Text of MD SB 541 (2024)
Maryland Online Data Privacy Act of 2024
Legislative text is a public record. Where LegiScan supplied it, the CC BY 4.0 credit applies.
Source: LegiScan. Bill data and text from LegiScan (legiscan.com), licensed CC BY 4.0 and used in modified form. LegiScan does not endorse the Trans Data Initiative. License: CC BY 4.0(opens another site). Source page(opens another site)
As introduced
64,520 characters
EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW.
[Brackets] indicate matter deleted from existing law.
*sb0541*
SENATE BILL 541
I3
4lr1200
CF HB 567
By: Senators Gile, Hester, Augustine, Feldman, Beidle, and Ellis
Introduced and read first time: January 24, 2024
Assigned to: Finance
A BILL ENTITLED
AN ACT concerning
1
Maryland Online Data Privacy Act of 2024
2
FOR the purpose of regulating the manner in which a controller or a processor in possession
3
of a consumer’s personal data may process the consumer’s personal data; authorizing
4
a consumer to exercise certain rights in regards to the consumer’s personal data;
5
requiring a controller of personal data to establish a method for a consumer to
6
exercise certain rights in regards to the consumer’s personal data; requiring a
7
controller to comply with a request by a consumer to exercise a certain right in a
8
certain manner, except under certain circumstances; authorizing a consumer to
9
designate an authorized agent to act on the consumer’s behalf to opt out of the
10
processing of the consumer’s personal data; requiring a controller to provide a
11
consumer with a certain privacy notice; requiring a controller that uses a processor
12
to process the personal data of consumers to enter into a contract with the processor
13
that governs the processor’s data processing procedures; requiring a controller to
14
conduct and document a data protection assessment for consumer data processing
15
activities that present a heightened risk of harm to a consumer; making a violation
16
of this Act an unfair, abusive, or deceptive trade practice that is subject to
17
enforcement and penalties under the Maryland Consumer Protection Act; and
18
generally relating to online data privacy.
19
BY repealing and reenacting, with amendments,
20
Article – Commercial Law
21
Section 13–301(14)(xl)
22
Annotated Code of Maryland
23
(2013 Replacement Volume and 2023 Supplement)
24
BY repealing and reenacting, without amendments,
25
Article – Commercial Law
26
Section 13–301(14)(xli)
27
Annotated Code of Maryland
28
(2013 Replacement Volume and 2023 Supplement)
29
2
SENATE BILL 541
BY adding to
1
Article – Commercial Law
2
Section 13–301(14)(xlii); and 14–4601 through 14–4613 to be under the new subtitle
3
“Subtitle 46. Online Data Privacy Act”
4
Annotated Code of Maryland
5
(2013 Replacement Volume and 2023 Supplement)
6
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND,
7
That the Laws of Maryland read as follows:
8
Article – Commercial Law
9
13–301.
10
Unfair, abusive, or deceptive trade practices include any:
11
(14)
Violation of a provision of:
12
(xl)
Title 14, Subtitle 13 of the Public Safety Article; [or]
13
(xli)
Title 14, Subtitle 45 of this article; or
14
(XLII) TITLE 14, SUBTITLE 46 OF THIS ARTICLE; OR
15
SUBTITLE 46. ONLINE DATA PRIVACY ACT.
16
14–4601.
17
(A)
IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS
18
INDICATED.
19
(B)
“AFFILIATE” MEANS A PERSON THAT:
20
(1)
SHARES COMMON BRANDING WITH ANOTHER PERSON; OR
21
(2)
CONTROLS, IS CONTROLLED BY, OR IS UNDER COMMON CONTROL
22
WITH ANOTHER PERSON.
23
(C)
“AUTHENTICATE” MEANS TO USE REASONABLE MEANS TO DETERMINE
24
THAT A REQUEST TO EXERCISE A CONSUMER RIGHT IN ACCORDANCE WITH § 14-4605
25
OF THIS SUBTITLE IS BEING MADE BY, OR ON BEHALF OF, A CONSUMER WHO IS
26
ENTITLED TO EXERCISE THE CONSUMER RIGHT WITH RESPECT TO THE PERSONAL
27
DATA AT ISSUE.
28
SENATE BILL 541
3
(D)
(1)
“BIOMETRIC DATA” MEANS DATA GENERATED BY AUTOMATIC
1
MEASUREMENTS OF THE BIOLOGICAL CHARACTERISTICS OF A CONSUMER THAT CAN
2
BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY.
3
(2)
“BIOMETRIC DATA” INCLUDES:
4
(I)
A FINGERPRINT;
5
(II)
A VOICE PRINT;
6
(III) AN EYE RETINA OR IRIS IMAGE; AND
7
(IV) ANY OTHER UNIQUE BIOLOGICAL CHARACTERISTICS THAT
8
CAN BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY.
9
(3)
“BIOMETRIC DATA” DOES NOT INCLUDE:
10
(I)
A DIGITAL OR PHYSICAL PHOTOGRAPH;
11
(II)
AN AUDIO OR VIDEO RECORDING; OR
12
(III) ANY DATA GENERATED FROM A DIGITAL OR PHYSICAL
13
PHOTOGRAPH OR AN AUDIO OR VIDEO RECORDING, UNLESS THE DATA IS
14
GENERATED TO IDENTIFY A SPECIFIC CONSUMER.
15
(E)
“BUSINESS ASSOCIATE” HAS THE MEANING STATED IN HIPAA.
16
(F)
“CHILD” HAS THE MEANING STATED IN COPPA.
17
(G)
(1)
“CONSENT” MEANS A CLEAR AFFIRMATIVE ACT SIGNIFYING A
18
CONSUMER’S
FREELY
GIVEN,
SPECIFIC,
INFORMED,
AND
UNAMBIGUOUS
19
AGREEMENT TO ALLOW THE PROCESSING OF PERSONAL DATA RELATING TO THE
20
CONSUMER FOR A PARTICULAR PURPOSE.
21
(2)
“CONSENT” INCLUDES:
22
(I)
A WRITTEN STATEMENT;
23
(II)
A WRITTEN STATEMENT BY ELECTRONIC MEANS; OR
24
(III) ANY OTHER UNAMBIGUOUS AFFIRMATIVE ACTION.
25
(3)
“CONSENT” DOES NOT INCLUDE:
26
4
SENATE BILL 541
(I)
ACCEPTANCE OF A GENERAL OR BROAD TERMS OF USE OR
1
SIMILAR
DOCUMENT
THAT
CONTAINS
DESCRIPTIONS
OF
PERSONAL
DATA
2
PROCESSING ALONG WITH OTHER UNRELATED INFORMATION;
3
(II)
HOVERING OVER, MUTING, PAUSING, OR CLOSING A PIECE
4
OF CONTENT; OR
5
(III) AGREEMENT OBTAINED THROUGH THE USE OF DARK
6
PATTERNS.
7
(H)
(1)
“CONSUMER” MEANS AN INDIVIDUAL WHO IS A RESIDENT OF THE
8
STATE.
9
(2)
“CONSUMER” DOES NOT INCLUDE:
10
(I)
AN
INDIVIDUAL
ACTING
IN
A
COMMERCIAL
OR
11
EMPLOYMENT CONTEXT; OR
12
(II)
AN INDIVIDUAL ACTING AS AN EMPLOYEE, AN OWNER, A
13
DIRECTOR, AN OFFICER, OR A CONTRACTOR OF A COMPANY, A PARTNERSHIP, A SOLE
14
PROPRIETORSHIP, A NONPROFIT ORGANIZATION, OR A GOVERNMENTAL UNIT
15
WHOSE COMMUNICATIONS OR TRANSACTIONS WITH A CONTROLLER OCCUR ONLY
16
WITHIN THE CONTEXT OF THE INDIVIDUAL’S ROLE WITH THE COMPANY,
17
PARTNERSHIP,
SOLE
PROPRIETORSHIP,
NONPROFIT
ORGANIZATION,
OR
18
GOVERNMENTAL UNIT.
19
(I)
(1)
“CONSUMER HEALTH DATA” MEANS PERSONAL DATA THAT A
20
CONTROLLER USES TO IDENTIFY A CONSUMER’S PHYSICAL OR MENTAL HEALTH
21
STATUS.
22
(2)
“CONSUMER HEALTH DATA” INCLUDES DATA RELATED TO:
23
(I)
GENDER–AFFIRMING CARE; OR
24
(II)
REPRODUCTIVE OR SEXUAL HEALTH CARE.
25
(J)
“CONTROL” MEANS:
26
(1)
OWNERSHIP OF OR THE POWER TO VOTE MORE THAN 50% OF THE
27
OUTSTANDING SHARES OF ANY CLASS OF VOTING SECURITY OF A BUSINESS;
28
SENATE BILL 541
5
(2)
ANY MANNER OF CONTROL OVER THE ELECTION OF A MAJORITY
1
OF THE DIRECTORS OF A BUSINESS, OR INDIVIDUALS EXERCISING SIMILAR
2
FUNCTIONS; OR
3
(3)
THE POWER TO EXERCISE A CONTROLLING INFLUENCE OVER THE
4
MANAGEMENT OF A BUSINESS.
5
(K)
“CONTROLLER” MEANS A PERSON THAT, ALONE OR JOINTLY WITH
6
OTHERS, DETERMINES THE PURPOSE AND MEANS OF PROCESSING PERSONAL DATA.
7
(L)
(1)
“COPPA” MEANS THE FEDERAL CHILDREN’S ONLINE PRIVACY
8
PROTECTION ACT OF 1998.
9
(2)
“COPPA” INCLUDES REGULATIONS ADOPTED UNDER THE
10
FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT OF 1998.
11
(M)
“COVERED ENTITY” HAS THE MEANING STATED IN HIPAA.
12
(N)
(1)
“DARK PATTERN” MEANS A USER INTERFACE DESIGNED OR
13
MANIPULATED WITH THE SUBSTANTIAL EFFECT OF SUBVERTING USER AUTONOMY,
14
DECISION MAKING, OR CHOICE.
15
(2)
“DARK PATTERN” INCLUDES ANY PRACTICE THE FEDERAL
16
TRADE COMMISSION REFERS TO AS A “DARK PATTERN”.
17
(O)
“DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT
18
EFFECTS CONCERNING THE CONSUMER” MEANS DECISIONS THAT RESULT IN THE
19
PROVISION OR DENIAL OF:
20
(1)
FINANCIAL OR LENDING SERVICES;
21
(2)
HOUSING;
22
(3)
INSURANCE;
23
(4)
EDUCATION ENROLLMENT OR OPPORTUNITY;
24
(5)
CRIMINAL JUSTICE;
25
(6)
EMPLOYMENT OPPORTUNITIES;
26
(7)
HEALTH CARE SERVICES; OR
27
6
SENATE BILL 541
(8)
ACCESS TO ESSENTIAL GOODS OR SERVICES.
1
(P)
“DE–IDENTIFIED DATA” MEANS DATA THAT CANNOT REASONABLY BE
2
USED TO INFER INFORMATION ABOUT OR OTHERWISE BE LINKED TO AN IDENTIFIED
3
OR IDENTIFIABLE CONSUMER, OR A DEVICE THAT MAY BE LINKED TO AN IDENTIFIED
4
OR IDENTIFIABLE CONSUMER, IF THE CONTROLLER THAT POSSESSES THAT
5
INFORMATION:
6
(1)
TAKES
REASONABLE
MEASURES
TO
ENSURE
THAT
THE
7
INFORMATION CANNOT BE LINKED WITH A CONSUMER;
8
(2)
COMMITS IN PUBLICLY AVAILABLE TERMS AND CONDITIONS OR IN
9
A PUBLICLY AVAILABLE PRIVACY POLICY TO MAINTAIN AND USE THE INFORMATION
10
IN DE–IDENTIFIED FORM; AND
11
(3)
CONTRACTUALLY
OBLIGES
ANY
RECIPIENTS
OF
THE
12
INFORMATION TO COMPLY WITH ALL PROVISIONS OF THIS SUBSECTION.
13
(Q)
(1)
“GENETIC DATA” MEANS DATA IN ANY FORMAT THAT CONCERNS
14
THE GENETIC CHARACTERISTICS OF A CONSUMER.
15
(2)
“GENETIC DATA” INCLUDES:
16
(I)
RAW SEQUENCE DATA THAT RESULTS FROM SEQUENCING
17
OF A CONSUMER’S COMPLETE EXTRACTED DNA OR A PORTION OF THE CONSUMER’S
18
COMPLETE EXTRACTED DNA;
19
(II)
GENOTYPIC
AND
PHENOTYPIC
INFORMATION
THAT
20
RESULTS FROM ANALYZING RAW SEQUENCE DATA;
21
(III) INFORMATION EXTRAPOLATED, DERIVED, OR INFERRED
22
FROM THE ANALYSIS OF RAW SEQUENCE DATA; AND
23
(IV) SELF–REPORTED HEALTH INFORMATION SUBMITTED TO A
24
DIRECT–TO–CONSUMER GENETIC TESTING COMPANY BY A CONSUMER REGARDING
25
THE CONSUMER’S HEALTH CONDITIONS:
26
1.
THAT IS USED FOR SCIENTIFIC RESEARCH OR
27
PRODUCT DEVELOPMENT; AND
28
2.
ANALYZED IN CONNECTION WITH THE CONSUMER’S
29
RAW SEQUENCE DATA.
30
SENATE BILL 541
7
(R)
(1)
“GEOFENCE”
MEANS
TECHNOLOGY
THAT
ESTABLISHES
A
1
VIRTUAL GEOGRAPHICAL BOUNDARY.
2
(2)
“GEOFENCE” INCLUDES BOUNDARIES THAT ARE ESTABLISHED
3
OR MONITORED THROUGH THE USE OF:
4
(I)
GLOBAL POSITIONING TECHNOLOGY;
5
(II)
CELL TOWER CONNECTIVITY;
6
(III) CELLULAR DATA;
7
(IV) RADIO FREQUENCY IDENTIFICATION;
8
(V)
WIRELESS FIDELITY TECHNOLOGY; OR
9
(VI) ANY
OTHER
FORM
OF
LOCATION
DETERMINATION
10
TECHNOLOGY.
11
(S)
“HIPAA” MEANS THE FEDERAL HEALTH INSURANCE PORTABILITY
12
AND ACCOUNTABILITY ACT OF 1996.
13
(T)
“IDENTIFIED OR IDENTIFIABLE CONSUMER” MEANS A CONSUMER WHO
14
CAN READILY BE IDENTIFIED, EITHER DIRECTLY OR INDIRECTLY.
15
(U)
“MENTAL HEALTH FACILITY” MEANS A HEALTH CARE FACILITY IN
16
WHICH NOT LESS THAN 70% OF HEALTH CARE SERVICES OFFERED ARE MENTAL
17
HEALTH SERVICES.
18
(V)
(1)
“PERSONAL DATA” MEANS ANY INFORMATION THAT IS LINKED OR
19
CAN BE REASONABLY LINKED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER.
20
(2)
“PERSONAL DATA” DOES NOT INCLUDE:
21
(I)
DE–IDENTIFIED DATA; OR
22
(II)
PUBLICLY AVAILABLE INFORMATION.
23
(W)
(1)
“PRECISE GEOLOCATION DATA” MEANS INFORMATION DERIVED
24
FROM TECHNOLOGY THAT CAN PRECISELY AND ACCURATELY IDENTIFY THE
25
SPECIFIC LOCATION OF A CONSUMER WITHIN A RADIUS OF 1,750 FEET.
26
8
SENATE BILL 541
(2)
“PRECISE GEOLOCATION DATA” INCLUDES GLOBAL POSITIONING
1
SYSTEM LEVEL LATITUDE AND LONGITUDE COORDINATES OR OTHER SIMILAR
2
MECHANISMS.
3
(3)
“PRECISE GEOLOCATION DATA” DOES NOT INCLUDE:
4
(I)
THE CONTENT OF COMMUNICATIONS DATA GENERATED BY
5
OR CONNECTED TO AN ADVANCED UTILITY METERING INFRASTRUCTURE SYSTEM;
6
OR
7
(II)
EQUIPMENT USED BY A UTILITY COMPANY.
8
(X)
(1)
“PROCESS” MEANS AN OPERATION OR SET OF OPERATIONS
9
PERFORMED BY MANUAL OR AUTOMATED MEANS ON PERSONAL DATA.
