER TO DISCLOSE THE PERSONAL DATA; OR 2. INTENTIONALLY USES THE CONTROLLER TO INTERACT WITH A THIRD PARTY; WES MOORE, Governor Ch. 454 – 11 – (V) THE DISCLOSURE OF PERSONAL DATA THAT THE CONSUMER: 1. INTENTIONALLY MADE AVAILABLE TO THE GENERAL PUBLIC THROUGH A CHANNEL OF MASS MEDIA; AND 2. DID NOT RESTRICT TO A SPECIFIC AUDIENCE; OR (VI) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO A THIRD PARTY AS AN ASSET THAT IS PART OF AN ACTUAL OR PROPOSED MERGER, ACQUISITION, BANKRUPTCY, OR OTHER TRANSACTION WHERE THE THIRD PARTY ASSUMES CONTROL OF ALL OR PART OF THE CONTROLLER’S ASSETS. (FF) (GG) “SENSITIVE DATA” MEANS PERSONAL DATA THAT INCLUDES: (1) DATA REVEALING: (I) RACIAL OR ETHNIC ORIGIN; (II) RELIGIOUS BELIEFS; (III) CONSUMER HEALTH DATA; (IV) SEX LIFE; (V) SEXUAL ORIENTATION; (VI) STATUS AS TRANSGENDER OR NONBINARY; (VII) NATIONAL ORIGIN; OR (VIII) CITIZENSHIP OR IMMIGRATION STATUS; (2) GENETIC DATA OR BIOMETRIC DATA; (3) PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER KNOWS OR HAS REASON TO KNOW IS A CHILD; OR (4) PRECISE GEOLOCATION DATA. (GG) (HH) (1) “TARGETED ADVERTISING” MEANS DISPLAYING ADVERTISEMENTS TO A CONSUMER OR ON A DEVICE IDENTIFIED BY A UNIQUE IDENTIFIER, WHERE THE ADVERTISEMENT IS SELECTED BASED ON PERSONAL DATA OBTAINED OR INFERRED FROM THE CONSUMER’S ACTIVITIES OVER TIME AND Ch. 454 2024 LAWS OF MARYLAND – 12 – ACROSS NONAFFILIATED WEBSITES OR ONLINE APPLICATIONS THAT ARE UNAFFILIATED WITH EACH OTHER, IN ORDER TO PREDICT THE CONSUMER’S PREFERENCES OR INTERESTS. (2) “TARGETED ADVERTISING” DOES NOT INCLUDE: (I) ADVERTISEMENTS BASED ON THE CONTEXT IN WHICH THE ADVERTISEMENT APPEARS AND DOES NOT VARY BASED ON WHO IS VIEWING THE ADVERTISEMENT OF A CONSUMER’S CURRENT SEARCH QUERY, VISIT TO A WEBSITE, OR ONLINE APPLICATION; (II) ADVERTISEMENTS BASED ON A CONSUMER’S ACTIVITIES WITHIN A CONTROLLER’S WEBSITES OR ONLINE APPLICATIONS; (III) ADVERTISEMENTS DIRECTED TO A CONSUMER IN RESPONSE TO THE CONSUMER’S REQUEST FOR INFORMATION OR FEEDBACK; OR (IV) PROCESSING PERSONAL DATA SOLELY TO MEASURE OR REPORT ADVERTISING FREQUENCY, PERFORMANCE, OR REACH. (HH) (II) “THIRD PARTY” MEANS A PERSON OTHER THAN THE RELEVANT CONSUMER, CONTROLLER, PROCESSOR, OR AFFILIATE OF THE CONTROLLER OR PROCESSOR OF RELEVANT PERSONAL DATA. (II) (JJ) (1) “TRADE SECRET” MEANS INFORMATION THAT: (I) DERIVES INDEPENDENT ECONOMIC VALUE, ACTUAL OR POTENTIAL, FROM NOT BEING GENERALLY KNOWN TO, AND NOT BEING READILY ASCERTAINABLE BY PROPER MEANS BY, OTHER PERSONS WHO COULD OBTAIN ECONOMIC VALUE FROM THE INFORMATION’S DISCLOSURE OR USE; AND (II) IS THE SUBJECT OF EFFORTS THAT ARE REASONABLE UNDER THE CIRCUMSTANCES TO MAINTAIN THE SECRECY OF THE INFORMATION. (2) “TRADE SECRET” INCLUDES A FORMULA, PATTERN, COMPILATION, PROGRAM, DEVICE, METHOD, TECHNIQUE, OR PROCESS HAS THE MEANING STATED IN § 11–1201 OF THIS ARTICLE. (KK) “TRANSFER” MEANS TO DISCLOSE, RELEASE, DISSEMINATE, MAKE AVAILABLE, LICENSE, RENT, OR SHARE PERSONAL DATA ORALLY, IN WRITING, ELECTRONICALLY, OR BY ANY OTHER MEANS. 14–4602. WES MOORE, Governor Ch. 454 – 13 – THIS SUBTITLE APPLIES TO A PERSON THAT CONDUCTS BUSINESS IN THE STATE OR PROVIDES PRODUCTS OR SERVICES THAT ARE TARGETED TO RESIDENTS OF THE STATE, AND THAT DURING THE PRECEDING CALENDAR YEAR DID ANY OF THE FOLLOWING: (1) CONDUCTS BUSINESS IN THE STATE; OR (2) (I) PRODUCES SERVICES OR PRODUCTS THAT ARE TARGETED TO RESIDENTS OF THE STATE; AND (II) DURING THE IMMEDIATELY PRECEDING CALENDAR YEAR: 1. (1) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION; OR 2. (2) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA. 14–4603. (A) THIS SUBTITLE DOES NOT APPLY TO: (1) A REGULATORY, ADMINISTRATIVE, ADVISORY, EXECUTIVE, APPOINTIVE, LEGISLATIVE, OR JUDICIAL BODY OR INSTRUMENTALITY OF THE STATE, INCLUDING A BOARD, BUREAU, COMMISSION, OR UNIT OF THE STATE OR A POLITICAL SUBDIVISION OF THE STATE; (2) A NATIONAL SECURITIES ASSOCIATION THAT IS REGISTERED UNDER § 15 OF THE FEDERAL SECURITIES EXCHANGE ACT OF 1934 OR A REGISTERED FUTURES ASSOCIATION DESIGNATED IN ACCORDANCE WITH § 17 OF THE FEDERAL COMMODITY EXCHANGE ACT; OR (3) A FINANCIAL INSTITUTION OR, AN AFFILIATE OF A FINANCIAL INSTITUTION, OR DATA THAT IS SUBJECT TO TITLE V OF THE FEDERAL GRAMM–LEACH–BLILEY ACT AND REGULATIONS ADOPTED UNDER THAT ACT; OR (4) A NONPROFIT CONTROLLER THAT PROCESSES OR SHARES PERSONAL DATA SOLELY FOR THE PURPOSES OF ASSISTING: Ch. 454 2024 LAWS OF MARYLAND – 14 – (I) LAW ENFORCEMENT AGENCIES IN INVESTIGATING CRIMINAL OR FRAUDULENT ACTS RELATING TO INSURANCE; OR (II) FIRST RESPONDERS IN RESPONDING TO CATASTROPHIC EVENTS. (B) THE FOLLOWING INFORMATION AND DATA ARE EXEMPT FROM THIS SUBTITLE: (1) PROTECTED HEALTH INFORMATION UNDER HIPAA; (2) PATIENT–IDENTIFYING INFORMATION FOR PURPOSES OF 42 U.S.C. § 290DD–2; (3) IDENTIFIABLE PRIVATE INFORMATION THAT IS USED FOR PURPOSES OF THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS IN ACCORDANCE WITH 45 C.F.R. § 46; (4) IDENTIFIABLE PRIVATE INFORMATION TO THE EXTENT THAT IT IS COLLECTED AND USED AS PART OF HUMAN SUBJECTS RESEARCH IN ACCORDANCE WITH THE ICH 36 GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY THE INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICAL REQUIREMENTS FOR PHARMACEUTICALS FOR HUMAN USE OR THE PROTECTION OF HUMAN SUBJECTS UNDER 21 C.F.R. §§ 50 AND 56; (5) PATIENT SAFETY WORK PRODUCT THAT IS CREATED AND USED FOR PURPOSES OF PATIENT SAFETY IMPROVEMENT IN ACCORDANCE WITH 42 C.F.R. § 3, ESTABLISHED IN ACCORDANCE WITH 42 U.S.C. §§ 299B–21 THROUGH 299B–26; (6) (I) INFORMATION TO THE EXTENT IT IS USED FOR PUBLIC HEALTH, COMMUNITY HEALTH, OR POPULATION HEALTH ACTIVITIES AND PURPOSES, AS AUTHORIZED BY HIPAA, WHEN PROVIDED BY OR TO A COVERED ENTITY OR WHEN PROVIDED BY OR TO A BUSINESS ASSOCIATE IN ACCORDANCE WITH THE BUSINESS ASSOCIATE AGREEMENT WITH A COVERED