10
(2)
“PROCESS”
INCLUDES
COLLECTING,
USING,
STORING,
11
DISCLOSING, ANALYZING, DELETING, OR MODIFYING PERSONAL DATA.
12
(Y)
“PROCESSOR” MEANS A PERSON THAT PROCESSES PERSONAL DATA ON
13
BEHALF OF A CONTROLLER.
14
(Z)
“PROFILING”
MEANS
ANY
FORM
OF
AUTOMATED
PROCESSING
15
PERFORMED ON PERSONAL DATA TO EVALUATE, ANALYZE, OR PREDICT PERSONAL
16
ASPECTS RELATED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER’S ECONOMIC
17
SITUATION, HEALTH, DEMOGRAPHIC CHARACTERISTICS, PERSONAL PREFERENCES,
18
INTERESTS, RELIABILITY, BEHAVIOR, LOCATION, OR MOVEMENTS.
19
(AA) “PROTECTED HEALTH INFORMATION” HAS THE MEANING STATED IN
20
HIPAA.
21
(BB) (1)
“PUBLICLY AVAILABLE INFORMATION” MEANS INFORMATION
22
THAT:
23
(I)
IS LAWFULLY MADE READILY AVAILABLE TO THE GENERAL
24
PUBLIC THROUGH FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS; OR
25
(II)
A CONTROLLER HAS A REASONABLE BASIS TO BELIEVE
26
THAT A CONSUMER HAS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC
27
THROUGH WIDELY DISTRIBUTED MEDIA.
28
(2)
“PUBLICLY AVAILABLE INFORMATION” DOES NOT INCLUDE
29
BIOMETRIC DATA COLLECTED BY A BUSINESS ABOUT A CONSUMER WITHOUT THE
30
CONSUMER’S KNOWLEDGE.
31
SENATE BILL 541
9
(CC) (1)
“REPRODUCTIVE OR SEXUAL HEALTH CARE” MEANS CARE
1
RELATED TO A CONSUMER’S REPRODUCTIVE SYSTEM OR SEXUAL WELL–BEING.
2
(2)
“REPRODUCTIVE OR SEXUAL HEALTH CARE” INCLUDES:
3
(I)
A SERVICE OR PRODUCT PROVIDED RELATED TO AN
4
INDIVIDUAL HEALTH
CONDITION,
STATUS,
DISEASE, DIAGNOSIS,
TEST,
OR
5
TREATMENT;
6
(II)
A SOCIAL, PSYCHOLOGICAL, BEHAVIORAL, OR MEDICAL
7
INTERVENTION;
8
(III) A SURGERY OR PROCEDURE;
9
(IV) THE PURCHASE OR USE OF A MEDICATION;
10
(V)
A SERVICE OR PRODUCT RELATED TO A BODILY FUNCTION,
11
VITAL SIGN, OR MEASUREMENT THEREOF;
12
(VI) AN ABORTION, WHETHER SURGICAL OR MEDICAL; AND
13
(VII) A SERVICE RELATED TO AN ABORTION.
14
(DD) “REPRODUCTIVE OR SEXUAL HEALTH CARE FACILITY” MEANS A
15
HEALTH CARE FACILITY WHERE NOT LESS THAN 70% OF SERVICES OFFERED ARE
16
REPRODUCTIVE OR SEXUAL HEALTH CARE SERVICES.
17
(EE) (1)
“SALE OF PERSONAL DATA” MEANS THE EXCHANGE OF PERSONAL
18
DATA BY A CONTROLLER TO A THIRD PARTY FOR MONETARY OR OTHER VALUABLE
19
CONSIDERATION.
20
(2)
“SALE OF PERSONAL DATA” DOES NOT INCLUDE:
21
(I)
THE DISCLOSURE OF PERSONAL DATA TO A PROCESSOR
22
THAT PROCESSES PERSONAL DATA ON BEHALF OF A CONTROLLER IF LIMITED TO
23
THE PURPOSES OF THE PROCESSING;
24
(II)
THE DISCLOSURE OF PERSONAL DATA TO A THIRD PARTY
25
FOR
PURPOSES
OF
PROVIDING A
PRODUCT
OR
SERVICE AFFIRMATIVELY
26
REQUESTED BY THE CONSUMER;
27
10
SENATE BILL 541
(III) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO AN
1
AFFILIATE OF THE CONTROLLER FOR THE PURPOSE OF PROVIDING A PRODUCT OR
2
SERVICE AFFIRMATIVELY REQUESTED BY THE CONSUMER;
3
(IV) THE
DISCLOSURE
OF
PERSONAL
DATA
WHERE
THE
4
CONSUMER:
5
1.
DIRECTS
THE
CONTROLLER
TO
DISCLOSE
THE
6
PERSONAL DATA; OR
7
2.
INTENTIONALLY
USES
THE
CONTROLLER
TO
8
INTERACT WITH A THIRD PARTY;
9
(V)
THE
DISCLOSURE
OF
PERSONAL
DATA
THAT
THE
10
CONSUMER:
11
1.
INTENTIONALLY MADE AVAILABLE TO THE GENERAL
12
PUBLIC THROUGH A CHANNEL OF MASS MEDIA; AND
13
2.
DID NOT RESTRICT TO A SPECIFIC AUDIENCE; OR
14
(VI) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO A
15
THIRD PARTY AS AN ASSET THAT IS PART OF AN ACTUAL OR PROPOSED MERGER,
16
ACQUISITION, BANKRUPTCY, OR OTHER TRANSACTION WHERE THE THIRD PARTY
17
ASSUMES CONTROL OF ALL OR PART OF THE CONTROLLER’S ASSETS.
18
(FF) “SENSITIVE DATA” MEANS PERSONAL DATA THAT INCLUDES:
19
(1)
DATA REVEALING:
20
(I)
RACIAL OR ETHNIC ORIGIN;
21
(II)
RELIGIOUS BELIEFS;
22
(III) CONSUMER HEALTH DATA;
23
(IV) SEX LIFE;
24
(V)
SEXUAL ORIENTATION;
25
(VI) STATUS AS TRANSGENDER OR NONBINARY;
26
(VII) NATIONAL ORIGIN; OR
27
SENATE BILL 541
11
(VIII) CITIZENSHIP OR IMMIGRATION STATUS;
1
(2)
GENETIC DATA OR BIOMETRIC DATA;
2
(3)
PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER KNOWS
3
OR HAS REASON TO KNOW IS A CHILD; OR
4
(4)
PRECISE GEOLOCATION DATA.
5
(GG) (1)
“TARGETED
ADVERTISING”
MEANS
DISPLAYING
6
ADVERTISEMENTS TO A CONSUMER OR ON A DEVICE IDENTIFIED BY A UNIQUE
7
IDENTIFIER, WHERE THE ADVERTISEMENT IS SELECTED BASED ON PERSONAL DATA
8
OBTAINED OR INFERRED FROM THE CONSUMER’S ACTIVITIES OVER TIME AND
9
ACROSS WEBSITES OR ONLINE APPLICATIONS THAT ARE UNAFFILIATED WITH EACH
10
OTHER, IN ORDER TO PREDICT THE CONSUMER’S PREFERENCES OR INTERESTS.
11
(2)
“TARGETED ADVERTISING” DOES NOT INCLUDE:
12
(I)
ADVERTISEMENTS BASED ON THE CONTEXT IN WHICH THE
13
ADVERTISEMENT APPEARS AND DOES NOT VARY BASED ON WHO IS VIEWING THE
14
ADVERTISEMENT;
15
(II)
ADVERTISEMENTS BASED ON A CONSUMER’S ACTIVITIES
16
WITHIN A CONTROLLER’S WEBSITES OR ONLINE APPLICATIONS;
17
(III) ADVERTISEMENTS
DIRECTED
TO
A
CONSUMER
IN
18
RESPONSE TO THE CONSUMER’S REQUEST FOR INFORMATION OR FEEDBACK; OR
19
(IV) PROCESSING PERSONAL DATA SOLELY TO MEASURE OR
20
REPORT ADVERTISING FREQUENCY, PERFORMANCE, OR REACH.
21
(HH) “THIRD PARTY” MEANS A PERSON OTHER THAN THE RELEVANT
22
CONSUMER, CONTROLLER, PROCESSOR, OR AFFILIATE OF THE CONTROLLER OR
23
PROCESSOR OF RELEVANT PERSONAL DATA.
24
(II)
(1)
“TRADE SECRET” MEANS INFORMATION THAT:
25
(I)
DERIVES INDEPENDENT ECONOMIC VALUE, ACTUAL OR
26
POTENTIAL, FROM NOT BEING GENERALLY KNOWN TO, AND NOT BEING READILY
27
ASCERTAINABLE BY PROPER MEANS BY, OTHER PERSONS WHO COULD OBTAIN
28
ECONOMIC VALUE FROM THE INFORMATION’S DISCLOSURE OR USE; AND
29
12
SENATE BILL 541
(II)
IS THE SUBJECT OF EFFORTS THAT ARE REASONABLE
1
UNDER THE CIRCUMSTANCES TO MAINTAIN THE SECRECY OF THE INFORMATION.
2
(2)
“TRADE
SECRET”
INCLUDES
A
FORMULA,
PATTERN,
3
COMPILATION, PROGRAM, DEVICE, METHOD, TECHNIQUE, OR PROCESS.
4
14–4602.
5
THIS SUBTITLE APPLIES TO A PERSON THAT:
6
(1)
CONDUCTS BUSINESS IN THE STATE; OR
7
(2)
(I)
PRODUCES SERVICES OR PRODUCTS THAT ARE TARGETED
8
TO RESIDENTS OF THE STATE; AND
9
(II)
DURING THE IMMEDIATELY PRECEDING CALENDAR YEAR:
10
1.
CONTROLLED OR PROCESSED THE PERSONAL DATA
11
OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR
12
PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION;
13
OR
14
2.
CONTROLLED OR PROCESSED THE PERSONAL DATA
15
OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS
16
REVENUE FROM THE SALE OF PERSONAL DATA.
17
14–4603.
18
(A)
THIS SUBTITLE DOES NOT APPLY TO:
19
(1)
A
REGULATORY,
ADMINISTRATIVE,
ADVISORY,
EXECUTIVE,
20
APPOINTIVE, LEGISLATIVE, OR JUDICIAL BODY OF THE STATE, INCLUDING A BOARD,
21
BUREAU, COMMISSION, OR UNIT OF THE STATE OR A POLITICAL SUBDIVISION OF
22
THE STATE;
23
(2)
A NATIONAL SECURITIES ASSOCIATION THAT IS REGISTERED
24
UNDER § 15 OF THE FEDERAL SECURITIES EXCHANGE ACT OF 1934 OR A
25
REGISTERED FUTURES ASSOCIATION DESIGNATED IN ACCORDANCE WITH § 17 OF
26
THE FEDERAL COMMODITY EXCHANGE ACT; OR
27
(3)
A FINANCIAL INSTITUTION OR AFFILIATE OF A FINANCIAL
28
INSTITUTION
THAT
IS
SUBJECT
TO
TITLE
V
OF
THE
FEDERAL
29
GRAMM–LEACH–BLILEY ACT AND REGULATIONS ADOPTED UNDER THAT ACT.
30
SENATE BILL 541
13
(B)
THE FOLLOWING INFORMATION AND DATA ARE EXEMPT FROM THIS
1
SUBTITLE:
2
(1)
PROTECTED HEALTH INFORMATION UNDER HIPAA;
3
(2)
PATIENT–IDENTIFYING INFORMATION FOR PURPOSES OF 42
4
U.S.C. § 290DD–2;
5
(3)
IDENTIFIABLE PRIVATE INFORMATION THAT IS USED FOR
6
PURPOSES OF THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS IN
7
ACCORDANCE WITH 45 C.F.R. § 46;
8
(4)
IDENTIFIABLE PRIVATE INFORMATION TO THE EXTENT THAT IT IS
9
COLLECTED AND USED AS PART OF HUMAN SUBJECTS RESEARCH IN ACCORDANCE
10
WITH THE ICH 36 GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY THE
11
INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICAL REQUIREMENTS
12
FOR PHARMACEUTICALS FOR HUMAN USE OR THE PROTECTION OF HUMAN
13
SUBJECTS UNDER 21 C.F.R. §§ 50 AND 56;
14
(5)
PATIENT SAFETY WORK PRODUCT THAT IS CREATED AND USED
15
FOR PURPOSES OF PATIENT SAFETY IMPROVEMENT IN ACCORDANCE WITH 42
16
C.F.R. § 3, ESTABLISHED IN ACCORDANCE WITH 42 U.S.C. §§ 299B–21 THROUGH
17
299B–26;
18
(6)
INFORMATION TO THE EXTENT IT IS USED FOR PUBLIC HEALTH,
19
COMMUNITY HEALTH, OR POPULATION HEALTH ACTIVITIES AND PURPOSES, AS
20
AUTHORIZED BY HIPAA, WHEN PROVIDED BY OR TO A COVERED ENTITY OR WHEN
21
PROVIDED BY OR TO A BUSINESS ASSOCIATE IN ACCORDANCE WITH THE BUSINESS
22
ASSOCIATE AGREEMENT WITH A COVERED ENTITY;
23
(7)
THE
COLLECTION,
MAINTENANCE,
DISCLOSURE,
SALE,
24
COMMUNICATION, OR USE OF PERSONAL INFORMATION BEARING ON A CONSUMER’S
25
CREDITWORTHINESS, CREDIT STANDING, CREDIT CAPACITY, CHARACTER, GENERAL
26
REPUTATION, PERSONAL CHARACTERISTICS, OR MODE OF LIVING BY A CONSUMER
27
REPORTING AGENCY, FURNISHER, OR USER THAT PROVIDES INFORMATION FOR USE
28
IN A CONSUMER REPORT, AND BY A USER OF A CONSUMER REPORT, BUT ONLY TO
29
THE EXTENT THAT THE ACTIVITY IS REGULATED BY AND AUTHORIZED UNDER THE
30
FEDERAL FAIR CREDIT REPORTING ACT;
31
(8)
PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED
32
IN COMPLIANCE WITH THE FEDERAL DRIVER’S PRIVACY PROTECTION ACT OF 1994;
33
14
SENATE BILL 541
(9)
PERSONAL
DATA
REGULATED
BY
THE
FEDERAL FAMILY
1
EDUCATIONAL RIGHTS AND PRIVACY ACT;
2
(10) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED
3
IN COMPLIANCE WITH THE FEDERAL FARM CREDIT ACT;
4
(11) DATA PROCESSED OR MAINTAINED:
5
(I)
IN
THE
COURSE
OF
AN
INDIVIDUAL
APPLYING
TO,
6
EMPLOYED BY, OR ACTING AS AN AGENT OR INDEPENDENT CONTRACTOR OF A
7
CONTROLLER, PROCESSOR, OR THIRD PARTY, TO THE EXTENT THAT THE DATA IS
8
COLLECTED AND USED WITHIN THE CONTEXT OF THE ROLE;
9
(II)
AS
THE
EMERGENCY
CONTACT
INFORMATION
OF
A
10
CONSUMER IF THE DATA IS USED FOR EMERGENCY CONTACT PURPOSES; OR
11
(III) THAT IS:
12
1.
NECESSARY TO RETAIN TO ADMINISTER BENEFITS
13
FOR ANOTHER INDIVIDUAL RELATING TO THE CONSUMER WHO IS THE SUBJECT OF
14
THE INFORMATION UNDER ITEM (I) OF THIS ITEM; AND
15
2.
USED FOR THE PURPOSES OF ADMINISTERING THE
16
BENEFITS; AND
17
(12) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED
18
IN RELATION TO PRICE, ROUTE, OR SERVICE BY AN AIR CARRIER SUBJECT TO THE
19
FEDERAL AIRLINE DEREGULATION ACT TO THE EXTENT THIS SUBTITLE IS
20
PREEMPTED BY THE FEDERAL AIRLINE DEREGULATION ACT.
21
(C)
CONTROLLERS AND PROCESSORS THAT COMPLY WITH THE VERIFIABLE
22
PARENTAL
CONSENT
REQUIREMENTS
OF COPPA
SHALL
BE
CONSIDERED
23
COMPLIANT WITH AN OBLIGATION TO OBTAIN PARENTAL CONSENT IN ACCORDANCE
24
WITH THIS SUBTITLE WITH RESPECT TO A CONSUMER WHO IS A CHILD.
25
14–4604.
26
A PERSON MAY NOT:
27
(1)
PROVIDE
AN
EMPLOYEE
OR
A
CONTRACTOR
ACCESS
TO
28
CONSUMER HEALTH DATA UNLESS THE EMPLOYEE OR CONTRACTOR IS SUBJECT TO
29
A CONTRACTUAL OR STATUTORY DUTY OF CONFIDENTIALITY;
30
SENATE BILL 541
15
(2)
PROVIDE A PROCESSOR ACCESS TO CONSUMER HEALTH DATA
1
UNLESS THE PERSON PROVIDING ACCESS TO THE CONSUMER HEALTH DATA AND
2
THE PROCESSOR COMPLY WITH § 14–4607 OF THIS SUBTITLE;
3
(3)
USE A GEOFENCE:
4
(I)
TO IDENTIFY, TRACK, COLLECT DATA FROM, OR SEND A
5
NOTIFICATION TO A CONSUMER REGARDING THE CONSUMER’S CONSUMER HEALTH
6
DATA; AND
7
(II)
WITHIN 1,750 FEET OF A MENTAL HEALTH FACILITY OR
8
REPRODUCTIVE OR SEXUAL HEALTH FACILITY; OR
9
(4)
SELL OR OFFER TO SELL CONSUMER HEALTH DATA WITHOUT THE
10
CONSENT OF THE CONSUMER WHOSE HEALTH DATA IS TO BE SOLD OR OFFERED TO
11
BE SOLD.
12
14–4605.
13
(A)
NOTHING IN THIS SECTION MAY BE CONSTRUED TO REQUIRE A
14
CONTROLLER TO REVEAL A TRADE SECRET.
15
(B)
A CONSUMER SHALL HAVE THE RIGHT TO:
16
(1)
CONFIRM
WHETHER A
CONTROLLER
IS PROCESSING
THE
17
CONSUMER’S PERSONAL DATA, UNLESS THAT CONFIRMATION WOULD REQUIRE THE
18
DISCLOSURE OF A TRADE SECRET;
19
(2)
IF A CONTROLLER IS PROCESSING A CONSUMER’S PERSONAL
20
DATA, ACCESS THE CONSUMER’S PERSONAL DATA UNLESS THAT ACCESS WOULD
21
REQUIRE THE DISCLOSURE OF A TRADE SECRET;
22
(3)
CONSIDERING THE NATURE OF THE CONSUMER’S PERSONAL
23
DATA AND THE PURPOSES OF THE PROCESSING OF THE PERSONAL DATA, CORRECT
24
INACCURACIES IN THE CONSUMER’S PERSONAL DATA;
25
(4)
REQUIRE A CONTROLLER TO DELETE PERSONAL DATA PROVIDED
26
BY, OR OBTAINED ABOUT, THE CONSUMER;
27
(5)
IF THE PROCESSING OF PERSONAL DATA IS DONE BY AUTOMATIC
28
MEANS, OBTAIN A COPY OF THE CONSUMER’S PERSONAL DATA PROCESSED BY THE
29
CONTROLLER IN A PORTABLE AND, TO THE EXTENT TECHNICALLY FEASIBLE,
30
16
SENATE BILL 541
READILY USABLE FORMAT THAT ALLOWS THE CONSUMER TO EASILY TRANSMIT THE
1
DATA TO ANOTHER CONTROLLER WITHOUT HINDRANCE;
2
(6)
OBTAIN A LIST OF THE CATEGORIES OF THIRD PARTIES TO WHICH
3
THE CONTROLLER HAS DISCLOSED THE CONSUMER’S PERSONAL DATA OR A LIST OF
4
THE CATEGORIES OF THIRD PARTIES TO WHICH THE CONTROLLER HAS DISCLOSED
5
ANY CONSUMER’S PERSONAL DATA IF THE CONTROLLER DOES NOT MAINTAIN THIS
6
INFORMATION IN A FORMAT SPECIFIC TO THE CONSUMER; AND
7
(7)
OPT OUT OF THE PROCESSING OF PERSONAL DATA FOR PURPOSES
8
OF:
9
(I)
TARGETED ADVERTISING;
10
(II)
THE SALE OF PERSONAL DATA; OR
11
(III) PROFILING IN FURTHERANCE OF SOLELY AUTOMATED
12
DECISIONS
THAT
PRODUCE
LEGAL
OR
SIMILARLY
SIGNIFICANT
EFFECTS
13
CONCERNING THE CONSUMER.
14
(C)
(1)
A CONTROLLER SHALL ESTABLISH A SECURE AND RELIABLE
15
METHOD FOR A CONSUMER TO EXERCISE A CONSUMER RIGHT UNDER THIS SECTION.
16
(2)
A CONSUMER MAY EXERCISE A CONSUMER RIGHT UNDER THIS
17
SECTION BY THE METHOD ESTABLISHED BY THE CONTROLLER UNDER PARAGRAPH
18
(1) OF THIS SUBSECTION.
19
(D)
(1)
A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT IN
20
ACCORDANCE WITH § 14–4606 OF THIS SUBTITLE TO OPT OUT OF THE PROCESSING
21
OF THE CONSUMER’S PERSONAL DATA UNDER SUBSECTION (B)(7) OF THIS SECTION
22
ON BEHALF OF A CONSUMER.
23
(2)
A PARENT OR LEGAL GUARDIAN OF A CHILD MAY EXERCISE A
24
CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE CHILD’S
25
BEHALF REGARDING THE PROCESSING OF PERSONAL DATA.
26
(3)
A GUARDIAN OR CONSERVATOR OF A CONSUMER SUBJECT TO A
27
GUARDIANSHIP, CONSERVATORSHIP, OR OTHER PROTECTIVE ARRANGEMENT MAY
28
EXERCISE A CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE
29
CONSUMER’S BEHALF REGARDING THE PROCESSING OF PERSONAL DATA.
30
SENATE BILL 541
17
(E)
(1)
EXCEPT
AS OTHERWISE
PROVIDED
IN THIS
SUBTITLE,
A
1
CONTROLLER SHALL COMPLY WITH A REQUEST BY A CONSUMER TO EXERCISE A
2
CONSUMER RIGHT LISTED IN THIS SECTION.
3
(2)
(I)
A CONTROLLER SHALL RESPOND TO A CONSUMER REQUEST
4
NOT LATER THAN 45 DAYS AFTER THE CONTROLLER RECEIVES THE CONSUMER
5
REQUEST.
6
(II)
A CONTROLLER MAY EXTEND THE COMPLETION PERIOD BY
7
AN ADDITIONAL 45 DAYS IF:
8
1.
IT IS REASONABLY NECESSARY TO COMPLETE THE
9
REQUEST BASED ON THE COMPLEXITY AND NUMBER OF THE CONSUMER’S
10
REQUESTS; AND
11
2.
THE CONTROLLER INFORMS THE CONSUMER OF THE
12
EXTENSION AND THE REASON FOR THE EXTENSION WITHIN THE INITIAL 45–DAY
13
RESPONSE PERIOD.
14
(III) A CONTROLLER SHALL NOTIFY THE CONSUMER WITHIN 30
15
DAYS AFTER COMPLYING WITH THE CONSUMER’S REQUEST THAT THE CONTROLLER
16
HAS COMPLIED WITH THE CONSUMER’S REQUEST.
17
(3)
IF A CONTROLLER DECLINES TO ACT REGARDING A CONSUMER’S
18
REQUEST, THE CONTROLLER SHALL:
19
(I)
INFORM THE CONSUMER WITHOUT UNDUE DELAY, BUT NOT
20
LATER THAN 45 DAYS AFTER RECEIVING THE REQUEST, OF THE JUSTIFICATION FOR
21
DECLINING TO ACT; AND
22
(II)
PROVIDE INSTRUCTIONS FOR HOW TO APPEAL THE
23
DECISION.
24
(4)
(I)
A CONTROLLER SHALL PROVIDE INFORMATION TO A
25
CONSUMER IN RESPONSE TO A CONSUMER’S REQUEST TO EXERCISE RIGHTS UNDER
26
THIS SUBTITLE FREE OF CHARGE ONCE DURING ANY 12–MONTH PERIOD.
27
(II)
IF REQUESTS FROM A CONSUMER ARE MANIFESTLY
28
UNFOUNDED,
EXCESSIVE,
TECHNICALLY
INFEASIBLE,
OR
REPETITIVE,
A
29
CONTROLLER MAY:
30
1.
CHARGE THE CONSUMER A REASONABLE FEE TO
31
COVER THE ADMINISTRATIVE COSTS OF COMPLYING WITH THE REQUEST; OR
32
18
SENATE BILL 541
2.
DECLINE TO ACT ON THE REQUEST.
1
(III) THE CONTROLLER HAS THE BURDEN OF DEMONSTRATING
2
THE
MANIFESTLY
UNFOUNDED,
EXCESSIVE,
TECHNICALLY
INFEASIBLE,
OR
3
REPETITIVE NATURE OF THE REQUEST.
4
(5)
IF A CONTROLLER IS UNABLE TO AUTHENTICATE A REQUEST TO
5
EXERCISE A CONSUMER RIGHT AFFORDED UNDER SUBSECTION (B)(1) THROUGH (5)
6
OF
THIS
SECTION
USING
COMMERCIALLY
REASONABLE
EFFORTS,
THE
7
CONTROLLER:
8
(I)
MAY NOT BE REQUIRED TO COMPLY WITH A REQUEST TO
9
INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION; AND
10
(II)
SHALL PROVIDE NOTICE TO THE CONSUMER THAT THE
11
CONTROLLER IS UNABLE TO AUTHENTICATE THE REQUEST TO EXERCISE THE RIGHT
12
UNTIL THE CONSUMER PROVIDES ADDITIONAL INFORMATION REASONABLY
13
NECESSARY TO AUTHENTICATE THE CONSUMER AND THE CONSUMER’S REQUEST TO
14
EXERCISE THE CONSUMER’S RIGHTS.
15
(6)
A CONTROLLER MAY NOT BE REQUIRED TO AUTHENTICATE AN
16
OPT–OUT REQUEST.
17
(7)
A CONTROLLER THAT HAS OBTAINED PERSONAL DATA ABOUT A
18
CONSUMER FROM A SOURCE OTHER THAN THE CONSUMER SHALL BE CONSIDERED
19
COMPLIANT WITH THE CONSUMER’S REQUEST TO DELETE THE CONSUMER’S DATA IN
20
ACCORDANCE WITH SUBSECTION (B)(4) OF THIS SECTION BY RETAINING A RECORD
21
OF THE DELETION REQUEST AND THE MINIMUM DATA NECESSARY FOR THE
22
PURPOSE OF ENSURING THAT THE CONSUMER’S PERSONAL DATA:
23
(I)
REMAINS DELETED FROM THE CONTROLLER’S RECORDS;
24
AND
25
(II)
IS NOT BEING USED FOR ANY OTHER PURPOSE.
26
(F)
(1)
A CONTROLLER SHALL ESTABLISH A PROCESS FOR A CONSUMER
27
TO APPEAL THE CONTROLLER’S REFUSAL TO ACT ON A CONSUMER RIGHTS REQUEST
28
WITHIN A REASONABLE PERIOD AFTER THE CONSUMER RECEIVES THE DECISION.
29
(2)
THE APPEAL PROCESS SHALL BE:
30
(I)
CONSPICUOUSLY AVAILABLE; AND
31
SENATE BILL 541
19
(II)
SIMILAR TO THE PROCESS FOR SUBMITTING REQUESTS TO
1
INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION.
2
(3)
NOT LATER THAN 60 DAYS AFTER RECEIVING AN APPEAL, A
3
CONTROLLER SHALL INFORM THE CONSUMER IN WRITING OF ANY ACTION TAKEN OR
4
NOT TAKEN IN RESPONSE TO THE APPEAL, INCLUDING A WRITTEN EXPLANATION OF
5
THE REASONS FOR THE DECISIONS.
6
(4)
IF A CONTROLLER DENIES AN APPEAL, THE CONTROLLER SHALL
7
PROVIDE THE CONSUMER WITH AN ONLINE MECHANISM, IF AVAILABLE, THROUGH
8
WHICH THE CONSUMER MAY CONTACT THE DIVISION TO SUBMIT A COMPLAINT.
9
14–4606.
10
(A)
(1)
A CONSUMER MAY DESIGNATE AN INDIVIDUAL TO SERVE AS THE
11
CONSUMER’S AUTHORIZED AGENT AND ACT ON THE CONSUMER’S BEHALF TO OPT
12
OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR ONE OR MORE
13
OF THE PURPOSES SPECIFIED IN § 14–4605(B)(7) OF THIS SUBTITLE.
14
(2)
A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT BY AN
15
INTERNET LINK OR A BROWSER SETTING, BROWSER EXTENSION, GLOBAL DEVICE
16
SETTING, OR OTHER SIMILAR TECHNOLOGY, INDICATING A CONSUMER’S INTENT TO
17
OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA.
18
(B)
A CONTROLLER SHALL COMPLY WITH AN OPT–OUT REQUEST RECEIVED
19
FROM AN AUTHORIZED AGENT IF, USING COMMERCIALLY REASONABLE EFFORTS,
20
THE CONTROLLER IS ABLE TO AUTHENTICATE:
21
(1)
THE IDENTITY OF THE CONSUMER; AND
22
(2)
THE
AUTHORIZED
AGENT’S
AUTHORITY
TO
ACT
ON
THE
23
CONSUMER’S BEHALF.
24
14–4607.
25
(A)
A CONTROLLER MAY NOT:
26
(1)
COLLECT PERSONAL DATA FOR THE SOLE PURPOSE OF CONTENT
27
PERSONALIZATION OR MARKETING WITHOUT THE CONSENT OF THE CONSUMER
28
WHOSE PERSONAL DATA IS COLLECTED;
29
20
SENATE BILL 541
(2)
EXCEPT WHERE THE COLLECTION OR PROCESSING IS STRICTLY
1
NECESSARY TO PROVIDE OR MAINTAIN A SPECIFIC PRODUCT OR SERVICE
2
REQUESTED BY THE CONSUMER TO WHOM THE PERSONAL DATA PERTAINS AND
3
UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT, COLLECT,
4
PROCESS, OR SHARE SENSITIVE DATA CONCERNING A CONSUMER;
5
(3)
SELL SENSITIVE DATA;
6
(4)
PROCESS PERSONAL DATA IN VIOLATION OF STATE OR FEDERAL
7
LAWS THAT PROHIBIT UNLAWFUL DISCRIMINATION;
8
(5)
PROCESS THE PERSONAL DATA OF A CONSUMER FOR THE
9
PURPOSES OF TARGETED ADVERTISING IF THE CONTROLLER KNEW OR SHOULD
10
HAVE KNOWN THAT THE CONSUMER IS AT LEAST 13 YEARS OLD AND UNDER THE AGE
11
OF 18 YEARS;
12
(6)
SELL THE PERSONAL DATA OF A CONSUMER WITHOUT THE
13
CONSUMER’S CONSENT IF THE CONTROLLER KNEW OR SHOULD HAVE KNOWN THAT
14
THE CONSUMER IS AT LEAST 13 YEARS OLD AND UNDER THE AGE OF 18 YEARS;
15
(7)
DISCRIMINATE AGAINST A CONSUMER FOR EXERCISING A
16
CONSUMER RIGHT CONTAINED IN THIS SUBTITLE, INCLUDING DENYING GOODS OR
17
SERVICES, CHARGING DIFFERENT PRICES OR RATES FOR GOODS OR SERVICES, OR
18
PROVIDING A DIFFERENT LEVEL OF QUALITY OF GOODS OR SERVICES TO THE
19
CONSUMER;
20
(8)
COLLECT, PROCESS, OR TRANSFER PERSONAL DATA OR PUBLICLY
21
AVAILABLE DATA IN A MANNER THAT UNLAWFULLY DISCRIMINATES IN OR
22
OTHERWISE UNLAWFULLY MAKES UNAVAILABLE THE EQUAL ENJOYMENT OF GOODS
23
OR SERVICES ON THE BASIS OF RACE, COLOR, RELIGION, NATIONAL ORIGIN, SEX,
24
SEXUAL
ORIENTATION,
GENDER
IDENTITY,
OR
DISABILITY,
UNLESS
THE
25
COLLECTION, PROCESSING, OR TRANSFER OF PERSONAL DATA IS FOR:
26
(I)
THE
CONTROLLER’S
SELF–TESTING
TO
PREVENT
OR
27
MITIGATE UNLAWFUL DISCRIMINATION;
28
(II)
THE CONTROLLER’S DIVERSIFYING OF AN APPLICANT,
29
PARTICIPANT, OR CUSTOMER POOL; OR
30
(III) A PRIVATE CLUB OR GROUP NOT OPEN TO THE PUBLIC, AS
31
DESCRIBED IN § 201(E) OF THE CIVIL RIGHTS ACT OF 1964; OR
32
SENATE BILL 541
21
(9)
UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT,
1
PROCESS PERSONAL DATA FOR A PURPOSE THAT IS NEITHER REASONABLY
2
NECESSARY TO, NOR COMPATIBLE WITH, THE DISCLOSED PURPOSES FOR WHICH
3
THE PERSONAL DATA IS PROCESSED, AS DISCLOSED TO THE CONSUMER.