ENTITY; AND (II) INFORMATION COLLECTED, USED, OR DISCLOSED BY AN ENTITY IF: 1. THE ENTITY IS A COVERED ENTITY OR BUSINESS ASSOCIATE UNDER HIPAA BECAUSE IT COLLECTS, USES, OR DISCLOSES PROTECTED HEALTH INFORMATION; AND WES MOORE, Governor Ch. 454 – 15 – 2. THE ENTITY APPLIES THE SAME FEDERAL AND STATE STANDARDS FOR THE COLLECTION, USE, AND DISCLOSURE OF INFORMATION AS PROVIDED TO PROTECTED HEALTH INFORMATION UNDER HIPAA AND LEGALLY PROTECTED HEALTH CARE UNDER § 4–301 OF THE HEALTH – GENERAL ARTICLE FOR INFORMATION THAT: A. IS CONSIDERED A MEDICAL RECORD UNDER § 4–301 OF THE HEALTH – GENERAL ARTICLE; AND B. IS NOT CONSIDERED PROTECTED HEALTH INFORMATION UNDER HIPAA; (II) INFORMATION THAT IS A MEDICAL RECORD UNDER § 4–301 OF THE HEALTH – GENERAL ARTICLE IF: 1. THE INFORMATION IS HELD BY AN ENTITY THAT IS A COVERED ENTITY OR BUSINESS ASSOCIATE UNDER HIPAA BECAUSE IT COLLECTS, USES, OR DISCLOSES PROTECTED HEALTH INFORMATION; AND 2. THE ENTITY APPLIES THE SAME STANDARDS FOR THE COLLECTION, USE, AND DISCLOSURE OF THE INFORMATION AS REQUIRED FOR PROTECTED HEALTH INFORMATION UNDER HIPAA AND MEDICAL RECORDS UNDER § 4–301 OF THE HEALTH – GENERAL ARTICLE, INCLUDING SPECIFIC STANDARDS REGARDING LEGALLY PROTECTED HEALTH CARE; AND (III) INFORMATION THAT IS DE–IDENTIFIED IN ACCORDANCE WITH THE REQUIREMENTS FOR DE–IDENTIFICATION SET FORTH IN 45 C.F.R. 164.514 THAT IS DERIVED FROM INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION AS DESCRIBED IN HIPAA OR PERSONAL INFORMATION CONSISTENT WITH THE HUMAN SUBJECT PROTECTION REQUIREMENTS OF THE U.S. FOOD AND DRUG ADMINISTRATION; (7) THE COLLECTION, MAINTENANCE, DISCLOSURE, SALE, COMMUNICATION, OR USE OF PERSONAL INFORMATION BEARING ON A CONSUMER’S CREDITWORTHINESS, CREDIT STANDING, CREDIT CAPACITY, CHARACTER, GENERAL REPUTATION, PERSONAL CHARACTERISTICS, OR MODE OF LIVING BY A CONSUMER REPORTING AGENCY, FURNISHER, OR USER THAT PROVIDES INFORMATION FOR USE IN A CONSUMER REPORT, AND BY A USER OF A CONSUMER REPORT, BUT ONLY TO THE EXTENT THAT THE ACTIVITY IS REGULATED BY AND AUTHORIZED UNDER THE FEDERAL FAIR CREDIT REPORTING ACT; (8) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED IN COMPLIANCE WITH THE FEDERAL DRIVER’S PRIVACY PROTECTION ACT OF 1994; Ch. 454 2024 LAWS OF MARYLAND – 16 – (9) PERSONAL DATA REGULATED BY THE FEDERAL FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT; (10) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED IN COMPLIANCE WITH THE FEDERAL FARM CREDIT ACT; (11) DATA PROCESSED OR MAINTAINED: (I) IN THE COURSE OF AN INDIVIDUAL APPLYING TO, EMPLOYED BY, OR ACTING AS AN AGENT OR INDEPENDENT CONTRACTOR OF A CONTROLLER, PROCESSOR, OR THIRD PARTY, TO THE EXTENT THAT THE DATA IS COLLECTED AND USED WITHIN THE CONTEXT OF THE ROLE; (II) AS THE EMERGENCY CONTACT INFORMATION OF A CONSUMER IF THE DATA IS USED FOR EMERGENCY CONTACT PURPOSES; OR (III) THAT IS: 1. NECESSARY TO RETAIN TO ADMINISTER BENEFITS FOR ANOTHER INDIVIDUAL RELATING TO THE CONSUMER WHO IS THE SUBJECT OF THE INFORMATION UNDER ITEM (I) OF THIS ITEM; AND 2. USED FOR THE PURPOSES OF ADMINISTERING THE BENEFITS; AND (12) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED IN RELATION TO PRICE, ROUTE, OR SERVICE BY AN AIR CARRIER SUBJECT TO THE FEDERAL AIRLINE DEREGULATION ACT TO THE EXTENT THIS SUBTITLE IS PREEMPTED BY THE FEDERAL AIRLINE DEREGULATION ACT; AND (13) PERSONAL DATA COLLECTED BY OR ON BEHALF OF A PERSON REGULATED UNDER THE INSURANCE ARTICLE OR AN AFFILIATE OF SUCH A PERSON, IN FURTHERANCE OF THE BUSINESS OF INSURANCE. (C) CONTROLLERS AND PROCESSORS THAT COMPLY WITH THE VERIFIABLE PARENTAL CONSENT REQUIREMENTS OF COPPA SHALL BE CONSIDERED COMPLIANT WITH AN OBLIGATION TO OBTAIN PARENTAL CONSENT IN ACCORDANCE WITH THIS SUBTITLE WITH RESPECT TO A CONSUMER WHO IS A CHILD. 14–4604. A PERSON MAY NOT: WES MOORE, Governor Ch. 454 – 17 – (1) PROVIDE AN EMPLOYEE OR CONTRACTOR ACCESS TO CONSUMER HEALTH DATA UNLESS THE: (I) THE EMPLOYEE OR CONTRACTOR IS SUBJECT TO A CONTRACTUAL OR STATUTORY DUTY OF CONFIDENTIALITY; OR (II) CONFIDENTIALITY IS REQUIRED AS A CONDITION OF EMPLOYMENT OF THE EMPLOYEE; (2) PROVIDE A PROCESSOR ACCESS TO CONSUMER HEALTH DATA UNLESS THE PERSON PROVIDING ACCESS TO THE CONSUMER HEALTH DATA AND THE PROCESSOR COMPLY WITH § 14–4607 14–4608 OF THIS SUBTITLE; OR (3) USE A GEOFENCE: (I) TO IDENTIFY, TRACK, COLLECT DATA FROM, OR SEND A NOTIFICATION TO A CONSUMER REGARDING THE CONSUMER’S CONSUMER HEALTH DATA; AND (II) WITHIN 1,750 FEET OF A MENTAL HEALTH FACILITY OR REPRODUCTIVE OR SEXUAL HEALTH FACILITY; OR (4) SELL OR OFFER TO SELL CONSUMER HEALTH DATA WITHOUT THE CONSENT OF THE CONSUMER WHOSE HEALTH DATA IS TO BE SOLD OR OFFERED TO BE SOLD TO ESTABLISH A VIRTUAL BOUNDARY THAT IS WITHIN 1,750 FEET OF ANY MENTAL HEALTH FACILITY OR REPRODUCTIVE OR SEXUAL HEALTH FACILITY FOR THE PURPOSE OF IDENTIFYING, TRACKING, COLLECTING DATA FROM, OR SENDING ANY NOTIFICATION TO A CONSUMER REGARDING THE CONSUMER’S CONSUMER HEALTH DATA. 14–4605. (A) NOTHING IN THIS SECTION MAY BE CONSTRUED TO REQUIRE A CONTROLLER TO REVEAL A TRADE SECRET. (B) A CONSUMER SHALL HAVE THE RIGHT TO: (1) CONFIRM WHETHER A CONTROLLER IS PROCESSING THE CONSUMER’S PERSONAL DATA, UNLESS THAT CONFIRMATION WOULD REQUIRE THE DISCLOSURE OF A TRADE SECRET; (2) IF A CONTROLLER IS PROCESSING A CONSUMER’S PERSONAL DATA, ACCESS THE CONSUMER’S PERSONAL DATA UNLESS THAT ACCESS WOULD REQUIRE THE DISCLOSURE OF A TRADE SECRET; Ch. 454 2024 LAWS OF MARYLAND – 18 – (3) CONSIDERING THE NATURE OF THE CONSUMER’S PERSONAL DATA AND THE PURPOSES OF THE PROCESSING OF THE PERSONAL DATA, CORRECT INACCURACIES IN THE CONSUMER’S PERSONAL DATA; (4) REQUIRE A CONTROLLER TO DELETE PERSONAL DATA PROVIDED BY, OR OBTAINED ABOUT, THE CONSUMER UNLESS RETENTION OF THE PERSONAL DATA IS REQUIRED BY LAW; (5) IF THE PROCESSING OF PERSONAL DATA IS DONE BY AUTOMATIC