4
(B)
(1)
A CONTROLLER SHALL:
5
(I)
LIMIT THE COLLECTION OF PERSONAL DATA TO WHAT IS
6
REASONABLY NECESSARY AND PROPORTIONATE TO PROVIDE OR MAINTAIN A
7
SPECIFIC PRODUCT OR SERVICE REQUESTED BY THE CONSUMER TO WHOM THE
8
DATA PERTAINS;
9
(II)
ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE
10
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO
11
PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL
12
DATA APPROPRIATE TO THE VOLUME AND NATURE OF THE PERSONAL DATA AT
13
ISSUE; AND
14
(III) PROVIDE AN EFFECTIVE MECHANISM FOR A CONSUMER TO
15
REVOKE THE CONSUMER’S CONSENT UNDER THIS SECTION THAT IS AT LEAST AS
16
EASY AS THE MECHANISM BY WHICH THE CONSUMER PROVIDED THE CONSUMER’S
17
CONSENT.
18
(2)
IF A CONSUMER REVOKES CONSENT UNDER THIS SECTION, THE
19
CONTROLLER SHALL STOP PROCESSING THE CONSUMER’S PERSONAL DATA AS SOON
20
AS PRACTICABLE, BUT NOT LATER THAN 15 DAYS AFTER RECEIVING THE REQUEST.
21
(C)
NOTHING IN SUBSECTION (A) OR (B) OF THIS SECTION MAY BE
22
CONSTRUED TO:
23
(1)
REQUIRE A CONTROLLER TO PROVIDE A PRODUCT OR SERVICE
24
THAT REQUIRES THE PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER
25
DOES NOT COLLECT OR MAINTAIN; OR
26
(2)
PROHIBIT A CONTROLLER FROM OFFERING A DIFFERENT PRICE,
27
RATE, LEVEL, QUALITY, OR SELECTION OF GOODS OR SERVICES TO A CONSUMER,
28
INCLUDING OFFERING GOODS OR SERVICES FOR NO FEE, IF THE OFFERING IS IN
29
CONNECTION WITH A CONSUMER’S VOLUNTARY PARTICIPATION IN A BONA FIDE
30
LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNTS, OR CLUB CARD PROGRAM.
31
(D)
A CONTROLLER SHALL PROVIDE A CONSUMER WITH A REASONABLY
32
ACCESSIBLE, CLEAR, AND MEANINGFUL PRIVACY NOTICE THAT INCLUDES:
33
22
SENATE BILL 541
(1)
THE CATEGORIES OF PERSONAL DATA PROCESSED BY THE
1
CONTROLLER, INCLUDING SENSITIVE DATA;
2
(2)
THE CONTROLLER’S PURPOSE FOR PROCESSING PERSONAL DATA;
3
(3)
HOW A CONSUMER MAY EXERCISE THE CONSUMER’S RIGHTS
4
UNDER
THIS
SUBTITLE,
INCLUDING
HOW
A
CONSUMER
MAY
APPEAL
A
5
CONTROLLER’S DECISION REGARDING THE CONSUMER’S REQUEST OR MAY REVOKE
6
CONSENT;
7
(4)
THE
CATEGORIES
OF
THIRD
PARTIES
WITH
WHICH
THE
8
CONTROLLER SHARES PERSONAL DATA WITH A LEVEL OF DETAIL THAT ENABLES A
9
CONSUMER TO UNDERSTAND WHAT TYPE OF ENTITY EACH THIRD PARTY IS AND, TO
10
THE EXTENT POSSIBLE, HOW EACH THIRD PARTY MAY PROCESS THE PERSONAL
11
DATA;
12
(5)
THE CATEGORIES OF PERSONAL DATA, INCLUDING SENSITIVE
13
DATA, THAT THE CONTROLLER SHARES WITH THIRD PARTIES; AND
14
(6)
AN ACTIVE E–MAIL ADDRESS OR OTHER ONLINE MECHANISM
15
THAT A CONSUMER MAY USE TO CONTACT THE CONTROLLER.
16
(E)
IF A CONTROLLER SELLS PERSONAL DATA TO THIRD PARTIES OR
17
PROCESSES PERSONAL DATA FOR TARGETED ADVERTISING OR FOR THE PURPOSES
18
OF PROFILING THE CONSUMER IN FURTHERANCE OF DECISIONS THAT PRODUCE
19
LEGAL OR SIMILARLY SIGNIFICANT EFFECTS, THE CONTROLLER SHALL CLEARLY
20
AND CONSPICUOUSLY DISCLOSE THE PROCESSING, AS WELL AS THE MANNER IN
21
WHICH A CONSUMER MAY EXERCISE THE RIGHT TO OPT OUT OF THE PROCESSING.
22
(F)
(1)
THE PRIVACY NOTICE UNDER SUBSECTION (D) OF THIS SECTION
23
SHALL ESTABLISH ONE OR MORE SECURE AND RELIABLE METHODS FOR A
24
CONSUMER TO SUBMIT A REQUEST TO EXERCISE A CONSUMER RIGHT IN
25
ACCORDANCE WITH THIS SUBTITLE THAT TAKE INTO ACCOUNT:
26
(I)
THE WAYS IN WHICH CONSUMERS NORMALLY INTERACT
27
WITH THE CONTROLLER;
28
(II)
THE NEED FOR SECURE AND RELIABLE COMMUNICATION
29
OF CONSUMER REQUESTS; AND
30
(III) THE ABILITY OF THE CONTROLLER TO VERIFY THE
31
IDENTITY OF A CONSUMER MAKING THE REQUEST.
32
SENATE BILL 541
23
(2)
(I)
A CONTROLLER MAY NOT REQUIRE A CONSUMER TO
1
CREATE A NEW ACCOUNT IN ORDER TO EXERCISE A CONSUMER RIGHT.
2
(II)
A CONTROLLER MAY REQUIRE A CONSUMER TO USE AN
3
EXISTING ACCOUNT TO EXERCISE A CONSUMER RIGHT.
4
(3)
A CONTROLLER MAY UTILIZE THE FOLLOWING METHODS TO
5
SATISFY PARAGRAPH (1) OF THIS SUBSECTION:
6
(I)
PROVIDING A CLEAR AND CONSPICUOUS LINK ON THE
7
CONTROLLER’S WEBSITE TO A WEBPAGE THAT ALLOWS A CONSUMER, OR AN
8
AUTHORIZED AGENT OF THE CONSUMER, TO OPT OUT OF THE TARGETED
9
ADVERTISING OR THE SALE OF THE CONSUMER’S PERSONAL DATA; OR
10
(II)
ON OR BEFORE OCTOBER 1, 2025, ALLOWING A CONSUMER
11
TO OPT OUT OF ANY PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR THE
12
PURPOSES OF TARGETED ADVERTISING, OR ANY SALE OF PERSONAL DATA,
13
THROUGH AN OPT–OUT PREFERENCE SIGNAL SENT, WITH THE CONSUMER’S
14
CONSENT, BY A PLATFORM, TECHNOLOGY, OR MECHANISM TO THE CONTROLLER
15
INDICATING THE CONSUMER’S INTENT TO OPT OUT OF THE PROCESSING OR SALE.
16
(4)
A
PLATFORM,
TECHNOLOGY,
OR
MECHANISM
USED
IN
17
ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION SHALL:
18
(I)
BE CONSUMER–FRIENDLY AND EASY TO USE BY THE
19
AVERAGE CONSUMER;
20
(II)
USE CLEAR, EASY TO UNDERSTAND, AND UNAMBIGUOUS
21
LANGUAGE;
22
(III) BE AS CONSISTENT AS POSSIBLE WITH ANY OTHER SIMILAR
23
PLATFORM, TECHNOLOGY, OR MECHANISM REQUIRED BY ANY FEDERAL OR STATE
24
LAW OR REGULATION;
25
(IV) ENABLE THE CONTROLLER TO REASONABLY DETERMINE
26
WHETHER THE CONSUMER:
27
1.
IS A RESIDENT OF THE STATE; AND
28
2.
HAS MADE A LEGITIMATE REQUEST TO OPT OUT OF
29
ANY SALE OF THE CONSUMER’S PERSONAL DATA OR TARGETED ADVERTISING; AND
30
24
SENATE BILL 541
(V)
REQUIRE A CONSUMER TO MAKE AN AFFIRMATIVE,
1
UNAMBIGUOUS, AND VOLUNTARY CHOICE IN ORDER TO OPT OUT OF ANY
2
PROCESSING OF THE CONSUMER’S PERSONAL DATA.
3
(5)
A
PLATFORM,
TECHNOLOGY,
OR
MECHANISM
USED
IN
4
ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION MAY NOT:
5
(I)
UNFAIRLY DISADVANTAGE ANOTHER CONTROLLER; OR
6
(II)
USE A DEFAULT SETTING TO OPT A CONSUMER OUT OF ANY
7
PROCESSING OF THE CONSUMER’S PERSONAL DATA.
8
(G)
IF A CONSUMER’S DECISION TO OPT OUT OF THE PROCESSING OF THE
9
CONSUMER’S PERSONAL DATA FOR THE PURPOSES OF TARGETED ADVERTISING, OR
10
THE SALE OF PERSONAL DATA THROUGH AN OPT–OUT PREFERENCE SIGNAL SENT IN
11
ACCORDANCE WITH SUBSECTION (F)(3) OF THIS SECTION CONFLICTS WITH THE
12
CONSUMER’S
EXISTING
CONTROLLER–SPECIFIC
PRIVACY
SETTING
OR
THE
13
CONSUMER’S VOLUNTARY PARTICIPATION IN A CONTROLLER’S BONA FIDE LOYALTY,
14
REWARDS, PREMIUM FEATURES, DISCOUNTS, OR CLUB CARD PROGRAM, THE
15
CONTROLLER MAY NOTIFY THE CONSUMER OF A CONFLICT AND PROVIDE THE
16
CHOICE
TO
CONFIRM
CONTROLLER–SPECIFIC
PRIVACY
SETTINGS
OR
17
PARTICIPATION IN A PROGRAM LISTED IN THIS PARAGRAPH.
18
14–4608.
19
(A)
(1)
IF A CONTROLLER USES A PROCESSOR TO PROCESS THE
20
PERSONAL DATA OF CONSUMERS, THE CONTROLLER AND THE PROCESSOR SHALL
21
ENTER INTO A CONTRACT THAT GOVERNS THE PROCESSOR’S DATA PROCESSING
22
PROCEDURES WITH RESPECT TO PROCESSING PERFORMED ON BEHALF OF THE
23
CONTROLLER.
24
(2)
THE CONTRACT SHALL BE BINDING AND SHALL CLEARLY SET
25
FORTH INSTRUCTIONS FOR:
26
(I)
PROCESSING DATA;
27
(II)
THE NATURE AND PURPOSE OF PROCESSING;
28
(III) THE TYPE OF DATA SUBJECT TO PROCESSING;
29
(IV) THE DURATION OF PROCESSING; AND
30
(V)
THE RIGHTS AND OBLIGATIONS OF BOTH PARTIES.
31
SENATE BILL 541
25
(3)
THE CONTRACT SHALL REQUIRE THAT THE PROCESSOR:
1
(I)
ENSURE THAT EACH PERSON PROCESSING PERSONAL DATA
2
IS SUBJECT TO A DUTY OF CONFIDENTIALITY WITH RESPECT TO THE PERSONAL
3
DATA;
4
(II)
ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE
5
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO
6
PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL
7
DATA, CONSIDERING THE VOLUME AND NATURE OF THE PERSONAL DATA;
8
(III) STOP PROCESSING DATA ON REQUEST BY THE CONTROLLER
9
MADE IN ACCORDANCE WITH A CONSUMER’S AUTHENTICATED REQUEST;
10
(IV) AT THE CONTROLLER’S DIRECTION, DELETE OR RETURN
11
ALL PERSONAL DATA TO THE CONTROLLER AS REQUESTED AT THE END OF THE
12
PROVISION OF SERVICE, UNLESS RETENTION OF THE PERSONAL DATA IS REQUIRED
13
BY LAW;
14
(V)
ON THE REASONABLE REQUEST OF THE CONTROLLER,
15
MAKE AVAILABLE TO THE CONTROLLER ALL INFORMATION IN THE PROCESSOR’S
16
POSSESSION NECESSARY TO DEMONSTRATE THE PROCESSOR’S COMPLIANCE WITH
17
THE OBLIGATIONS IN THIS SUBTITLE;
18
(VI) AFTER PROVIDING THE CONTROLLER AN OPPORTUNITY TO
19
OBJECT, ENGAGE A SUBCONTRACTOR TO ASSIST WITH PROCESSING PERSONAL DATA
20
ON THE CONTROLLER’S BEHALF ONLY IN ACCORDANCE WITH A WRITTEN CONTRACT
21
THAT REQUIRES THE SUBCONTRACTOR TO MEET THE PROCESSOR’S OBLIGATIONS
22
REGARDING THE PERSONAL DATA UNDER THE PROCESSOR’S CONTRACT WITH THE
23
CONTROLLER; AND
24
(VII) ALLOW AND COOPERATE WITH REASONABLE ASSESSMENTS
25
BY THE CONTROLLER, THE CONTROLLER’S DESIGNATED ASSESSOR, OR A QUALIFIED
26
AND INDEPENDENT ASSESSOR ARRANGED FOR BY THE PROCESSOR TO ASSESS THE
27
PROCESSOR’S POLICIES AND TECHNICAL AND ORGANIZATIONAL MEASURES IN
28
SUPPORT OF THE OBLIGATIONS UNDER THIS SUBTITLE.
29
(4)
(I)
ON REQUEST, THE PROCESSOR SHALL PROVIDE A REPORT
30
OF AN ASSESSMENT REQUIRED BY PARAGRAPH (3)(V) OF THIS SUBSECTION TO THE
31
CONTROLLER.
32
26
SENATE BILL 541
(II)
AN ASSESSMENT CONDUCTED IN ACCORDANCE WITH
1
PARAGRAPH (3)(V) OF THIS SUBSECTION SHALL BE CONDUCTED USING AN
2
APPROPRIATE AND ACCEPTED CONTROL STANDARD OR FRAMEWORK AND
3
ASSESSMENT PROCEDURE FOR THE ASSESSMENTS.
4
(B)
(1)
IF A CONTROLLER USES A PROCESSOR TO PROCESS THE
5
PERSONAL DATA OF CONSUMERS, THE CONTROLLER SHALL PROVIDE THE
6
PROCESSOR WITH INSTRUCTIONS ON HOW TO PROCESS PERSONAL DATA.
7
(2)
A PROCESSOR SHALL:
8
(I)
ADHERE TO THE CONTRACT AND INSTRUCTIONS OF A
9
CONTROLLER;
10
(II)
ASSIST THE CONTROLLER IN MEETING THE CONTROLLER’S
11
OBLIGATIONS UNDER THIS SUBTITLE, INCLUDING, CONSIDERING THE NATURE OF
12
PROCESSING AND THE INFORMATION AVAILABLE TO THE PROCESSOR:
13
1.
BY APPROPRIATE TECHNICAL AND ORGANIZATIONAL
14
MEASURES
AS
MUCH
AS
REASONABLY
PRACTICABLE
TO
FULFILL
THE
15
CONTROLLER’S OBLIGATION TO RESPOND TO CONSUMER RIGHTS REQUESTS; AND
16
2.
BY ASSISTING THE CONTROLLER IN MEETING THE
17
CONTROLLER’S OBLIGATIONS IN RELATION TO THE SECURITY OF PROCESSING THE
18
PERSONAL DATA AND IN RELATION TO THE NOTIFICATION OF A BREACH OF THE
19
SECURITY OF A SYSTEM, AS DEFINED IN § 14–3504 OF THIS TITLE; AND
20
(III) PROVIDE NECESSARY INFORMATION TO ENABLE THE
21
CONTROLLER TO CONDUCT AND DOCUMENT DATA PROTECTION ASSESSMENTS.
22
(C)
NOTHING IN THIS SECTION MAY BE CONSTRUED TO RELIEVE A
23
CONTROLLER OR A PROCESSOR FROM THE LIABILITIES IMPOSED ON THE
24
CONTROLLER OR PROCESSOR BY VIRTUE OF THE CONTROLLER’S OR PROCESSOR’S
25
ROLE IN THE PROCESSING RELATIONSHIP IN ACCORDANCE WITH THIS SECTION.
26
(D)
(1)
THE DETERMINATION OF WHETHER A PERSON IS ACTING AS A
27
CONTROLLER OR A PROCESSOR WITH RESPECT TO A SPECIFIC PROCESSING OF DATA
28
IS A FACT–BASED DETERMINATION THAT DEPENDS ON THE CONTEXT IN WHICH
29
PERSONAL DATA IS BEING PROCESSED.
30
(2)
A PERSON IS CONSIDERED TO BE A CONTROLLER IF THE PERSON:
31
SENATE BILL 541
27
(I)
IS NOT LIMITED IN THE PERSON’S PROCESSING OF SPECIFIC
1
PERSONAL DATA IN ACCORDANCE WITH A CONTROLLER’S INSTRUCTIONS; OR
2
(II)
FAILS TO ADHERE TO A CONTROLLER’S INSTRUCTIONS
3
WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA.
4
(3)
A PROCESSOR THAT CONTINUES TO ADHERE TO A CONTROLLER’S
5
INSTRUCTIONS WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA
6
REMAINS A PROCESSOR.
7
(4)
IF A PROCESSOR OR THIRD PARTY BEGINS, ALONE OR JOINTLY
8
WITH OTHERS, DETERMINING THE PURPOSES AND MEANS OF THE PROCESSING OF
9
PERSONAL DATA, THE PROCESSOR:
10
(I)
IS A CONTROLLER WITH RESPECT TO THE PROCESSING; AND
11
(II)
MAY BE SUBJECT TO AN ENFORCEMENT ACTION UNDER
12
THIS SUBTITLE.
13
(E)
NOTHING IN THIS SECTION MAY BE CONSTRUED TO ALTER A
14
CONTROLLER’S OBLIGATION TO LIMIT A PERSON’S PROCESSING OF PERSONAL DATA
15
OR TO TAKE STEPS TO ENSURE THAT A PROCESSOR ADHERES TO THE CONTROLLER’S
16
INSTRUCTIONS.
17
14–4609.
18
(A)
IF A THIRD PARTY USES OR SHARES A CONSUMER’S INFORMATION IN A
19
MANNER INCONSISTENT WITH PROMISES MADE TO THE CONSUMER AT THE TIME OF
20
COLLECTION OF THE INFORMATION, THE THIRD PARTY SHALL PROVIDE AN
21
AFFECTED CONSUMER WITH NOTICE OF THE NEW OR CHANGED PRACTICE BEFORE
22
IMPLEMENTING THE NEW OR CHANGED PRACTICE.
23
(B)
THE NOTICE PROVIDED UNDER SUBSECTION (A) OF THIS SECTION
24
SHALL BE PROVIDED IN A MANNER AND AT A TIME REASONABLY CALCULATED TO
25
ALLOW A CONSUMER TO EXERCISE THE RIGHTS PROVIDED UNDER THIS SUBTITLE.
26
14–4610.
27
(A)
IN
THIS
SECTION, “PROCESSING
ACTIVITIES
THAT
PRESENT A
28
HEIGHTENED RISK OF HARM TO A CONSUMER” MEANS:
29
(1)
THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF
30
TARGETED ADVERTISING;
31
28
SENATE BILL 541
(2)
THE SALE OF PERSONAL DATA;
1
(3)
THE PROCESSING OF SENSITIVE DATA; AND
2
(4)
THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF
3
PROFILING, IN WHICH THE PROFILING PRESENTS A REASONABLY FORESEEABLE
4
RISK OF:
5
(I)
UNFAIR, ABUSIVE, OR DECEPTIVE TREATMENT OF A
6
CONSUMER;
7
(II)
HAVING
AN
UNLAWFUL
DISPARATE
IMPACT
ON
A
8
CONSUMER;
9
(III) FINANCIAL, PHYSICAL, OR REPUTATIONAL INJURY TO A
10
CONSUMER;
11
(IV) A PHYSICAL OR OTHER INTRUSION ON THE SOLITUDE OR
12
SECLUSION OR THE PRIVATE AFFAIRS OR CONCERNS OF A CONSUMER IN WHICH THE
13
INTRUSION WOULD BE OFFENSIVE TO A REASONABLE PERSON; OR
14
(V)
OTHER SUBSTANTIAL INJURY TO A CONSUMER.
15
(B)
A CONTROLLER SHALL CONDUCT AND DOCUMENT, ON A REGULAR
16
BASIS, A DATA PROTECTION ASSESSMENT FOR EACH OF THE CONTROLLER’S
17
PROCESSING ACTIVITIES THAT PRESENT A HEIGHTENED RISK OF HARM TO A
18
CONSUMER, INCLUDING AN ASSESSMENT FOR EACH ALGORITHM THAT IS USED.
19
(C)
(1)
A DATA PROTECTION ASSESSMENT CONDUCTED IN ACCORDANCE
20
WITH THIS SECTION SHALL IDENTIFY AND WEIGH THE BENEFITS THAT MAY FLOW
21
DIRECTLY AND INDIRECTLY FROM THE PROCESSING TO THE CONTROLLER, THE
22
CONSUMER, OTHER INTERESTED PARTIES, AND THE PUBLIC AGAINST:
23
(I)
THE POTENTIAL RISKS TO THE RIGHTS OF THE CONSUMER
24
ASSOCIATED WITH THE PROCESSING AS MITIGATED BY SAFEGUARDS THAT MAY BE
25
EMPLOYED BY THE CONTROLLER TO REDUCE THESE RISKS; AND
26
(II)
THE NECESSITY AND PROPORTIONALITY OF PROCESSING IN
27
RELATION TO THE STATED PURPOSE OF THE PROCESSING.
28
(2)
THE CONTROLLER SHALL FACTOR INTO A DATA PROTECTION
29
ASSESSMENT:
30
SENATE BILL 541
29
(I)
THE USE OF DE–IDENTIFIED DATA;
1
(II)
THE REASONABLE EXPECTATIONS OF CONSUMERS;
2
(III) THE CONTEXT OF THE PROCESSING; AND
3
(IV) THE RELATIONSHIP BETWEEN THE CONTROLLER AND THE
4
CONSUMER WHOSE PERSONAL DATA WILL BE PROCESSED.
5
(D)
(1)
THE DIVISION MAY REQUIRE THAT A CONTROLLER MAKE
6
AVAILABLE TO THE DIVISION A DATA PROTECTION ASSESSMENT THAT IS RELEVANT
7
TO AN INVESTIGATION CONDUCTED BY THE DIVISION.
8
(2)
(I)
THE DIVISION MAY EVALUATE A DATA PROTECTION
9
ASSESSMENT FOR COMPLIANCE WITH THE RESPONSIBILITIES ESTABLISHED IN THIS
10
SUBTITLE.
11
(II)
A CONTROLLER’S DATA PROTECTION ASSESSMENT MAY BE
12
USED IN AN ACTION TO ENFORCE THIS SUBTITLE.
13
(3)
A DATA PROTECTION ASSESSMENT IS CONFIDENTIAL AND IS
14
EXEMPT FROM DISCLOSURE UNDER THE FEDERAL FREEDOM OF INFORMATION ACT
15
OR THE PUBLIC INFORMATION ACT.
16
(E)
A
SINGLE
DATA
PROTECTION
ASSESSMENT
MAY
ADDRESS
A
17
COMPARABLE
SET
OF
PROCESSING
OPERATIONS
THAT
INCLUDE
SIMILAR
18
ACTIVITIES.
19
(F)
IF A CONTROLLER CONDUCTS A DATA PROTECTION ASSESSMENT FOR
20
THE PURPOSE OF COMPLYING WITH ANOTHER APPLICABLE LAW OR REGULATION,
21
THE DATA PROTECTION ASSESSMENT SHALL BE CONSIDERED TO SATISFY THE
22
REQUIREMENTS ESTABLISHED IN THIS SECTION IF THE DATA PROTECTION
23
ASSESSMENT IS REASONABLY SIMILAR IN SCOPE AND EFFECT TO THE DATA
24
PROTECTION
ASSESSMENT
THAT
WOULD
OTHERWISE
BE
CONDUCTED
IN
25
ACCORDANCE WITH THIS SECTION.
26
(G)
TO THE EXTENT THAT ANY INFORMATION CONTAINED IN A DATA
27
PROTECTION ASSESSMENT DISCLOSED TO THE DIVISION INCLUDES INFORMATION
28
SUBJECT TO ATTORNEY–CLIENT PRIVILEGE OR WORK PRODUCT PROTECTION, THE
29
DISCLOSURE MAY NOT CONSTITUTE A WAIVER OF THAT PRIVILEGE OR PROTECTION.
30
14–4611.
31
30
SENATE BILL 541
(A)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A
1
CONTROLLER OR A PROCESSOR TO:
2
(1)
RE–IDENTIFY DE–IDENTIFIED DATA;
3
(2)
MAINTAIN DATA IN AN IDENTIFIABLE FORM; OR
4
(3)
COLLECT,
OBTAIN,
RETAIN,
OR
ACCESS
ANY
DATA
OR
5
TECHNOLOGY IN ORDER TO BE CAPABLE OF ASSOCIATING AN AUTHENTICATED
6
CONSUMER REQUEST WITH PERSONAL DATA.
7
(B)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A
8
CONTROLLER OR PROCESSOR TO COMPLY WITH AN AUTHENTICATED CONSUMER
9
RIGHTS REQUEST IF THE CONTROLLER:
10
(1)
IS NOT REASONABLY CAPABLE OF ASSOCIATING THE REQUEST
11
WITH THE PERSONAL DATA OR IT WOULD BE UNREASONABLY BURDENSOME FOR THE
12
CONTROLLER TO ASSOCIATE THE REQUEST WITH THE PERSONAL DATA;
13
(2)
DOES NOT USE THE PERSONAL DATA TO RECOGNIZE OR RESPOND
14
TO THE SPECIFIC CONSUMER WHO IS THE SUBJECT OF THE PERSONAL DATA OR
15
ASSOCIATE THE PERSONAL DATA WITH OTHER PERSONAL DATA ABOUT THE SAME
16
SPECIFIC CONSUMER; AND
17
(3)
DOES NOT SELL THE PERSONAL DATA TO A THIRD PARTY OR
18
OTHERWISE VOLUNTARILY DISCLOSE THE PERSONAL DATA TO A THIRD PARTY
19
OTHER THAN A PROCESSOR, EXCEPT AS OTHERWISE ALLOWED IN THIS SUBTITLE.
20
(C)
(1)
A CONTROLLER THAT DISCLOSES DE–IDENTIFIED DATA SHALL:
21
(I)
EXERCISE
REASONABLE
OVERSIGHT
TO
MONITOR
22
COMPLIANCE
WITH
ANY
CONTRACTUAL
COMMITMENTS
TO
WHICH
THE
23
DE–IDENTIFIED DATA IS SUBJECT; AND
24
(II)
TAKE APPROPRIATE STEPS TO ADDRESS ANY BREACHES OF
25
ANY CONTRACTUAL COMMITMENTS.
26
(2)
THE DETERMINATION OF WHETHER OVERSIGHT IS REASONABLE
27
AND WHETHER APPROPRIATE STEPS WERE TAKEN IN ACCORDANCE WITH
28
PARAGRAPH (1) OF THIS SUBSECTION SHALL TAKE INTO ACCOUNT WHETHER THE
29
DISCLOSED DATA INCLUDES DATA THAT WOULD BE CONSIDERED SENSITIVE DATA IF
30
THE DATA WERE RE–IDENTIFIED.
31
SENATE BILL 541
31
14–4612.
1
(A)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO RESTRICT A
2
CONTROLLER’S OR PROCESSOR’S ABILITY TO:
3
(1)
COMPLY
WITH
FEDERAL,
STATE,
OR
LOCAL
LAWS
OR
4
REGULATIONS;
5
(2)
COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY,
6
INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL, STATE, LOCAL, OR OTHER
7
GOVERNMENTAL AUTHORITY;
8
(3)
COOPERATE WITH LAW ENFORCEMENT AGENCIES CONCERNING
9
CONDUCT OR ACTIVITY THAT THE CONTROLLER OR PROCESSOR REASONABLY AND
10
IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR LOCAL LAWS OR
11
REGULATIONS;
12
(4)
INVESTIGATE, ESTABLISH, EXERCISE, PREPARE FOR, OR DEFEND
13
A LEGAL CLAIM;
14
(5)
PROVIDE A PRODUCT OR SERVICE SPECIFICALLY REQUESTED BY
15
A CONSUMER;
16
(6)
PERFORM UNDER A CONTRACT TO WHICH A CONSUMER IS A
17
PARTY, INCLUDING FULFILLING THE TERMS OF A WRITTEN WARRANTY;
18
(7)
TAKE STEPS AT THE REQUEST OF A CONSUMER BEFORE
19
ENTERING INTO A CONTRACT;
20
(8)
TAKE IMMEDIATE STEPS TO PROTECT AN INTEREST THAT IS
21
ESSENTIAL FOR THE LIFE OR PHYSICAL SAFETY OF A CONSUMER OR ANOTHER
22
INDIVIDUAL AND WHEN THE PROCESSING CANNOT BE MANIFESTLY BASED ON
23
ANOTHER LEGAL BASIS;
24
(9)
PREVENT,
DETECT,
PROTECT
AGAINST,
INVESTIGATE,
25
PROSECUTE THOSE RESPONSIBLE, OR OTHERWISE RESPOND TO A SECURITY
26
INCIDENT, IDENTITY THEFT, FRAUD, HARASSMENT, MALICIOUS OR DECEPTIVE
27
ACTIVITY, OR ANY OTHER TYPE OF ILLEGAL ACTIVITY;
28
(10) PRESERVE THE INTEGRITY OR SECURITY OF SYSTEMS; OR
29
32
SENATE BILL 541
(11) ASSIST ANOTHER CONTROLLER, PROCESSOR, OR THIRD PARTY
1
WITH AN OBLIGATION UNDER THIS SUBTITLE.
2
(B)
(1)
THIS SUBSECTION DOES
NOT APPLY TO AN OBLIGATION
3
REQUIRED UNDER § 14–4611 OF THIS SUBTITLE.
4
(2)
AN OBLIGATION IMPOSED ON A CONTROLLER OR PROCESSOR
5
UNDER THIS SUBTITLE MAY NOT RESTRICT A CONTROLLER’S OR PROCESSOR’S
6
ABILITY TO COLLECT, USE, OR RETAIN PERSONAL DATA FOR INTERNAL USE TO:
7
(I)
EFFECTUATE A PRODUCT RECALL;
8
(II)
IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR
9
EXISTING OR INTENDED FUNCTIONALITY; OR
10
(III) PERFORM INTERNAL OPERATIONS THAT ARE:
11
1.
REASONABLY ALIGNED WITH THE EXPECTATIONS OF
12
THE CONSUMER OR CAN BE REASONABLY ANTICIPATED BASED ON THE CONSUMER’S
13
EXISTING RELATIONSHIP WITH THE CONTROLLER; OR
14
2.