MEANS, OBTAIN A COPY OF THE CONSUMER’S PERSONAL DATA PROCESSED BY THE CONTROLLER IN A PORTABLE AND, TO THE EXTENT TECHNICALLY FEASIBLE, READILY USABLE FORMAT THAT ALLOWS THE CONSUMER TO EASILY TRANSMIT THE DATA TO ANOTHER CONTROLLER WITHOUT HINDRANCE; (6) OBTAIN A LIST OF THE CATEGORIES OF THIRD PARTIES TO WHICH THE CONTROLLER HAS DISCLOSED THE CONSUMER’S PERSONAL DATA OR A LIST OF THE CATEGORIES OF THIRD PARTIES TO WHICH THE CONTROLLER HAS DISCLOSED ANY CONSUMER’S PERSONAL DATA IF THE CONTROLLER DOES NOT MAINTAIN THIS INFORMATION IN A FORMAT SPECIFIC TO THE CONSUMER; AND (7) OPT OUT OF THE PROCESSING OF PERSONAL DATA FOR PURPOSES OF: (I) TARGETED ADVERTISING; (II) THE SALE OF PERSONAL DATA; OR (III) PROFILING IN FURTHERANCE OF SOLELY AUTOMATED DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING THE CONSUMER. (C) (1) A CONTROLLER SHALL ESTABLISH A SECURE AND RELIABLE METHOD FOR A CONSUMER TO EXERCISE A CONSUMER RIGHT UNDER THIS SECTION. (2) A CONSUMER MAY EXERCISE A CONSUMER RIGHT UNDER THIS SECTION BY THE METHOD ESTABLISHED BY THE CONTROLLER UNDER PARAGRAPH (1) OF THIS SUBSECTION. (D) (1) A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT IN ACCORDANCE WITH § 14–4606 OF THIS SUBTITLE TO OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA UNDER SUBSECTION (B)(7) OF THIS SECTION ON BEHALF OF A CONSUMER. WES MOORE, Governor Ch. 454 – 19 – (2) A PARENT OR LEGAL GUARDIAN OF A CHILD MAY EXERCISE A CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE CHILD’S BEHALF REGARDING THE PROCESSING OF PERSONAL DATA. (3) A GUARDIAN OR CONSERVATOR OF A CONSUMER SUBJECT TO A GUARDIANSHIP, CONSERVATORSHIP, OR OTHER PROTECTIVE ARRANGEMENT MAY EXERCISE A CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE CONSUMER’S BEHALF REGARDING THE PROCESSING OF PERSONAL DATA. (E) (1) EXCEPT AS OTHERWISE PROVIDED IN THIS SUBTITLE, A CONTROLLER SHALL COMPLY WITH A REQUEST BY A CONSUMER TO EXERCISE A CONSUMER RIGHT LISTED IN THIS SECTION. (2) (I) A CONTROLLER SHALL RESPOND TO A CONSUMER REQUEST NOT LATER THAN 45 DAYS AFTER THE CONTROLLER RECEIVES THE CONSUMER REQUEST. (II) A CONTROLLER MAY EXTEND THE COMPLETION PERIOD BY AN ADDITIONAL 45 DAYS IF: 1. IT IS REASONABLY NECESSARY TO COMPLETE THE REQUEST BASED ON THE COMPLEXITY AND NUMBER OF THE CONSUMER’S REQUESTS; AND 2. THE CONTROLLER INFORMS THE CONSUMER OF THE EXTENSION AND THE REASON FOR THE EXTENSION WITHIN THE INITIAL 45–DAY RESPONSE PERIOD. (III) A CONTROLLER SHALL NOTIFY THE CONSUMER WITHIN 30 DAYS AFTER COMPLYING WITH THE CONSUMER’S REQUEST THAT THE CONTROLLER HAS COMPLIED WITH THE CONSUMER’S REQUEST. (3) IF A CONTROLLER DECLINES TO ACT REGARDING A CONSUMER’S REQUEST, THE CONTROLLER SHALL: (I) INFORM THE CONSUMER WITHOUT UNDUE DELAY, BUT NOT LATER THAN 45 DAYS AFTER RECEIVING THE REQUEST, OF THE JUSTIFICATION FOR DECLINING TO ACT; AND (II) PROVIDE INSTRUCTIONS FOR HOW TO APPEAL THE DECISION. Ch. 454 2024 LAWS OF MARYLAND – 20 – (4) (I) A CONTROLLER SHALL PROVIDE INFORMATION TO A CONSUMER IN RESPONSE TO A CONSUMER’S REQUEST TO EXERCISE RIGHTS UNDER THIS SUBTITLE FREE OF CHARGE ONCE DURING ANY 12–MONTH PERIOD. (II) IF REQUESTS FROM A CONSUMER ARE MANIFESTLY UNFOUNDED, EXCESSIVE, TECHNICALLY INFEASIBLE, OR REPETITIVE, A CONTROLLER MAY: 1. CHARGE THE CONSUMER A REASONABLE FEE TO COVER THE ADMINISTRATIVE COSTS OF COMPLYING WITH THE REQUEST; OR 2. DECLINE TO ACT ON THE REQUEST. (III) THE CONTROLLER HAS THE BURDEN OF DEMONSTRATING THE MANIFESTLY UNFOUNDED, EXCESSIVE, TECHNICALLY INFEASIBLE, OR REPETITIVE NATURE OF THE REQUEST. (5) IF A CONTROLLER IS UNABLE TO AUTHENTICATE A REQUEST TO EXERCISE A CONSUMER RIGHT AFFORDED UNDER SUBSECTION (B)(1) THROUGH (5) OF THIS SECTION USING COMMERCIALLY REASONABLE EFFORTS, THE CONTROLLER: (I) MAY NOT BE REQUIRED TO COMPLY WITH A REQUEST TO INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION; AND (II) SHALL PROVIDE NOTICE TO THE CONSUMER THAT THE CONTROLLER IS UNABLE TO AUTHENTICATE THE REQUEST TO EXERCISE THE RIGHT UNTIL THE CONSUMER PROVIDES ADDITIONAL INFORMATION REASONABLY NECESSARY TO AUTHENTICATE THE CONSUMER AND THE CONSUMER’S REQUEST TO EXERCISE THE CONSUMER’S RIGHTS. (6) A CONTROLLER MAY NOT BE REQUIRED TO AUTHENTICATE AN OPT–OUT REQUEST. (7) A CONTROLLER THAT HAS OBTAINED PERSONAL DATA ABOUT A CONSUMER FROM A SOURCE OTHER THAN THE CONSUMER SHALL BE CONSIDERED COMPLIANT WITH THE CONSUMER’S REQUEST TO DELETE THE CONSUMER’S DATA IN ACCORDANCE WITH SUBSECTION (B)(4) OF THIS SECTION BY RETAINING A RECORD OF THE DELETION REQUEST AND THE MINIMUM DATA NECESSARY FOR THE PURPOSE OF ENSURING THAT THE CONSUMER’S PERSONAL DATA: (I) REMAINS DELETED FROM THE CONTROLLER’S RECORDS; AND WES MOORE, Governor Ch. 454 – 21 – (II) IS NOT BEING USED FOR ANY OTHER PURPOSE. (F) (1) A CONTROLLER SHALL ESTABLISH A PROCESS FOR A CONSUMER TO APPEAL THE CONTROLLER’S REFUSAL TO ACT ON A CONSUMER RIGHTS REQUEST WITHIN A REASONABLE PERIOD AFTER THE CONSUMER RECEIVES THE DECISION. (2) THE APPEAL PROCESS SHALL BE: (I) CONSPICUOUSLY AVAILABLE; AND (II) SIMILAR TO THE PROCESS FOR SUBMITTING REQUESTS TO INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION. (3) NOT LATER THAN 60 DAYS AFTER RECEIVING AN APPEAL, A CONTROLLER SHALL INFORM THE CONSUMER IN WRITING OF ANY ACTION TAKEN OR NOT TAKEN IN RESPONSE TO THE APPEAL, INCLUDING A WRITTEN EXPLANATION OF THE REASONS FOR THE DECISIONS. (4) IF A CONTROLLER DENIES AN APPEAL, THE CONTROLLER SHALL PROVIDE THE CONSUMER WITH AN ONLINE MECHANISM, IF AVAILABLE, THROUGH WHICH THE CONSUMER MAY CONTACT THE DIVISION TO SUBMIT A COMPLAINT. 14–4606. (A) (1) A CONSUMER MAY DESIGNATE AN INDIVIDUAL TO SERVE AS THE CONSUMER’S AUTHORIZED AGENT AND ACT ON THE CONSUMER’S BEHALF TO OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR ONE OR MORE OF THE PURPOSES SPECIFIED IN § 14–4605(B)(7) OF THIS SUBTITLE. (2) A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT BY AN INTERNET LINK OR A BROWSER SETTING, BROWSER EXTENSION, GLOBAL DEVICE SETTING, OR OTHER SIMILAR TECHNOLOGY, INDICATING A CONSUMER’S INTENT TO OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA. (B) A CONTROLLER SHALL COMPLY WITH AN OPT–OUT REQUEST RECEIVED FROM AN AUTHORIZED AGENT IF, USING COMMERCIALLY REASONABLE EFFORTS, THE CONTROLLER IS ABLE TO AUTHENTICATE THE: (1) IDENTITY OF THE CONSUMER; AND (2) AUTHORIZED AGENT’S AUTHORITY TO ACT ON THE CONSUMER’S BEHALF. Ch. 454 2024 LAWS OF MARYLAND – 22 – 14–4607. (A) A CONTROLLER OR PROCESSOR MAY NOT: (1) COLLECT PERSONAL DATA FOR THE SOLE PURPOSE OF CONTENT PERSONALIZATION OR MARKETING WITHOUT THE CONSENT OF THE CONSUMER WHOSE PERSONAL DATA IS COLLECTED; (2) (1) EXCEPT WHERE THE COLLECTION OR PROCESSING IS STRICTLY NECESSARY TO PROVIDE OR MAINTAIN A SPECIFIC PRODUCT OR SERVICE REQUESTED BY THE CONSUMER TO WHOM THE PERSONAL DATA PERTAINS AND UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT, COLLECT, PROCESS, OR SHARE SENSITIVE DATA CONCERNING A CONSUMER; (3) (2) SELL SENSITIVE DATA; (4) (3) PROCESS PERSONAL DATA IN VIOLATION OF STATE OR FEDERAL LAWS THAT PROHIBIT UNLAWFUL DISCRIMINATION; (5) (4) PROCESS THE PERSONAL DATA OF A CONSUMER FOR THE PURPOSES OF TARGETED ADVERTISING IF THE CONTROLLER KNEW OR SHOULD HAVE KNOWN THAT THE CONSUMER IS AT LEAST 13 YEARS OLD AND UNDER THE AGE OF 18 YEARS; (6) (5) SELL THE PERSONAL DATA OF A CONSUMER WITHOUT THE CONSUMER’S CONSENT IF THE CONTROLLER KNEW OR SHOULD HAVE KNOWN THAT THE CONSUMER IS AT LEAST 13 YEARS OLD AND UNDER THE AGE OF 18 YEARS; (7) (6) DISCRIMINATE AGAINST A CONSUMER FOR EXERCISING A CONSUMER RIGHT CONTAINED IN THIS SUBTITLE, INCLUDING DENYING GOODS OR SERVICES, CHARGING DIFFERENT PRICES OR RATES FOR GOODS OR SERVICES, OR PROVIDING A DIFFERENT LEVEL OF QUALITY OF GOODS OR SERVICES TO THE CONSUMER; (8) (7) COLLECT, PROCESS, OR TRANSFER PERSONAL DATA OR PUBLICLY AVAILABLE DATA IN A MANNER THAT UNLAWFULLY DISCRIMINATES IN OR OTHERWISE UNLAWFULLY MAKES UNAVAILABLE THE EQUAL ENJOYMENT OF GOODS OR SERVICES ON THE BASIS OF RACE, COLOR, RELIGION, NATIONAL ORIGIN, SEX, SEXUAL ORIENTATION, GENDER IDENTITY, OR DISABILITY, UNLESS THE COLLECTION, PROCESSING, OR TRANSFER OF PERSONAL DATA IS FOR: (I) THE CONTROLLER’S SELF–TESTING TO PREVENT OR MITIGATE UNLAWFUL DISCRIMINATION; WES MOORE, Governor Ch. 454 – 23 – (II) THE CONTROLLER’S DIVERSIFYING OF AN APPLICANT, PARTICIPANT, OR CUSTOMER POOL; OR (III) A PRIVATE CLUB OR GROUP NOT OPEN TO THE PUBLIC, AS DESCRIBED IN § 201(E) OF THE CIVIL RIGHTS ACT OF 1964; OR (9) (8) UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT, PROCESS PERSONAL DATA FOR A PURPOSE THAT IS NEITHER REASONABLY NECESSARY TO, NOR COMPATIBLE WITH, THE DISCLOSED PURPOSES FOR WHICH THE PERSONAL DATA IS PROCESSED, AS DISCLOSED TO THE CONSUMER. (B) (1) A CONTROLLER OR PROCESSOR SHALL: (I) LIMIT THE COLLECTION OF PERSONAL DATA TO WHAT IS REASONABLY NECESSARY AND PROPORTIONATE TO PROVIDE OR MAINTAIN A SPECIFIC PRODUCT OR SERVICE REQUESTED BY THE CONSUMER TO WHOM THE DATA PERTAINS; (II) ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL DATA APPROPRIATE TO THE VOLUME AND NATURE OF THE PERSONAL DATA AT ISSUE; AND (III) PROVIDE AN EFFECTIVE MECHANISM FOR A CONSUMER TO REVOKE THE CONSUMER’S CONSENT UNDER THIS SECTION THAT IS AT LEAST AS EASY AS THE MECHANISM BY WHICH THE CONSUMER PROVIDED THE CONSUMER’S CONSENT. (2) IF A CONSUMER REVOKES CONSENT UNDER THIS SECTION, THE CONTROLLER SHALL STOP PROCESSING THE CONSUMER’S PERSONAL DATA AS SOON AS PRACTICABLE, BUT NOT LATER THAN 15 30 DAYS AFTER RECEIVING THE REQUEST. (C) NOTHING IN SUBSECTION (A) OR (B) OF THIS SECTION MAY BE CONSTRUED TO: (1) REQUIRE A CONTROLLER TO PROVIDE A PRODUCT OR SERVICE THAT REQUIRES THE PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER DOES NOT COLLECT OR MAINTAIN; OR (2) PROHIBIT A CONTROLLER FROM OFFERING A DIFFERENT PRICE, RATE, LEVEL, QUALITY, OR SELECTION OF GOODS OR SERVICES TO A CONSUMER, Ch. 454 2024 LAWS OF MARYLAND – 24 – INCLUDING OFFERING GOODS OR SERVICES FOR NO FEE, IF THE OFFERING IS IN CONNECTION WITH A CONSUMER’S VOLUNTARY PARTICIPATION IN A BONA FIDE LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNTS, OR CLUB CARD PROGRAM THAT DOES NOT: (I) PROVIDE FOR THE TRANSFER OF PERSONAL DATA TO A THIRD PARTY AS PART OF THE PROGRAM UNLESS: 1. THE TRANSFER IS FUNCTIONALLY NECESSARY TO ENABLE THE THIRD PARTY TO PROVIDE A BENEFIT TO WHICH THE CONSUMER IS ENTITLED; 2. THE TRANSFER OF PERSONAL DATA TO THE THIRD PARTY IS CLEARLY DISCLOSED IN THE TERMS OF THE PROGRAM; AND 3. THE THIRD PARTY USES THE PERSONAL DATA ONLY FOR PURPOSES OF FACILITATING A BENEFIT TO WHICH THE CONSUMER IS ENTITLED AND DOES NOT PROCESS OR TRANSFER THE PERSONAL DATA FOR ANY OTHER PURPOSE; OR (II) USE FINANCIAL INCENTIVE PRACTICES THAT ARE UNJUST, UNREASONABLE, COERCIVE, OR USURIOUS IN NATURE. (3) A SALE OF PERSONAL DATA MAY NOT BE CONSIDERED FUNCTIONALLY NECESSARY TO PROVIDE A PROGRAM THAT MEETS THE DESCRIPTION UNDER PARAGRAPH (2)(I) OF THIS SUBSECTION, PROVIDED THAT THE SELLING OF PERSONAL DATA IS NOT A CONDITION OF PARTICIPATION IN THE PROGRAM. (D) A CONTROLLER SHALL PROVIDE A CONSUMER WITH A REASONABLY ACCESSIBLE, CLEAR, AND MEANINGFUL PRIVACY NOTICE THAT INCLUDES: (1) THE CATEGORIES OF PERSONAL DATA PROCESSED BY THE CONTROLLER, INCLUDING SENSITIVE DATA; (2) THE CONTROLLER’S PURPOSE FOR PROCESSING PERSONAL DATA; (3) HOW A CONSUMER MAY EXERCISE THE CONSUMER’S RIGHTS UNDER THIS SUBTITLE, INCLUDING HOW A CONSUMER MAY APPEAL A CONTROLLER’S DECISION REGARDING THE CONSUMER’S REQUEST OR MAY REVOKE CONSENT; WES MOORE, Governor Ch. 454 – 25 – (4) THE CATEGORIES OF THIRD PARTIES WITH WHICH THE CONTROLLER SHARES PERSONAL DATA WITH A LEVEL OF DETAIL THAT ENABLES A CONSUMER TO UNDERSTAND WHAT TYPE OF ENTITY EACH