OTHERWISE COMPATIBLE WITH PROCESSING DATA IN
15
FURTHERANCE OF:
16
A.
THE
PROVISION
OF
A
PRODUCT
OR
SERVICE
17
SPECIFICALLY REQUESTED BY A CONSUMER; OR
18
B.
THE PERFORMANCE OF A CONTRACT TO WHICH THE
19
CONSUMER IS A PARTY.
20
(C)
(1)
AN OBLIGATION IMPOSED ON A CONTROLLER OR A PROCESSOR
21
UNDER THIS SUBTITLE DOES NOT APPLY WHEN COMPLIANCE BY THE CONTROLLER
22
OR PROCESSOR WITH THE SUBTITLE WOULD VIOLATE AN EVIDENTIARY PRIVILEGE
23
UNDER STATE LAW.
24
(2)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO PREVENT A
25
CONTROLLER OR PROCESSOR FROM PROVIDING PERSONAL DATA CONCERNING A
26
CONSUMER TO A PERSON COVERED BY AN EVIDENTIARY PRIVILEGE UNDER STATE
27
LAW AS PART OF A PRIVILEGED COMMUNICATION.
28
(D)
A
THIRD–PARTY CONTROLLER
OR
PROCESSOR THAT
RECEIVES
29
PERSONAL DATA FROM A CONTROLLER OR PROCESSOR IN COMPLIANCE WITH THIS
30
SUBTITLE IS NOT IN VIOLATION OF THIS SUBTITLE FOR THE INDEPENDENT
31
SENATE BILL 541
33
MISCONDUCT
OF
THE
CONTROLLER
OR
PROCESSOR
FROM
WHICH
THE
1
THIRD–PARTY CONTROLLER OR PROCESSOR RECEIVED THE PERSONAL DATA.
2
(E)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO:
3
(1)
IMPOSE AN OBLIGATION ON A CONTROLLER OR A PROCESSOR
4
THAT ADVERSELY AFFECTS THE RIGHTS OR FREEDOMS OF ANY PERSON, INCLUDING
5
THE RIGHTS OF A PERSON TO FREEDOM OF SPEECH OR FREEDOM OF THE PRESS AS
6
GUARANTEED IN THE FIRST AMENDMENT TO THE U.S. CONSTITUTION; OR
7
(2)
APPLY TO A PERSON’S PROCESSING OF PERSONAL DATA DURING
8
THE PERSON’S PERSONAL OR HOUSEHOLD ACTIVITIES.
9
(F)
IF A CONTROLLER PROCESSES PERSONAL DATA IN ACCORDANCE WITH
10
AN EXEMPTION UNDER THIS SECTION, THE CONTROLLER SHALL DEMONSTRATE
11
THAT THE PROCESSING:
12
(1)
QUALIFIES FOR AN EXEMPTION; AND
13
(2)
COMPLIES WITH THE REQUIREMENTS OF SUBSECTION (G) OF THIS
14
SECTION.
15
(G)
PERSONAL DATA PROCESSED BY A CONTROLLER IN ACCORDANCE WITH
16
THIS SECTION:
17
(1)
SHALL
BE
SUBJECT
TO
REASONABLE
ADMINISTRATIVE,
18
TECHNICAL, AND PHYSICAL MEASURES TO:
19
(I)
PROTECT
THE
CONFIDENTIALITY,
INTEGRITY,
AND
20
ACCESSIBILITY OF THE PERSONAL DATA; AND
21
(II)
REDUCE REASONABLY FORESEEABLE RISKS OF HARM TO
22
CONSUMERS RELATING TO THE COLLECTION, USE, OR RETENTION OF PERSONAL
23
DATA; AND
24
(2)
MAY BE PROCESSED TO THE EXTENT THAT THE PROCESSING IS:
25
(I)
REASONABLY NECESSARY AND PROPORTIONATE TO THE
26
PURPOSES LISTED IN THIS SECTION; AND
27
(II)
ADEQUATE,
RELEVANT,
AND
LIMITED
TO
WHAT
IS
28
NECESSARY IN RELATION TO THE SPECIFIC PURPOSES LISTED IN THIS SECTION.
29
34
SENATE BILL 541
(H)
A PERSON THAT PROCESSES PERSONAL DATA FOR A PURPOSE
1
EXPRESSLY IDENTIFIED IN THIS SECTION MAY NOT BE CONSIDERED A CONTROLLER
2
SOLELY BASED ON THE PROCESSING OF PERSONAL DATA.
3
14–4613.
4
(A)
EXCEPT AS PROVIDED IN SUBSECTION (B) OF THIS SECTION, A
5
VIOLATION OF THIS SUBTITLE IS:
6
(1)
AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE PRACTICE WITHIN
7
THE MEANING OF TITLE 13 OF THIS ARTICLE; AND
8
(2)
SUBJECT TO THE ENFORCEMENT AND PENALTY PROVISIONS
9
CONTAINED IN TITLE 13 OF THIS ARTICLE, EXCEPT FOR § 13–408 OF THIS ARTICLE.
10
(B)
THIS SECTION DOES NOT PREVENT A CONSUMER FROM PURSUING ANY
11
OTHER REMEDY PROVIDED BY LAW.
12
SECTION 2. AND BE IT FURTHER ENACTED, That § 14–4612 of the Commercial
13
Law Article, as enacted by Section 1 of this Act, shall be construed to apply only
14
prospectively and may not be applied or interpreted to have any effect on or application to
15
any personal data processing activities before April 1, 2025.
16
SECTION 3. AND BE IT FURTHER ENACTED, That this Act shall take effect
17
October 1, 2024.
18
As enrolled or final
68,944 characters
WES MOORE, Governor
Ch. 455
– 1 –
Chapter 455
(Senate Bill 541)
AN ACT concerning
Maryland Online Data Privacy Act of 2024
FOR the purpose of regulating the manner in which a controller or a processor in possession
of a consumer’s personal data may process the consumer’s personal data; authorizing
a consumer to exercise certain rights in regards to the consumer’s personal data;
requiring a controller of personal data to establish a method for a consumer to
exercise certain rights in regards to the consumer’s personal data; requiring a
controller to comply with a request by a consumer to exercise a certain right in a
certain manner, except under certain circumstances; authorizing a consumer to
designate an authorized agent to act on the consumer’s behalf to opt out of the
processing of the consumer’s personal data; requiring a controller to provide a
consumer with a certain privacy notice; requiring a controller that uses a processor
to process the personal data of consumers to enter into a contract with the processor
that governs the processor’s data processing procedures; requiring a controller to
conduct and document a data protection assessment for consumer data processing
activities that present a heightened risk of harm to a consumer; making a violation
of this Act an unfair, abusive, or deceptive trade practice that is subject to
enforcement and penalties under the Maryland Consumer Protection Act; and
generally relating to online data privacy.
BY repealing and reenacting, with amendments,
Article – Commercial Law
Section 13–301(14)(xl)
Annotated Code of Maryland
(2013 Replacement Volume and 2023 Supplement)
BY repealing and reenacting, without amendments,
Article – Commercial Law
Section 13–301(14)(xli)
Annotated Code of Maryland
(2013 Replacement Volume and 2023 Supplement)
BY adding to
Article – Commercial Law
Section 13–301(14)(xlii); and 14–4601 through 14–4613 14–4614 to be under the new
subtitle “Subtitle 46. Online Data Privacy Act”
Annotated Code of Maryland
(2013 Replacement Volume and 2023 Supplement)
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND,
That the Laws of Maryland read as follows:
Ch. 455
2024 LAWS OF MARYLAND
– 2 –
Article – Commercial Law
13–301.
Unfair, abusive, or deceptive trade practices include any:
(14)
Violation of a provision of:
(xl)
Title 14, Subtitle 13 of the Public Safety Article; [or]
(xli)
Title 14, Subtitle 45 of this article; or
(XLII) TITLE 14, SUBTITLE 46 OF THIS ARTICLE; OR
SUBTITLE 46. ONLINE DATA PRIVACY ACT.
14–4601.
(A)
IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS
INDICATED.
(B)
“AFFILIATE” MEANS A PERSON THAT, DIRECTLY OR INDIRECTLY
THROUGH ONE OR MORE INTERMEDIARIES, CONTROLS, IS CONTROLLED BY, OR IS
UNDER COMMON CONTROL WITH ANOTHER PERSON, SUCH THAT THE PERSON:
(1)
SHARES COMMON BRANDING WITH ANOTHER PERSON; OR
(2)
CONTROLS, IS CONTROLLED BY, OR IS UNDER COMMON CONTROL
WITH ANOTHER PERSON.
(1)
OWNS OR HAS THE POWER TO VOTE MORE THAN 50% OF THE
OUTSTANDING SHARES OF ANY VOTING CLASS OF THE OTHER PERSON’S SECURITIES;
(2)
HAS THE POWER TO ELECT OR INFLUENCE THE ELECTION OF A
MAJORITY OF THE DIRECTORS, MEMBERS, OR MANAGERS OF THE OTHER PERSON;
(3)
HAS THE POWER TO DIRECT THE MANAGEMENT OF THE OTHER
PERSON; OR
(4)
IS SUBJECT TO THE OTHER PERSON’S EXERCISE OF THE POWERS
DESCRIBED IN ITEM (1), (2), OR (3) OF THIS SUBSECTION.
WES MOORE, Governor
Ch. 455
– 3 –
(C)
“AUTHENTICATE” MEANS TO USE REASONABLE MEANS TO DETERMINE
THAT A REQUEST TO EXERCISE A CONSUMER RIGHT IN ACCORDANCE WITH §
14–4605 OF THIS SUBTITLE IS BEING MADE BY, OR ON BEHALF OF, A CONSUMER WHO
IS ENTITLED TO EXERCISE THE CONSUMER RIGHT WITH RESPECT TO THE PERSONAL
DATA AT ISSUE.
(D)
(1)
“BIOMETRIC DATA” MEANS DATA GENERATED BY AUTOMATIC
MEASUREMENTS OF THE BIOLOGICAL CHARACTERISTICS OF A CONSUMER THAT CAN
BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY.
(2)
“BIOMETRIC DATA” INCLUDES:
(I)
A FINGERPRINT;
(II)
A VOICE PRINT;
(III) AN EYE RETINA OR IRIS IMAGE; AND
(IV) ANY OTHER UNIQUE BIOLOGICAL CHARACTERISTICS THAT
CAN BE ARE CAN BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY.
(3)
“BIOMETRIC DATA” DOES NOT INCLUDE:
(I)
A DIGITAL OR PHYSICAL PHOTOGRAPH;
(II)
AN AUDIO OR VIDEO RECORDING; OR
(III) ANY DATA GENERATED FROM A DIGITAL OR PHYSICAL
PHOTOGRAPH OR AN AUDIO OR VIDEO RECORDING, UNLESS THE DATA IS
GENERATED TO IDENTIFY A SPECIFIC CONSUMER.
(E)
“BUSINESS ASSOCIATE” HAS THE MEANING STATED IN HIPAA.
(F)
“CHILD” HAS THE MEANING STATED IN COPPA.
(G)
(1)
“CONSENT” MEANS A CLEAR AFFIRMATIVE ACT SIGNIFYING A
CONSUMER’S
FREELY
GIVEN,
SPECIFIC,
INFORMED,
AND
UNAMBIGUOUS
AGREEMENT TO ALLOW THE PROCESSING OF PERSONAL DATA RELATING TO THE
CONSUMER FOR A PARTICULAR PURPOSE.
(2)
“CONSENT” INCLUDES:
(I)
A WRITTEN STATEMENT;
Ch. 455
2024 LAWS OF MARYLAND
– 4 –
(II)
A WRITTEN STATEMENT BY ELECTRONIC MEANS; OR
(III) ANY OTHER UNAMBIGUOUS AFFIRMATIVE ACTION.
(3)
“CONSENT” DOES NOT INCLUDE:
(I)
ACCEPTANCE OF A GENERAL OR BROAD TERMS OF USE OR
SIMILAR
DOCUMENT
THAT
CONTAINS
DESCRIPTIONS
OF
PERSONAL
DATA
PROCESSING ALONG WITH OTHER UNRELATED INFORMATION;
(II)
HOVERING OVER, MUTING, PAUSING, OR CLOSING A PIECE
OF CONTENT; OR
(III) AGREEMENT OBTAINED THROUGH THE USE OF DARK
PATTERNS.
(H)
(1)
“CONSUMER” MEANS AN INDIVIDUAL WHO IS A RESIDENT OF THE
STATE.
(2)
“CONSUMER” DOES NOT INCLUDE:
(I)
AN
INDIVIDUAL
ACTING
IN
A
COMMERCIAL
OR
EMPLOYMENT CONTEXT; OR
(II)
AN INDIVIDUAL ACTING AS AN EMPLOYEE, AN OWNER, A
DIRECTOR, AN OFFICER, OR A CONTRACTOR OF A COMPANY, A PARTNERSHIP, A SOLE
PROPRIETORSHIP, A NONPROFIT ORGANIZATION, OR A GOVERNMENTAL UNIT
WHOSE COMMUNICATIONS OR TRANSACTIONS WITH A CONTROLLER OCCUR ONLY
WITHIN THE CONTEXT OF THE INDIVIDUAL’S ROLE WITH THE COMPANY,
PARTNERSHIP,
SOLE
PROPRIETORSHIP,
NONPROFIT
ORGANIZATION,
OR
GOVERNMENTAL UNIT.
(I)
(1)
“CONSUMER HEALTH DATA” MEANS PERSONAL DATA THAT A
CONTROLLER USES TO IDENTIFY A CONSUMER’S PHYSICAL OR MENTAL HEALTH
STATUS.
(2)
“CONSUMER HEALTH DATA” INCLUDES DATA RELATED TO:
(I)
GENDER–AFFIRMING CARE TREATMENT; OR
(II)
REPRODUCTIVE OR SEXUAL HEALTH CARE.
(J)
“CONTROL” MEANS:
WES MOORE, Governor
Ch. 455
– 5 –
(1)
OWNERSHIP OF OR THE POWER TO VOTE MORE THAN 50% OF THE
OUTSTANDING SHARES OF ANY CLASS OF VOTING SECURITY OF A BUSINESS;
(2)
ANY MANNER OF CONTROL OVER THE ELECTION OF A MAJORITY
OF THE DIRECTORS OF A BUSINESS, OR INDIVIDUALS EXERCISING SIMILAR
FUNCTIONS; OR
(3)
THE POWER TO EXERCISE A CONTROLLING INFLUENCE OVER THE
MANAGEMENT OF A BUSINESS.
(K)
“CONTROLLER” MEANS A PERSON THAT, ALONE OR JOINTLY WITH
OTHERS, DETERMINES THE PURPOSE AND MEANS OF PROCESSING PERSONAL DATA.
(L)
(1)
“COPPA” MEANS THE FEDERAL CHILDREN’S ONLINE PRIVACY
PROTECTION ACT OF 1998 AND THE REGULATIONS, RULES, GUIDANCE, AND
EXEMPTIONS ADOPTED UNDER THE ACT, AND AS THE ACT AND THE REGULATIONS,
RULES, GUIDANCE, AND EXEMPTIONS MAY BE AMENDED.
(2)
“COPPA” INCLUDES REGULATIONS ADOPTED UNDER THE
FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT OF 1998.
(M)
“COVERED ENTITY” HAS THE MEANING STATED IN HIPAA.
(N)
(1)
“DARK PATTERN” MEANS A USER INTERFACE DESIGNED OR
MANIPULATED WITH THE SUBSTANTIAL EFFECT OF SUBVERTING USER AUTONOMY,
DECISION MAKING, OR CHOICE.
(2)
“DARK PATTERN” INCLUDES ANY PRACTICE THE FEDERAL
TRADE COMMISSION REFERS TO AS A “DARK PATTERN”.
(O)
“DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT
EFFECTS CONCERNING THE CONSUMER” MEANS DECISIONS THAT RESULT IN THE
PROVISION OR DENIAL OF:
(1)
FINANCIAL OR LENDING SERVICES;
(2)
HOUSING;
(3)
INSURANCE;
(4) (3)
EDUCATION ENROLLMENT OR OPPORTUNITY;
(5) (4)
CRIMINAL JUSTICE;
Ch. 455
2024 LAWS OF MARYLAND
– 6 –
(6) (5)
EMPLOYMENT OPPORTUNITIES;
(7) (6)
HEALTH CARE SERVICES; OR
(8) (7)
ACCESS TO ESSENTIAL GOODS OR SERVICES.