THIRD PARTY IS AND, TO THE EXTENT POSSIBLE, HOW EACH THIRD PARTY MAY PROCESS THE PERSONAL DATA THE TYPE OF, BUSINESS MODEL OF, OR PROCESSING CONDUCTED BY THE EACH THIRD PARTY; (5) THE CATEGORIES OF PERSONAL DATA, INCLUDING SENSITIVE DATA, THAT THE CONTROLLER SHARES WITH THIRD PARTIES; AND (6) AN ACTIVE E–MAIL ADDRESS OR OTHER ONLINE MECHANISM THAT A CONSUMER MAY USE TO CONTACT THE CONTROLLER. (E) (1) IF A CONTROLLER SELLS PERSONAL DATA TO THIRD PARTIES OR PROCESSES PERSONAL DATA FOR TARGETED ADVERTISING OR FOR THE PURPOSES OF PROFILING THE CONSUMER IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS, THE CONTROLLER SHALL CLEARLY AND CONSPICUOUSLY DISCLOSE THE SALE OR PROCESSING, AS WELL AS THE MANNER IN WHICH A CONSUMER MAY EXERCISE THE RIGHT TO OPT OUT OF THE SALE OR PROCESSING. (2) THE DISCLOSURE REQUIRED UNDER PARAGRAPH (1) OF THIS SUBSECTION SHALL BE PROMINENTLY DISPLAYED, AND USE CLEAR, EASY TO UNDERSTAND, AND UNAMBIGUOUS LANGUAGE, TO STATE WHETHER THE CONSUMER’S PERSONAL DATA WILL BE SOLD OR SHARED WITH A THIRD PARTY. (F) (1) THE PRIVACY NOTICE UNDER SUBSECTION (D) OF THIS SECTION SHALL ESTABLISH ONE OR MORE SECURE AND RELIABLE METHODS FOR A CONSUMER TO SUBMIT A REQUEST TO EXERCISE A CONSUMER RIGHT IN ACCORDANCE WITH THIS SUBTITLE THAT TAKE INTO ACCOUNT: (I) THE WAYS IN WHICH CONSUMERS NORMALLY INTERACT WITH THE CONTROLLER; (II) THE NEED FOR SECURE AND RELIABLE COMMUNICATION OF CONSUMER REQUESTS; AND (III) THE ABILITY OF THE CONTROLLER TO VERIFY THE IDENTITY OF A CONSUMER MAKING THE REQUEST. (2) (I) A CONTROLLER MAY NOT REQUIRE A CONSUMER TO CREATE A NEW ACCOUNT IN ORDER TO EXERCISE A CONSUMER RIGHT. Ch. 454 2024 LAWS OF MARYLAND – 26 – (II) A CONTROLLER MAY REQUIRE A CONSUMER TO USE AN EXISTING ACCOUNT TO EXERCISE A CONSUMER RIGHT. (3) A CONTROLLER MAY UTILIZE THE FOLLOWING METHODS TO SATISFY PARAGRAPH (1) OF THIS SUBSECTION: (I) PROVIDING A CLEAR AND CONSPICUOUS LINK ON THE CONTROLLER’S WEBSITE TO A WEBPAGE THAT ALLOWS A CONSUMER, OR AN AUTHORIZED AGENT OF THE CONSUMER, TO OPT OUT OF THE TARGETED ADVERTISING OR THE SALE OF THE CONSUMER’S PERSONAL DATA; OR (II) ON OR BEFORE OCTOBER 1, 2025, ALLOWING A CONSUMER TO OPT OUT OF ANY PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR THE PURPOSES OF TARGETED ADVERTISING, OR ANY SALE OF PERSONAL DATA, THROUGH AN OPT–OUT PREFERENCE SIGNAL SENT, WITH THE CONSUMER’S CONSENT, BY A PLATFORM, TECHNOLOGY, OR MECHANISM TO THE CONTROLLER INDICATING THE CONSUMER’S INTENT TO OPT OUT OF THE PROCESSING OR SALE. (4) A PLATFORM, TECHNOLOGY, OR MECHANISM USED IN ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION SHALL: (I) BE CONSUMER–FRIENDLY AND EASY TO USE BY THE AVERAGE CONSUMER; (II) USE CLEAR, EASY TO UNDERSTAND, AND UNAMBIGUOUS LANGUAGE; (III) BE AS CONSISTENT AS POSSIBLE WITH ANY OTHER SIMILAR PLATFORM, TECHNOLOGY, OR MECHANISM REQUIRED BY ANY FEDERAL OR STATE LAW OR REGULATION; (IV) ENABLE THE CONTROLLER TO REASONABLY DETERMINE WHETHER THE CONSUMER: 1. IS A RESIDENT OF THE STATE; AND 2. HAS MADE A LEGITIMATE REQUEST TO OPT OUT OF ANY SALE OF THE CONSUMER’S PERSONAL DATA OR TARGETED ADVERTISING; AND (V) REQUIRE A CONSUMER TO MAKE AN AFFIRMATIVE, UNAMBIGUOUS, AND VOLUNTARY CHOICE IN ORDER TO OPT OUT OF ANY PROCESSING OF THE CONSUMER’S PERSONAL DATA. WES MOORE, Governor Ch. 454 – 27 – (5) A PLATFORM, TECHNOLOGY, OR MECHANISM USED IN ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION MAY NOT: (I) UNFAIRLY DISADVANTAGE ANOTHER CONTROLLER; OR (II) USE A DEFAULT SETTING TO OPT A CONSUMER OUT OF ANY PROCESSING OF THE CONSUMER’S PERSONAL DATA. (G) (1) IF A CONSUMER’S DECISION TO OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR THE PURPOSES OF TARGETED ADVERTISING, OR THE SALE OF PERSONAL DATA THROUGH AN OPT–OUT PREFERENCE SIGNAL SENT IN ACCORDANCE WITH SUBSECTION (F)(3) OF THIS SECTION CONFLICTS WITH THE CONSUMER’S EXISTING CONTROLLER–SPECIFIC PRIVACY SETTING OR THE CONSUMER’S VOLUNTARY PARTICIPATION IN A CONTROLLER’S BONA FIDE LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNTS, OR CLUB CARD PROGRAM, THE CONTROLLER MAY NOTIFY THE CONSUMER OF A CONFLICT AND PROVIDE THE CHOICE TO CONFIRM CONTROLLER–SPECIFIC PRIVACY SETTINGS OR PARTICIPATION IN A PROGRAM LISTED IN THIS PARAGRAPH. (2) A CONTROLLER THAT RECOGNIZES SIGNALS APPROVED BY OTHER STATES SHALL BE CONSIDERED IN COMPLIANCE WITH THIS SECTION. 14–4608. (A) (1) IF A CONTROLLER USES A PROCESSOR TO PROCESS THE PERSONAL DATA OF CONSUMERS, THE CONTROLLER AND THE PROCESSOR SHALL ENTER INTO A CONTRACT THAT GOVERNS THE PROCESSOR’S DATA PROCESSING PROCEDURES WITH RESPECT TO PROCESSING PERFORMED ON BEHALF OF THE CONTROLLER. (2) THE CONTRACT SHALL BE BINDING AND CLEARLY SET FORTH INSTRUCTIONS FOR: (I) PROCESSING INSTRUCTIONS FOR PROCESSING DATA; (II) THE NATURE AND PURPOSE OF PROCESSING; (III) THE TYPE OF DATA SUBJECT TO PROCESSING; (IV) THE DURATION OF PROCESSING; AND (V) THE RIGHTS AND OBLIGATIONS OF BOTH PARTIES. (3) THE CONTRACT SHALL REQUIRE THAT THE PROCESSOR: Ch. 454 2024 LAWS OF MARYLAND – 28 – (I) ENSURE THAT EACH PERSON PROCESSING PERSONAL DATA IS SUBJECT TO A DUTY OF CONFIDENTIALITY WITH RESPECT TO THE PERSONAL DATA; (II) ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL DATA, CONSIDERING THE VOLUME AND NATURE OF THE PERSONAL DATA; (III) STOP PROCESSING DATA ON REQUEST BY THE CONTROLLER MADE IN ACCORDANCE WITH A CONSUMER’S AUTHENTICATED REQUEST; (IV) AT THE CONTROLLER’S DIRECTION, DELETE OR RETURN ALL PERSONAL DATA TO THE CONTROLLER AS REQUESTED AT THE END OF THE PROVISION OF SERVICE, UNLESS RETENTION OF THE PERSONAL DATA IS REQUIRED BY LAW; (V) ON THE REASONABLE REQUEST OF THE CONTROLLER, MAKE AVAILABLE TO THE CONTROLLER ALL INFORMATION IN THE PROCESSOR’S POSSESSION NECESSARY TO DEMONSTRATE THE PROCESSOR’S COMPLIANCE WITH THE OBLIGATIONS IN THIS SUBTITLE; (VI) AFTER PROVIDING THE CONTROLLER AN OPPORTUNITY TO OBJECT, ENGAGE A SUBCONTRACTOR TO ASSIST WITH PROCESSING PERSONAL DATA ON THE CONTROLLER’S BEHALF ONLY IN ACCORDANCE WITH A WRITTEN CONTRACT THAT REQUIRES THE SUBCONTRACTOR TO MEET THE PROCESSOR’S OBLIGATIONS REGARDING THE PERSONAL DATA UNDER THE PROCESSOR’S CONTRACT WITH THE CONTROLLER; AND (VII) ALLOW AND COOPERATE WITH REASONABLE ASSESSMENTS BY THE CONTROLLER, THE CONTROLLER’S DESIGNATED ASSESSOR, OR A QUALIFIED AND INDEPENDENT ASSESSOR ARRANGED FOR BY THE PROCESSOR TO ASSESS THE PROCESSOR’S POLICIES AND TECHNICAL AND ORGANIZATIONAL MEASURES IN SUPPORT OF THE OBLIGATIONS UNDER THIS SUBTITLE. (4) (I) ON REQUEST, THE PROCESSOR SHALL PROVIDE A REPORT OF AN ASSESSMENT REQUIRED BY PARAGRAPH (3)(V) OF THIS SUBSECTION TO THE CONTROLLER. (II) AN ASSESSMENT CONDUCTED IN ACCORDANCE WITH PARAGRAPH (3)(V) OF THIS SUBSECTION SHALL BE CONDUCTED USING AN WES MOORE, Governor Ch. 454 – 29 – APPROPRIATE AND ACCEPTED CONTROL STANDARD OR FRAMEWORK AND ASSESSMENT PROCEDURE FOR THE ASSESSMENTS. (B) (1) IF A CONTROLLER USES A PROCESSOR TO PROCESS THE PERSONAL DATA OF CONSUMERS, THE CONTROLLER SHALL PROVIDE THE PROCESSOR WITH INSTRUCTIONS ON HOW TO PROCESS PERSONAL DATA. (2) A PROCESSOR SHALL: (I) (1) ADHERE TO THE CONTRACT AND INSTRUCTIONS OF A CONTROLLER; (II) (2) ASSIST THE CONTROLLER IN MEETING THE CONTROLLER’S OBLIGATIONS UNDER THIS SUBTITLE, INCLUDING, CONSIDERING THE NATURE OF PROCESSING AND THE INFORMATION AVAILABLE TO THE PROCESSOR: 1. (I) BY APPROPRIATE TECHNICAL AND ORGANIZATIONAL MEASURES AS MUCH AS REASONABLY PRACTICABLE TO FULFILL THE CONTROLLER’S OBLIGATION TO RESPOND TO CONSUMER RIGHTS REQUESTS, CONSIDERING THE NATURE OF PROCESSING AND THE INFORMATION AVAILABLE TO THE PROCESSOR; AND 2. (II) BY ASSISTING THE CONTROLLER IN MEETING THE CONTROLLER’S OBLIGATIONS IN RELATION TO THE SECURITY OF PROCESSING THE PERSONAL DATA AND IN RELATION TO THE NOTIFICATION OF A BREACH OF THE SECURITY OF A SYSTEM, AS DEFINED IN § 14–3504 OF THIS TITLE; AND (III) (3) PROVIDE NECESSARY INFORMATION TO ENABLE THE CONTROLLER TO CONDUCT AND DOCUMENT DATA PROTECTION ASSESSMENTS. (C) NOTHING IN THIS SECTION MAY BE CONSTRUED TO RELIEVE A CONTROLLER OR A PROCESSOR FROM THE LIABILITIES IMPOSED ON THE CONTROLLER OR PROCESSOR BY VIRTUE OF THE CONTROLLER’S OR PROCESSOR’S ROLE IN THE PROCESSING RELATIONSHIP IN ACCORDANCE WITH THIS SECTION. (D) (1) THE DETERMINATION OF WHETHER A PERSON IS ACTING AS A CONTROLLER OR A PROCESSOR WITH RESPECT TO A SPECIFIC PROCESSING OF DATA IS A FACT–BASED DETERMINATION THAT DEPENDS ON THE CONTEXT IN WHICH PERSONAL DATA IS BEING PROCESSED. (2) A PERSON IS CONSIDERED TO BE A CONTROLLER IF THE PERSON: Ch. 454 2024 LAWS OF MARYLAND – 30 – (I) IS NOT LIMITED IN THE PERSON’S PROCESSING OF SPECIFIC PERSONAL DATA IN ACCORDANCE WITH A CONTROLLER’S INSTRUCTIONS; OR (II) FAILS TO ADHERE TO A CONTROLLER’S INSTRUCTIONS WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA. (3) A PROCESSOR THAT CONTINUES TO ADHERE TO A CONTROLLER’S INSTRUCTIONS WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA REMAINS A PROCESSOR. (4) IF A PROCESSOR OR THIRD PARTY BEGINS, ALONE OR JOINTLY WITH OTHERS, DETERMINING THE PURPOSES AND MEANS OF THE PROCESSING OF PERSONAL DATA, THE PROCESSOR: (I) IS A CONTROLLER WITH RESPECT TO THE PROCESSING; AND (II) MAY BE SUBJECT TO AN ENFORCEMENT ACTION UNDER THIS SUBTITLE. (E) NOTHING IN THIS SECTION MAY BE CONSTRUED TO ALTER A CONTROLLER’S OBLIGATION TO LIMIT A PERSON’S PROCESSING OF PERSONAL DATA OR TO TAKE STEPS TO ENSURE THAT A PROCESSOR ADHERES TO THE CONTROLLER’S INSTRUCTIONS. 14–4609. (A) IF A THIRD PARTY USES OR SHARES A CONSUMER’S INFORMATION IN A MANNER INCONSISTENT WITH PROMISES MADE TO THE CONSUMER AT THE TIME OF COLLECTION OF THE INFORMATION, THE THIRD PARTY SHALL PROVIDE AN AFFECTED CONSUMER WITH NOTICE OF THE NEW OR CHANGED PRACTICE BEFORE IMPLEMENTING THE NEW OR CHANGED PRACTICE. (B) THE NOTICE PROVIDED UNDER SUBSECTION (A) OF THIS SECTION SHALL BE PROVIDED IN A MANNER AND AT A TIME REASONABLY CALCULATED TO ALLOW A CONSUMER TO EXERCISE THE RIGHTS PROVIDED UNDER THIS SUBTITLE. 14–4610. (A) IN THIS SECTION, “PROCESSING ACTIVITIES THAT PRESENT A HEIGHTENED RISK OF HARM TO A CONSUMER” MEANS: (1) THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF TARGETED ADVERTISING; WES MOORE, Governor Ch. 454 – 31 – (2) THE SALE OF PERSONAL DATA; (3) THE PROCESSING OF SENSITIVE DATA; AND (4) THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF PROFILING, IN WHICH THE PROFILING PRESENTS A REASONABLY FORESEEABLE RISK OF: (I) UNFAIR, ABUSIVE, OR DECEPTIVE TREATMENT OF A CONSUMER; (II) HAVING AN UNLAWFUL DISPARATE IMPACT ON A CONSUMER; (III) FINANCIAL, PHYSICAL, OR REPUTATIONAL INJURY TO A CONSUMER; (IV) A PHYSICAL OR OTHER INTRUSION ON THE SOLITUDE OR SECLUSION OR THE PRIVATE AFFAIRS OR CONCERNS OF A CONSUMER IN WHICH THE INTRUSION WOULD BE OFFENSIVE TO A REASONABLE PERSON; OR (V) OTHER SUBSTANTIAL INJURY TO A CONSUMER. (B) A CONTROLLER SHALL CONDUCT AND DOCUMENT, ON A REGULAR BASIS, A DATA PROTECTION ASSESSMENT FOR EACH OF THE CONTROLLER’S PROCESSING ACTIVITIES THAT PRESENT A HEIGHTENED RISK OF HARM TO A CONSUMER, INCLUDING AN ASSESSMENT FOR EACH ALGORITHM THAT IS USED. (C) (1) A DATA PROTECTION ASSESSMENT CONDUCTED IN ACCORDANCE WITH THIS SECTION SHALL IDENTIFY AND WEIGH THE BENEFITS THAT MAY FLOW DIRECTLY AND INDIRECTLY FROM THE PROCESSING TO THE CONTROLLER, THE CONSUMER, OTHER INTERESTED PARTIES, AND THE PUBLIC AGAINST: (I) THE POTENTIAL RISKS TO THE RIGHTS OF THE CONSUMER ASSOCIATED WITH THE PROCESSING AS MITIGATED BY SAFEGUARDS THAT MAY BE EMPLOYED BY THE CONTROLLER TO REDUCE THESE RISKS; AND (II) THE NECESSITY AND PROPORTIONALITY OF PROCESSING IN RELATION TO THE STATED PURPOSE OF THE PROCESSING. (2) THE CONTROLLER SHALL FACTOR INTO A DATA PROTECTION ASSESSMENT: Ch. 454 2024 LAWS OF MARYLAND – 32 – (I) THE USE OF DE–IDENTIFIED DATA; (II) THE REASONABLE EXPECTATIONS OF CONSUMERS; (III) THE CONTEXT OF THE PROCESSING; AND (IV) THE RELATIONSHIP BETWEEN THE CONTROLLER AND THE CONSUMER WHOSE PERSONAL DATA WILL BE PROCESSED. (D) (1) THE DIVISION MAY REQUIRE THAT A CONTROLLER MAKE AVAILABLE TO THE DIVISION A DATA PROTECTION ASSESSMENT THAT IS RELEVANT TO AN INVESTIGATION CONDUCTED BY THE DIVISION. (2) (I) THE DIVISION MAY EVALUATE A DATA PROTECTION ASSESSMENT FOR COMPLIANCE WITH THE RESPONSIBILITIES ESTABLISHED IN THIS SUBTITLE. (II) A CONTROLLER’S DATA PROTECTION ASSESSMENT MAY BE USED IN AN ACTION TO ENFORCE THIS SUBTITLE. (3) A DATA PROTECTION ASSESSMENT IS CONFIDENTIAL AND IS EXEMPT FROM DISCLOSURE UNDER THE FEDERAL FREEDOM OF INFORMATION ACT OR THE PUBLIC INFORMATION ACT. (E) A SINGLE DATA PROTECTION ASSESSMENT MAY ADDRESS A COMPARABLE SET OF PROCESSING OPERATIONS THAT INCLUDE SIMILAR ACTIVITIES. (F) IF A CONTROLLER CONDUCTS A DATA PROTECTION ASSESSMENT FOR THE PURPOSE OF COMPLYING WITH ANOTHER APPLICABLE LAW OR REGULATION, THE DATA PROTECTION ASSESSMENT SHALL BE CONSIDERED TO SATISFY THE REQUIREMENTS ESTABLISHED IN THIS SECTION IF THE DATA PROTECTION ASSESSMENT IS REASONABLY SIMILAR IN SCOPE AND EFFECT TO THE DATA PROTECTION ASSESSMENT THAT WOULD OTHERWISE BE CONDUCTED IN ACCORDANCE WITH THIS SECTION. (G) TO THE EXTENT THAT ANY INFORMATION CONTAINED IN A DATA PROTECTION ASSESSMENT DISCLOSED TO THE DIVISION INCLUDES INFORMATION SUBJECT TO ATTORNEY–CLIENT PRIVILEGE OR WORK PRODUCT PROTECTION, THE DISCLOSURE MAY NOT CONSTITUTE A WAIVER OF THAT PRIVILEGE OR PROTECTION. (H) A DATA PROTECTION ASSESSMENT CONDUCTED UNDER THIS SECTION: WES MOORE, Governor Ch. 454 – 33 – (1) SHALL APPLY TO PROCESSING ACTIVITIES THAT OCCUR ON OR AFTER OCTOBER 1, 2025; AND (2) IS NOT REQUIRED FOR PROCESSING ACTIVITIES THAT OCCUR BEFORE OCTOBER 1, 2025. 14–4611. (A) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A CONTROLLER OR A PROCESSOR TO: (1) RE–IDENTIFY DE–IDENTIFIED DATA; (2) MAINTAIN DATA IN AN IDENTIFIABLE FORM; OR (3) COLLECT, OBTAIN, RETAIN, OR ACCESS ANY DATA OR TECHNOLOGY IN ORDER TO BE CAPABLE OF ASSOCIATING AN AUTHENTICATED CONSUMER REQUEST WITH PERSONAL DATA. (B) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A CONTROLLER OR PROCESSOR TO COMPLY WITH AN AUTHENTICATED CONSUMER RIGHTS REQUEST IF THE CONTROLLER: (1) IS NOT REASONABLY CAPABLE OF ASSOCIATING THE REQUEST WITH THE PERSONAL DATA OR IT WOULD BE UNREASONABLY BURDENSOME FOR THE CONTROLLER TO ASSOCIATE THE REQUEST WITH THE PERSONAL DATA; (2) DOES NOT USE THE PERSONAL DATA TO RECOGNIZE OR RESPOND TO THE SPECIFIC CONSUMER WHO IS THE SUBJECT OF THE PERSONAL DATA OR ASSOCIATE THE PERSONAL DATA WITH OTHER PERSONAL DATA ABOUT THE SAME SPECIFIC CONSUMER; AND (3) DOES NOT SELL THE PERSONAL DATA TO A THIRD PARTY OR OTHERWISE VOLUNTARILY DISCLOSE THE PERSONAL DATA TO A THIRD PARTY OTHER THAN A PROCESSOR, EXCEPT AS OTHERWISE ALLOWED IN THIS SUBTITLE. (C) (1) A CONTROLLER THAT DISCLOSES DE–IDENTIFIED DATA SHALL: (I) EXERCISE REASONABLE OVERSIGHT TO MONITOR COMPLIANCE WITH ANY CONTRACTUAL COMMITMENTS TO WHICH THE DE–IDENTIFIED DATA IS SUBJECT; AND (II) TAKE APPROPRIATE STEPS TO ADDRESS ANY BREACHES OF ANY CONTRACTUAL COMMITMENTS. Ch. 454 2024 LAWS OF MARYLAND – 34 – (2) THE DETERMINATION OF WHETHER OVERSIGHT IS REASONABLE AND WHETHER APPROPRIATE STEPS WERE TAKEN IN ACCORDANCE WITH PARAGRAPH (1) OF THIS SUBSECTION SHALL TAKE INTO ACCOUNT WHETHER THE DISCLOSED DATA INCLUDES DATA THAT WOULD BE CONSIDERED SENSITIVE DATA IF THE DATA WERE RE–IDENTIFIED. 14–4612. (A) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO RESTRICT A CONTROLLER’S OR PROCESSOR’S ABILITY TO: (1) COMPLY WITH FEDERAL, STATE, OR LOCAL LAWS OR REGULATIONS; (2) COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL, STATE, LOCAL, OR OTHER GOVERNMENTAL AUTHORITY; (3) COOPERATE WITH LAW ENFORCEMENT AGENCIES CONCERNING CONDUCT OR ACTIVITY THAT THE CONTROLLER OR PROCESSOR REASONABLY AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR LOCAL LAWS OR REGULATIONS; (4) INVESTIGATE, ESTABLISH, EXERCISE, PREPARE FOR, OR DEFEND A LEGAL CLAIM; (5) PROVIDE A PRODUCT OR SERVICE SPECIFICALLY REQUESTED BY A CONSUMER; (6) PERFORM UNDER A CONTRACT TO WHICH A CONSUMER IS A PARTY, INCLUDING FULFILLING THE TERMS OF A WRITTEN WARRANTY; (7) TAKE STEPS AT THE REQUEST OF A CONSUMER BEFORE ENTERING INTO A CONTRACT; (8) TAKE IMMEDIATE STEPS TO PROTECT AN INTEREST THAT IS ESSENTIAL FOR THE LIFE OR PHYSICAL SAFETY OF A CONSUMER OR ANOTHER INDIVIDUAL AND WHEN THE PROCESSING CANNOT BE MANIFESTLY BASED ON ANOTHER LEGAL BASIS; (9) PREVENT, DETECT, PROTECT AGAINST, INVESTIGATE, PROSECUTE THOSE RESPONSIBLE, OR OTHERWISE RESPOND TO A SECURITY WES MOORE, Governor Ch. 454 – 35 – INCIDENT, IDENTITY THEFT, FRAUD, HARASSMENT, MALICIOUS OR DECEPTIVE ACTIVITY, OR ANY OTHER TYPE OF ILLEGAL ACTIVITY; (10) PRESERVE THE INTEGRITY OR SECURITY OF SYSTEMS; OR (11) ASSIST ANOTHER CONTROLLER, PROCESSOR, OR THIRD PARTY WITH AN OBLIGATION UNDER THIS SUBTITLE. (B) (1) THIS SUBSECTION DOES NOT APPLY TO AN OBLIGATION REQUIRED UNDER § 14–4611 OF THIS SUBTITLE. (2) AN OBLIGATION IMPOSED ON A CONTROLLER OR PROCESSOR UNDER THIS SUBTITLE MAY NOT RESTRICT A CONTROLLER’S OR PROCESSOR’S ABILITY TO COLLECT, USE, OR RETAIN PERSONAL DATA FOR INTERNAL USE TO: (I) EFFECTUATE A PRODUCT RECALL; (II) IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR EXISTING OR INTENDED FUNCTIONALITY; OR (III) PERFORM INTERNAL OPERATIONS THAT ARE: 1. REASONABLY ALIGNED WITH THE EXPECTATIONS OF THE CONSUMER OR CAN BE REASONABLY ANTICIPATED BASED ON THE CONSUMER’S EXISTING RELATIONSHIP WITH THE CONTROLLER; OR 2. OTHERWISE COMPATIBLE WITH PROCESSING DATA IN FURTHERANCE OF: A. THE PROVISION OF A PRODUCT OR SERVICE SPECIFICALLY REQUESTED BY A CONSUMER; OR B. THE PERFORMANCE OF