(P)
“DE–IDENTIFIED DATA” MEANS DATA THAT CANNOT REASONABLY BE
USED TO INFER INFORMATION ABOUT OR OTHERWISE BE LINKED TO AN IDENTIFIED
OR IDENTIFIABLE CONSUMER, OR A DEVICE THAT MAY BE LINKED TO AN IDENTIFIED
OR IDENTIFIABLE CONSUMER, IF THE CONTROLLER THAT POSSESSES THAT
INFORMATION:
(1)
TAKES
REASONABLE
MEASURES
TO
ENSURE
THAT
THE
INFORMATION CANNOT BE LINKED WITH A CONSUMER;
(2)
COMMITS IN PUBLICLY AVAILABLE TERMS AND CONDITIONS OR IN
A PUBLICLY AVAILABLE PRIVACY POLICY TO MAINTAIN AND USE THE INFORMATION
IN DE–IDENTIFIED FORM; AND
(3)
CONTRACTUALLY
OBLIGES
ANY
RECIPIENTS
OF
THE
INFORMATION TO COMPLY WITH ALL PROVISIONS OF THIS SUBSECTION HAS THE
MEANING STATED IN § 14–4401 OF THIS TITLE.
(Q)
“GENDER–AFFIRMING TREATMENT” HAS THE MEANING STATED IN §
15–151(A) OF THE HEALTH – GENERAL ARTICLE.
(Q) (R)
(1)
“GENETIC DATA” MEANS DATA IN ANY FORMAT THAT
CONCERNS THE GENETIC CHARACTERISTICS OF A CONSUMER.
(2)
“GENETIC DATA” INCLUDES:
(I)
RAW SEQUENCE DATA THAT RESULTS FROM SEQUENCING
OF A CONSUMER’S COMPLETE EXTRACTED DNA OR A PORTION OF THE CONSUMER’S
COMPLETE EXTRACTED DNA;
(II)
GENOTYPIC
AND
PHENOTYPIC
INFORMATION
THAT
RESULTS FROM ANALYZING RAW SEQUENCE DATA;
(III) INFORMATION EXTRAPOLATED, DERIVED, OR INFERRED
FROM THE ANALYSIS OF RAW SEQUENCE DATA; AND
WES MOORE, Governor
Ch. 455
– 7 –
(IV) SELF–REPORTED HEALTH INFORMATION SUBMITTED TO A
DIRECT–TO–CONSUMER GENETIC TESTING COMPANY BY A CONSUMER REGARDING
THE CONSUMER’S HEALTH CONDITIONS:
1.
THAT IS USED FOR SCIENTIFIC RESEARCH OR
PRODUCT DEVELOPMENT; AND
2.
ANALYZED IN CONNECTION WITH THE CONSUMER’S
RAW SEQUENCE DATA HAS THE MEANING STATED IN § 14–4401 OF THIS TITLE.
(R) (S)
(1)
“GEOFENCE” MEANS TECHNOLOGY THAT ESTABLISHES A
VIRTUAL GEOGRAPHICAL BOUNDARY.
(2)
“GEOFENCE” INCLUDES BOUNDARIES THAT ARE ESTABLISHED
OR MONITORED THROUGH THE USE OF:
(I)
GLOBAL POSITIONING TECHNOLOGY;
(II)
CELL TOWER CONNECTIVITY;
(III) CELLULAR DATA;
(IV) RADIO FREQUENCY IDENTIFICATION;
(V)
WIRELESS FIDELITY TECHNOLOGY; OR
(VI) ANY
OTHER
FORM
OF
LOCATION
DETERMINATION
TECHNOLOGY.
(S) (T)
“HIPAA”
MEANS
THE
FEDERAL
HEALTH
INSURANCE
PORTABILITY AND ACCOUNTABILITY ACT OF 1996.
(T) (U)
“IDENTIFIED OR IDENTIFIABLE CONSUMER” MEANS A CONSUMER
WHO CAN READILY BE IDENTIFIED, EITHER DIRECTLY OR INDIRECTLY.
(U) (V)
“MENTAL HEALTH FACILITY” MEANS A HEALTH CARE FACILITY IN
WHICH NOT LESS THAN 70% OF HEALTH CARE SERVICES OFFERED ARE MENTAL
HEALTH SERVICES.
(V) (W)
(1)
“PERSONAL DATA” MEANS ANY INFORMATION THAT IS
LINKED OR CAN BE REASONABLY LINKED TO AN IDENTIFIED OR IDENTIFIABLE
CONSUMER.
(2)
“PERSONAL DATA” DOES NOT INCLUDE:
Ch. 455
2024 LAWS OF MARYLAND
– 8 –
(I)
DE–IDENTIFIED DATA; OR
(II)
PUBLICLY AVAILABLE INFORMATION.
(W) (X)
(1)
“PRECISE GEOLOCATION DATA” MEANS INFORMATION
DERIVED FROM TECHNOLOGY THAT CAN PRECISELY AND ACCURATELY IDENTIFY
THE SPECIFIC LOCATION OF A CONSUMER WITHIN A RADIUS OF 1,750 FEET.
(2)
“PRECISE GEOLOCATION DATA” INCLUDES GLOBAL POSITIONING
SYSTEM LEVEL LATITUDE AND LONGITUDE COORDINATES OR OTHER SIMILAR
MECHANISMS.
(3)
“PRECISE GEOLOCATION DATA” DOES NOT INCLUDE:
(I)
THE CONTENT OF COMMUNICATIONS DATA;
(II)
DATA GENERATED BY OR CONNECTED TO AN ADVANCED
UTILITY METERING INFRASTRUCTURE SYSTEM; OR
(II) (III)
EQUIPMENT DATA GENERATED BY EQUIPMENT USED
BY A UTILITY COMPANY.
(X) (Y)
(1)
“PROCESS” MEANS AN OPERATION OR SET OF OPERATIONS
PERFORMED BY MANUAL OR AUTOMATED MEANS ON PERSONAL DATA.
(2)
“PROCESS”
INCLUDES
COLLECTING,
USING,
STORING,
DISCLOSING, ANALYZING, DELETING, OR MODIFYING PERSONAL DATA.
(Y) (Z)
“PROCESSOR” MEANS A PERSON THAT PROCESSES PERSONAL
DATA ON BEHALF OF A CONTROLLER.
(Z) (AA)
“PROFILING” MEANS ANY FORM OF AUTOMATED PROCESSING
PERFORMED ON PERSONAL DATA TO EVALUATE, ANALYZE, OR PREDICT PERSONAL
ASPECTS RELATED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER’S ECONOMIC
SITUATION, HEALTH, DEMOGRAPHIC CHARACTERISTICS, PERSONAL PREFERENCES,
INTERESTS, RELIABILITY, BEHAVIOR, LOCATION, OR MOVEMENTS.
(AA) (BB)
“PROTECTED HEALTH INFORMATION” HAS THE MEANING STATED
IN HIPAA.
(BB) (CC)
(1)
“PUBLICLY
AVAILABLE
INFORMATION”
MEANS
INFORMATION THAT A PERSON:
WES MOORE, Governor
Ch. 455
– 9 –
(I)
IS LAWFULLY MADE READILY AVAILABLE TO THE GENERAL
PUBLIC THROUGH FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS; OR
(II)
A CONTROLLER HAS A REASONABLE BASIS TO BELIEVE
THAT A CONSUMER HAS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC
THROUGH WIDELY DISTRIBUTED MEDIA.
(I)
LAWFULLY OBTAINS FROM A RECORD OF A GOVERNMENTAL
ENTITY;
(II)
REASONABLY
BELIEVES
A
CONSUMER
OR
WIDELY
DISTRIBUTED MEDIA HAVE LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC;
OR
(III) IF
THE
CONSUMER
HAS
NOT
RESTRICTED
THE
INFORMATION TO A SPECIFIC AUDIENCE, OBTAINS FROM A PERSON TO WHOM THE
CONSUMER DISCLOSED THE INFORMATION.
(2)
“PUBLICLY AVAILABLE INFORMATION” DOES NOT INCLUDE
BIOMETRIC DATA COLLECTED BY A BUSINESS ABOUT A CONSUMER WITHOUT THE
CONSUMER’S KNOWLEDGE.
(CC) (DD)
(1)
“REPRODUCTIVE OR SEXUAL HEALTH CARE” MEANS CARE
RELATED TO A HEALTH CARE–RELATED SERVICE OR PRODUCT RENDERED OR
PROVIDED CONCERNING A CONSUMER’S REPRODUCTIVE SYSTEM OR SEXUAL
WELL–BEING., INCLUDING:
(2)
“REPRODUCTIVE OR SEXUAL HEALTH CARE” INCLUDES:
(I) (1)
A SERVICE OR PRODUCT PROVIDED RELATED TO AN
INDIVIDUAL HEALTH
CONDITION,
STATUS,
DISEASE, DIAGNOSIS,
TEST,
OR
TREATMENT;
(II) (2)
A
SOCIAL,
PSYCHOLOGICAL,
BEHAVIORAL,
OR
MEDICAL INTERVENTION;
(III) (3)
A SURGERY OR PROCEDURE;
(IV) (4)
THE
PURCHASE
OR
USE
OF
A
MEDICATION,
INCLUDING A MEDICATION PURCHASED OR USED FOR THE PURPOSES OF AN
ABORTION;
(V) (5)
A SERVICE OR PRODUCT RELATED TO A BODILY
FUNCTION, VITAL SIGN, OR MEASUREMENT THEREOF SYMPTOM;
Ch. 455
2024 LAWS OF MARYLAND
– 10 –
(6)
A MEASUREMENT OF A BODILY FUNCTION, VITAL SIGN, OR
SYMPTOM; AND
(VI) (7)
AN ABORTION,,
WHETHER SURGICAL OR MEDICAL;
AND
(VII) A SERVICE RELATED TO AN ABORTION AND MEDICAL AND
NONMEDICAL SERVICES, PRODUCTS, DIAGNOSTICS, COUNSELING, AND FOLLOW–UP
SERVICES FOR AN ABORTION.
(DD) (EE)
“REPRODUCTIVE OR SEXUAL HEALTH CARE FACILITY” MEANS A
HEALTH CARE FACILITY WHERE NOT LESS THAN 70% OF SERVICES OFFERED ARE
REPRODUCTIVE OR SEXUAL HEALTH CARE SERVICES.
(EE) (FF)
(1)
“SALE OF PERSONAL DATA” MEANS THE EXCHANGE OF
PERSONAL DATA BY A CONTROLLER, A PROCESSOR, OR AN AFFILIATE OF A
CONTROLLER OR PROCESSER TO A THIRD PARTY FOR MONETARY OR OTHER
VALUABLE CONSIDERATION.
(2)
“SALE OF PERSONAL DATA” DOES NOT INCLUDE:
(I)
THE DISCLOSURE OF PERSONAL DATA TO A PROCESSOR
THAT PROCESSES PERSONAL DATA ON BEHALF OF A CONTROLLER IF LIMITED TO
THE PURPOSES OF THE PROCESSING;
(II)
THE DISCLOSURE OF PERSONAL DATA TO A THIRD PARTY
FOR
PURPOSES
OF
PROVIDING A
PRODUCT
OR
SERVICE AFFIRMATIVELY
REQUESTED BY THE CONSUMER;
(III) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO AN
AFFILIATE OF THE CONTROLLER FOR THE PURPOSE OF PROVIDING A PRODUCT OR
SERVICE AFFIRMATIVELY REQUESTED BY THE CONSUMER;
(IV) THE
DISCLOSURE
OF
PERSONAL
DATA
WHERE
THE
CONSUMER:
1.
DIRECTS
THE
CONTROLLER
TO
DISCLOSE
THE
PERSONAL DATA; OR
2.
INTENTIONALLY
USES
THE
CONTROLLER
TO
INTERACT WITH A THIRD PARTY;
WES MOORE, Governor
Ch. 455
– 11 –
(V)
THE
DISCLOSURE
OF
PERSONAL
DATA
THAT
THE
CONSUMER:
1.
INTENTIONALLY MADE AVAILABLE TO THE GENERAL
PUBLIC THROUGH A CHANNEL OF MASS MEDIA; AND
2.
DID NOT RESTRICT TO A SPECIFIC AUDIENCE; OR
(VI) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO A
THIRD PARTY AS AN ASSET THAT IS PART OF AN ACTUAL OR PROPOSED MERGER,
ACQUISITION, BANKRUPTCY, OR OTHER TRANSACTION WHERE THE THIRD PARTY
ASSUMES CONTROL OF ALL OR PART OF THE CONTROLLER’S ASSETS.
(FF) (GG)
“SENSITIVE DATA” MEANS PERSONAL DATA THAT INCLUDES:
(1)
DATA REVEALING:
(I)
RACIAL OR ETHNIC ORIGIN;
(II)
RELIGIOUS BELIEFS;
(III) CONSUMER HEALTH DATA;
(IV) SEX LIFE;
(V)
SEXUAL ORIENTATION;
(VI) STATUS AS TRANSGENDER OR NONBINARY;
(VII) NATIONAL ORIGIN; OR
(VIII) CITIZENSHIP OR IMMIGRATION STATUS;
(2)
GENETIC DATA OR BIOMETRIC DATA;
(3)
PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER KNOWS
OR HAS REASON TO KNOW IS A CHILD; OR
(4)
PRECISE GEOLOCATION DATA.
(GG) (HH) (1)
“TARGETED
ADVERTISING”
MEANS
DISPLAYING
ADVERTISEMENTS TO A CONSUMER OR ON A DEVICE IDENTIFIED BY A UNIQUE
IDENTIFIER, WHERE THE ADVERTISEMENT IS SELECTED BASED ON PERSONAL DATA
OBTAINED OR INFERRED FROM THE CONSUMER’S ACTIVITIES OVER TIME AND
Ch. 455
2024 LAWS OF MARYLAND
– 12 –
ACROSS
NONAFFILIATED
WEBSITES
OR
ONLINE
APPLICATIONS
THAT
ARE
UNAFFILIATED WITH EACH OTHER, IN ORDER TO PREDICT THE CONSUMER’S
PREFERENCES OR INTERESTS.
(2)
“TARGETED ADVERTISING” DOES NOT INCLUDE:
(I)
ADVERTISEMENTS BASED ON THE CONTEXT IN WHICH THE
ADVERTISEMENT APPEARS AND DOES NOT VARY BASED ON WHO IS VIEWING THE
ADVERTISEMENT OF A CONSUMER’S CURRENT SEARCH QUERY, VISIT TO A WEBSITE,
OR ONLINE APPLICATION;
(II)
ADVERTISEMENTS BASED ON A CONSUMER’S ACTIVITIES
WITHIN A CONTROLLER’S WEBSITES OR ONLINE APPLICATIONS;
(III) ADVERTISEMENTS
DIRECTED
TO
A
CONSUMER
IN
RESPONSE TO THE CONSUMER’S REQUEST FOR INFORMATION OR FEEDBACK; OR
(IV) PROCESSING PERSONAL DATA SOLELY TO MEASURE OR
REPORT ADVERTISING FREQUENCY, PERFORMANCE, OR REACH.
(HH) (II)
“THIRD PARTY” MEANS A PERSON OTHER THAN THE RELEVANT
CONSUMER, CONTROLLER, PROCESSOR, OR AFFILIATE OF THE CONTROLLER OR
PROCESSOR OF RELEVANT PERSONAL DATA.
(II) (JJ)
(1)
“TRADE SECRET” MEANS INFORMATION THAT:
(I)
DERIVES INDEPENDENT ECONOMIC VALUE, ACTUAL OR
POTENTIAL, FROM NOT BEING GENERALLY KNOWN TO, AND NOT BEING READILY
ASCERTAINABLE BY PROPER MEANS BY, OTHER PERSONS WHO COULD OBTAIN
ECONOMIC VALUE FROM THE INFORMATION’S DISCLOSURE OR USE; AND
(II)
IS THE SUBJECT OF EFFORTS THAT ARE REASONABLE
UNDER THE CIRCUMSTANCES TO MAINTAIN THE SECRECY OF THE INFORMATION.