A CONTRACT TO WHICH THE CONSUMER IS A PARTY. (C) (1) AN OBLIGATION IMPOSED ON A CONTROLLER OR A PROCESSOR UNDER THIS SUBTITLE DOES NOT APPLY WHEN COMPLIANCE BY THE CONTROLLER OR PROCESSOR WITH THE SUBTITLE WOULD VIOLATE AN EVIDENTIARY PRIVILEGE UNDER STATE LAW. (2) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO PREVENT A CONTROLLER OR PROCESSOR FROM PROVIDING PERSONAL DATA CONCERNING A CONSUMER TO A PERSON COVERED BY AN EVIDENTIARY PRIVILEGE UNDER STATE LAW AS PART OF A PRIVILEGED COMMUNICATION. Ch. 454 2024 LAWS OF MARYLAND – 36 – (D) (1) A CONTROLLER OR PROCESSOR THAT DISCLOSES PERSONAL DATA TO A PROCESSOR OR A THIRD–PARTY CONTROLLER IN COMPLIANCE WITH THIS SUBTITLE IS NOT IN VIOLATION OF THIS SUBTITLE IF THE PROCESSOR OR THIRD–PARTY CONTROLLER THAT RECEIVES THE PERSONAL DATA VIOLATES THIS SUBTITLE AND: (I) AT THE TIME THE DISCLOSING CONTROLLER OR PROCESSOR DISCLOSED THE PERSONAL DATA, THE DISCLOSING CONTROLLER OR PROCESSOR DID NOT HAVE ACTUAL KNOWLEDGE THAT THE RECEIVING PROCESSOR OR THIRD–PARTY CONTROLLER WOULD VIOLATE THIS SUBTITLE; AND (II) THE DISCLOSING CONTROLLER WAS, AND REMAINED, IN COMPLIANCE WITH ITS OBLIGATIONS AS THE DISCLOSER OF THE PERSONAL DATA. (2) A THIRD–PARTY CONTROLLER OR PROCESSOR THAT RECEIVES PERSONAL DATA FROM A CONTROLLER OR PROCESSOR IN COMPLIANCE WITH THIS SUBTITLE IS NOT IN VIOLATION OF THIS SUBTITLE FOR THE INDEPENDENT MISCONDUCT OF THE CONTROLLER OR PROCESSOR FROM WHICH THE THIRD–PARTY CONTROLLER OR PROCESSOR RECEIVED THE PERSONAL DATA. (E) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO: (1) IMPOSE AN OBLIGATION ON A CONTROLLER OR A PROCESSOR THAT ADVERSELY AFFECTS THE RIGHTS OR FREEDOMS OF ANY PERSON, INCLUDING THE RIGHTS OF A PERSON TO FREEDOM OF SPEECH OR FREEDOM OF THE PRESS AS GUARANTEED IN THE FIRST AMENDMENT TO THE U.S. CONSTITUTION; OR (2) APPLY TO A PERSON’S PROCESSING OF PERSONAL DATA DURING THE PERSON’S PERSONAL OR HOUSEHOLD ACTIVITIES. (F) IF A CONTROLLER OR PROCESSOR PROCESSES PERSONAL DATA IN ACCORDANCE WITH AN EXEMPTION UNDER THIS SECTION, THE CONTROLLER OR PROCESSOR SHALL DEMONSTRATE THAT THE PROCESSING: (1) QUALIFIES FOR AN EXEMPTION; AND (2) COMPLIES WITH THE REQUIREMENTS OF SUBSECTION (G) OF THIS SECTION. (G) PERSONAL DATA PROCESSED BY A CONTROLLER OR PROCESSOR IN ACCORDANCE WITH THIS SECTION: WES MOORE, Governor Ch. 454 – 37 – (1) SHALL BE SUBJECT TO REASONABLE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL MEASURES TO: (I) PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF THE PERSONAL DATA; AND (II) REDUCE REASONABLY FORESEEABLE RISKS OF HARM TO CONSUMERS RELATING TO THE COLLECTION, USE, OR RETENTION OF PERSONAL DATA; AND (2) MAY BE PROCESSED TO THE EXTENT THAT THE PROCESSING IS: (I) REASONABLY NECESSARY AND PROPORTIONATE TO THE PURPOSES LISTED IN THIS SECTION; AND (II) ADEQUATE, RELEVANT, AND LIMITED TO WHAT IS NECESSARY IN RELATION TO THE SPECIFIC PURPOSES LISTED IN THIS SECTION. (H) A PERSON THAT PROCESSES PERSONAL DATA FOR A PURPOSE EXPRESSLY IDENTIFIED IN THIS SECTION MAY NOT BE CONSIDERED A CONTROLLER SOLELY BASED ON THE PROCESSING OF PERSONAL DATA. 14–4613. (A) EXCEPT AS PROVIDED IN SUBSECTION (B) OF THIS SECTION, A VIOLATION OF THIS SUBTITLE IS: (1) AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE PRACTICE WITHIN THE MEANING OF TITLE 13 OF THIS ARTICLE; AND (2) SUBJECT TO THE ENFORCEMENT AND PENALTY PROVISIONS CONTAINED IN TITLE 13 OF THIS ARTICLE, EXCEPT FOR § 13–408 OF THIS ARTICLE. (B) THIS SECTION DOES NOT PREVENT A CONSUMER FROM PURSUING ANY OTHER REMEDY PROVIDED BY LAW. 14–4614. (A) THIS SECTION APPLIES TO AN ENFORCEMENT ACTION UNDER § 14–4613 OF THIS SUBTITLE FOR AN ALLEGED VIOLATION THAT OCCURS ON OR BEFORE APRIL 1, 2027. Ch. 454 2024 LAWS OF MARYLAND – 38 – (B) BEFORE INITIATING ANY ACTION UNDER § 14–4613 OF THIS SUBTITLE, THE DIVISION MAY ISSUE A NOTICE OF VIOLATION TO THE CONTROLLER OR PROCESSOR IF THE DIVISION DETERMINES THAT A CURE IS POSSIBLE. (C) (1) IF THE DIVISION ISSUES A NOTICE OF VIOLATION UNDER SUBSECTION (B) OF THIS SECTION, THE CONTROLLER OR PROCESSOR SHALL HAVE AT LEAST 60 DAYS TO CURE THE VIOLATION AFTER RECEIPT OF THE NOTICE. (2) IF THE CONTROLLER OR PROCESSOR FAILS TO CURE THE VIOLATION WITHIN THE TIME PERIOD SPECIFIED BY THE DIVISION, THE DIVISION MAY BRING AN ENFORCEMENT ACTION UNDER § 14–4613 OF THIS SUBTITLE. (D) IN DETERMINING WHETHER TO GRANT A CONTROLLER OR PROCESSOR AN OPPORTUNITY TO CURE AN ALLEGED VIOLATION, THE DIVISION MAY CONSIDER THE FOLLOWING FACTORS: (1) THE NUMBER OF VIOLATIONS; (2) THE SIZE AND COMPLEXITY OF THE CONTROLLER OR PROCESSOR; (3) THE NATURE AND EXTENT OF THE CONTROLLER’S OR PROCESSOR’S PROCESSING ACTIVITIES; (4) THE LIKELIHOOD OF INJURY TO THE PUBLIC; (5) THE SAFETY OF PERSONS OR PROPERTY; (6) WHETHER THE ALLEGED VIOLATION WAS LIKELY CAUSED BY HUMAN OR TECHNICAL ERROR; AND (7) THE EXTENT TO WHICH THE CONTROLLER OR PROCESSOR HAS VIOLATED THIS SUBTITLE OR SIMILAR LAWS IN THE PAST. SECTION 2. AND BE IT FURTHER ENACTED, That § 14–4612 of the Commercial Law Article, as enacted by Section 1 of this Act, shall be construed to apply only prospectively and may not be applied or interpreted to have any effect on or application to any personal data processing activities before April 1, 2025 2026. SECTION 3. AND BE IT FURTHER ENACTED, That, if any provision of this Act or the application thereof to any person or circumstance is held invalid for any reason in a court of competent jurisdiction, the invalidity does not affect other provisions or any other application of this Act that can be given effect without the invalid provision or application, and for this purpose the provisions of this Act are declared severable. WES MOORE, Governor Ch. 454 – 39 – SECTION 4. AND BE IT FURTHER ENACTED, That this Act shall take effect October 1, 2024 2025. Approved by the Governor, May 9, 2024.