(2)
“TRADE
SECRET”
INCLUDES
A
FORMULA,
PATTERN,
COMPILATION, PROGRAM, DEVICE, METHOD, TECHNIQUE, OR PROCESS HAS THE
MEANING STATED IN § 11–1201 OF THIS ARTICLE.
14–4602.
THIS SUBTITLE APPLIES TO A PERSON THAT:
(1)
(I)
CONDUCTS BUSINESS IN THE STATE; OR
WES MOORE, Governor
Ch. 455
– 13 –
(2)
(I) (II)
PRODUCES PROVIDES SERVICES OR PRODUCTS THAT
ARE TARGETED TO RESIDENTS OF THE STATE; AND
(II) (2)
DURING THE IMMEDIATELY PRECEDING CALENDAR
YEAR:
1. (I) CONDUCTS BUSINESS IN THE STATE OR PROVIDES
PRODUCTS OR SERVICES THAT ARE TARGETED TO RESIDENTS OF THE STATE, AND
THAT DURING THE PRECEDING CALENDAR YEAR DID ANY OF THE FOLLOWING:
(1)
CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST
35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED
SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION; OR
2. (II) (2)
CONTROLLED OR PROCESSED THE PERSONAL
DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS
REVENUE FROM THE SALE OF PERSONAL DATA.
14–4603.
(A)
THIS SUBTITLE DOES NOT APPLY TO:
(1)
A
REGULATORY,
ADMINISTRATIVE,
ADVISORY,
EXECUTIVE,
APPOINTIVE, LEGISLATIVE, OR JUDICIAL BODY OR INSTRUMENTALITY OF THE
STATE, INCLUDING A BOARD, BUREAU, COMMISSION, OR UNIT OF THE STATE OR A
POLITICAL SUBDIVISION OF THE STATE;
(2)
A NATIONAL SECURITIES ASSOCIATION THAT IS REGISTERED
UNDER § 15 OF THE FEDERAL SECURITIES EXCHANGE ACT OF 1934 OR A
REGISTERED FUTURES ASSOCIATION DESIGNATED IN ACCORDANCE WITH § 17 OF
THE FEDERAL COMMODITY EXCHANGE ACT; OR
(3)
A FINANCIAL INSTITUTION OR, AN AFFILIATE OF A FINANCIAL
INSTITUTION, OR DATA THAT IS SUBJECT TO TITLE V OF THE FEDERAL
GRAMM–LEACH–BLILEY ACT AND REGULATIONS ADOPTED UNDER THAT ACT; OR
(4)
A NONPROFIT CONTROLLER THAT PROCESSES OR SHARES
PERSONAL DATA SOLELY FOR THE PURPOSES OF ASSISTING:
(I)
LAW
ENFORCEMENT
AGENCIES
IN
INVESTIGATING
CRIMINAL OR FRAUDULENT ACTS RELATING TO INSURANCE; OR
(II)
FIRST RESPONDERS IN RESPONDING TO CATASTROPHIC
EVENTS.
Ch. 455
2024 LAWS OF MARYLAND
– 14 –
(B)
THE FOLLOWING INFORMATION AND DATA ARE EXEMPT FROM THIS
SUBTITLE:
(1)
PROTECTED HEALTH INFORMATION UNDER HIPAA;
(2)
PATIENT–IDENTIFYING INFORMATION FOR PURPOSES OF 42
U.S.C. § 290DD–2;
(3)
IDENTIFIABLE PRIVATE INFORMATION THAT IS USED FOR
PURPOSES OF THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS IN
ACCORDANCE WITH 45 C.F.R. § 46;
(4)
IDENTIFIABLE PRIVATE INFORMATION TO THE EXTENT THAT IT IS
COLLECTED AND USED AS PART OF HUMAN SUBJECTS RESEARCH IN ACCORDANCE
WITH THE ICH 36 GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY THE
INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICAL REQUIREMENTS
FOR PHARMACEUTICALS FOR HUMAN USE OR THE PROTECTION OF HUMAN
SUBJECTS UNDER 21 C.F.R. §§ 50 AND 56;
(5)
PATIENT SAFETY WORK PRODUCT THAT IS CREATED AND USED
FOR PURPOSES OF PATIENT SAFETY IMPROVEMENT IN ACCORDANCE WITH 42
C.F.R. § 3, ESTABLISHED IN ACCORDANCE WITH 42 U.S.C. §§ 299B–21 THROUGH
299B–26;
(6)
(I)
INFORMATION TO THE EXTENT IT IS USED FOR PUBLIC
HEALTH,
COMMUNITY HEALTH, OR
POPULATION HEALTH ACTIVITIES
AND
PURPOSES, AS AUTHORIZED BY HIPAA, WHEN PROVIDED BY OR TO A COVERED
ENTITY OR WHEN PROVIDED BY OR TO A BUSINESS ASSOCIATE IN ACCORDANCE WITH
THE BUSINESS ASSOCIATE AGREEMENT WITH A COVERED ENTITY;
(II)
INFORMATION THAT IS A MEDICAL RECORD UNDER § 4–301
OF THE HEALTH – GENERAL ARTICLE IF:
1.
THE INFORMATION IS HELD BY AN ENTITY THAT IS A
COVERED ENTITY OR BUSINESS ASSOCIATE UNDER HIPAA BECAUSE IT COLLECTS,
USES, OR DISCLOSES PROTECTED HEALTH INFORMATION; AND
2.
THE ENTITY APPLIES THE SAME STANDARDS FOR THE
COLLECTION, USE, AND DISCLOSURE OF THE INFORMATION AS REQUIRED FOR
PROTECTED HEALTH INFORMATION UNDER HIPAA AND MEDICAL RECORDS UNDER
§ 4–301 OF THE HEALTH – GENERAL ARTICLE, INCLUDING SPECIFIC STANDARDS
REGARDING LEGALLY PROTECTED HEALTH CARE; AND
WES MOORE, Governor
Ch. 455
– 15 –
(III) INFORMATION THAT IS DE–IDENTIFIED IN ACCORDANCE
WITH THE REQUIREMENTS FOR DE–IDENTIFICATION SET FORTH IN 45 C.F.R.
164.514
THAT
IS
DERIVED
FROM
INDIVIDUALLY
IDENTIFIABLE
HEALTH
INFORMATION AS DESCRIBED IN HIPAA OR PERSONAL INFORMATION CONSISTENT
WITH THE HUMAN SUBJECT PROTECTION REQUIREMENTS OF THE U.S. FOOD AND
DRUG ADMINISTRATION;
(7)
THE
COLLECTION,
MAINTENANCE,
DISCLOSURE,
SALE,
COMMUNICATION, OR USE OF PERSONAL INFORMATION BEARING ON A CONSUMER’S
CREDITWORTHINESS, CREDIT STANDING, CREDIT CAPACITY, CHARACTER, GENERAL
REPUTATION, PERSONAL CHARACTERISTICS, OR MODE OF LIVING BY A CONSUMER
REPORTING AGENCY, FURNISHER, OR USER THAT PROVIDES INFORMATION FOR USE
IN A CONSUMER REPORT, AND BY A USER OF A CONSUMER REPORT, BUT ONLY TO
THE EXTENT THAT THE ACTIVITY IS REGULATED BY AND AUTHORIZED UNDER THE
FEDERAL FAIR CREDIT REPORTING ACT;
(8)
PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED
IN COMPLIANCE WITH THE FEDERAL DRIVER’S PRIVACY PROTECTION ACT OF 1994;
(9)
PERSONAL
DATA
REGULATED
BY
THE
FEDERAL FAMILY
EDUCATIONAL RIGHTS AND PRIVACY ACT;
(10) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED
IN COMPLIANCE WITH THE FEDERAL FARM CREDIT ACT;
(11) DATA PROCESSED OR MAINTAINED:
(I)
IN
THE
COURSE
OF
AN
INDIVIDUAL
APPLYING
TO,
EMPLOYED BY, OR ACTING AS AN AGENT OR INDEPENDENT CONTRACTOR OF A
CONTROLLER, PROCESSOR, OR THIRD PARTY, TO THE EXTENT THAT THE DATA IS
COLLECTED AND USED WITHIN THE CONTEXT OF THE ROLE;
(II)
AS
THE
EMERGENCY
CONTACT
INFORMATION
OF
A
CONSUMER IF THE DATA IS USED FOR EMERGENCY CONTACT PURPOSES; OR
(III) THAT IS:
1.
NECESSARY TO RETAIN TO ADMINISTER BENEFITS
FOR ANOTHER INDIVIDUAL RELATING TO THE CONSUMER WHO IS THE SUBJECT OF
THE INFORMATION UNDER ITEM (I) OF THIS ITEM; AND
2.
USED FOR THE PURPOSES OF ADMINISTERING THE
BENEFITS; AND
Ch. 455
2024 LAWS OF MARYLAND
– 16 –
(12) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED
IN RELATION TO PRICE, ROUTE, OR SERVICE BY AN AIR CARRIER SUBJECT TO THE
FEDERAL AIRLINE DEREGULATION ACT TO THE EXTENT THIS SUBTITLE IS
PREEMPTED BY THE FEDERAL AIRLINE DEREGULATION ACT; AND
(13) PERSONAL DATA TO THE EXTENT IT IS COLLECTED FOR,
PROVIDED TO, OR USED BY BY OR ON BEHALF OF A PERSON REGULATED UNDER THE
INSURANCE ARTICLE OR AN AFFILIATE OF SUCH A PERSON, IN FURTHERANCE OF
THE BUSINESS OF INSURANCE.
(C)
CONTROLLERS AND PROCESSORS THAT COMPLY WITH THE VERIFIABLE
PARENTAL
CONSENT
REQUIREMENTS
OF COPPA
SHALL
BE
CONSIDERED
COMPLIANT WITH AN OBLIGATION TO OBTAIN PARENTAL CONSENT IN ACCORDANCE
WITH THIS SUBTITLE WITH RESPECT TO A CONSUMER WHO IS A CHILD.
14–4604.
A PERSON MAY NOT:
(1)
PROVIDE
AN
EMPLOYEE
OR
A
CONTRACTOR
ACCESS
TO
CONSUMER HEALTH DATA UNLESS THE:
(I)
THE EMPLOYEE OR CONTRACTOR IS SUBJECT TO A
CONTRACTUAL OR STATUTORY DUTY OF CONFIDENTIALITY; OR
(II)
CONFIDENTIALITY IS REQUIRED AS A CONDITION OF
EMPLOYMENT OF THE EMPLOYEE;
(2)
PROVIDE A PROCESSOR ACCESS TO CONSUMER HEALTH DATA
UNLESS THE PERSON PROVIDING ACCESS TO THE CONSUMER HEALTH DATA AND
THE PROCESSOR COMPLY WITH § 14–4607 14–4608 OF THIS SUBTITLE; OR
(3)
USE A GEOFENCE:
(I)
TO IDENTIFY, TRACK, COLLECT DATA FROM, OR SEND A
NOTIFICATION TO A CONSUMER REGARDING THE CONSUMER’S CONSUMER HEALTH
DATA; AND
(II)
WITHIN 1,750 FEET OF A MENTAL HEALTH FACILITY OR
REPRODUCTIVE OR SEXUAL HEALTH FACILITY; OR
WES MOORE, Governor
Ch. 455
– 17 –
(4)
SELL OR OFFER TO SELL CONSUMER HEALTH DATA WITHOUT THE
CONSENT OF THE CONSUMER WHOSE HEALTH DATA IS TO BE SOLD OR OFFERED TO
BE SOLD TO ESTABLISH A VIRTUAL BOUNDARY THAT IS WITHIN 1,750 FEET OF ANY
MENTAL HEALTH FACILITY OR REPRODUCTIVE OR SEXUAL HEALTH FACILITY FOR
THE PURPOSE OF IDENTIFYING, TRACKING, OR COLLECTING DATA FROM, OR
SENDING ANY NOTIFICATION TO A CONSUMER REGARDING THE CONSUMER’S
CONSUMER HEALTH DATA.
14–4605.
(A)
NOTHING IN THIS SECTION MAY BE CONSTRUED TO REQUIRE A
CONTROLLER TO REVEAL A TRADE SECRET.
(B)
A CONSUMER SHALL HAVE THE RIGHT TO:
(1)
CONFIRM
WHETHER A
CONTROLLER
IS PROCESSING
THE
CONSUMER’S PERSONAL DATA, UNLESS THAT CONFIRMATION WOULD REQUIRE THE
DISCLOSURE OF A TRADE SECRET;
(2)
IF A CONTROLLER IS PROCESSING A CONSUMER’S PERSONAL
DATA, ACCESS THE CONSUMER’S PERSONAL DATA UNLESS THAT ACCESS WOULD
REQUIRE THE DISCLOSURE OF A TRADE SECRET;
(3)
CONSIDERING THE NATURE OF THE CONSUMER’S PERSONAL
DATA AND THE PURPOSES OF THE PROCESSING OF THE PERSONAL DATA, CORRECT
INACCURACIES IN THE CONSUMER’S PERSONAL DATA;
(4)
REQUIRE A CONTROLLER TO DELETE PERSONAL DATA PROVIDED
BY, OR OBTAINED ABOUT, THE CONSUMER UNLESS RETENTION OF THE PERSONAL
DATA IS REQUIRED BY LAW;
(5)
IF THE PROCESSING OF PERSONAL DATA IS DONE BY AUTOMATIC
MEANS, OBTAIN A COPY OF THE CONSUMER’S PERSONAL DATA PROCESSED BY THE
CONTROLLER IN A PORTABLE AND, TO THE EXTENT TECHNICALLY FEASIBLE,
READILY USABLE FORMAT THAT ALLOWS THE CONSUMER TO EASILY TRANSMIT THE
DATA TO ANOTHER CONTROLLER WITHOUT HINDRANCE;
(6)
OBTAIN A LIST OF THE CATEGORIES OF THIRD PARTIES TO WHICH
THE CONTROLLER HAS DISCLOSED THE CONSUMER’S PERSONAL DATA OR A LIST OF
THE CATEGORIES OF THIRD PARTIES TO WHICH THE CONTROLLER HAS DISCLOSED
ANY CONSUMER’S PERSONAL DATA IF THE CONTROLLER DOES NOT MAINTAIN THIS
INFORMATION IN A FORMAT SPECIFIC TO THE CONSUMER; AND
Ch. 455
2024 LAWS OF MARYLAND
– 18 –
(7)
OPT OUT OF THE PROCESSING OF PERSONAL DATA FOR PURPOSES
OF:
(I)
TARGETED ADVERTISING;
(II)
THE SALE OF PERSONAL DATA; OR
(III) PROFILING IN FURTHERANCE OF SOLELY AUTOMATED
DECISIONS
THAT
PRODUCE
LEGAL
OR
SIMILARLY
SIGNIFICANT
EFFECTS
CONCERNING THE CONSUMER.
(C)
(1)
A CONTROLLER SHALL ESTABLISH A SECURE AND RELIABLE
METHOD FOR A CONSUMER TO EXERCISE A CONSUMER RIGHT UNDER THIS SECTION.
(2)
A CONSUMER MAY EXERCISE A CONSUMER RIGHT UNDER THIS
SECTION BY THE METHOD ESTABLISHED BY THE CONTROLLER UNDER PARAGRAPH
(1) OF THIS SUBSECTION.
(D)
(1)
A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT IN
ACCORDANCE WITH § 14–4606 OF THIS SUBTITLE TO OPT OUT OF THE PROCESSING
OF THE CONSUMER’S PERSONAL DATA UNDER SUBSECTION (B)(7) OF THIS SECTION
ON BEHALF OF A CONSUMER.
(2)
A PARENT OR LEGAL GUARDIAN OF A CHILD MAY EXERCISE A
CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE CHILD’S
BEHALF REGARDING THE PROCESSING OF PERSONAL DATA.
(3)
A GUARDIAN OR CONSERVATOR OF A CONSUMER SUBJECT TO A
GUARDIANSHIP, CONSERVATORSHIP, OR OTHER PROTECTIVE ARRANGEMENT MAY
EXERCISE A CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE
CONSUMER’S BEHALF REGARDING THE PROCESSING OF PERSONAL DATA.
(E)
(1)
EXCEPT
AS OTHERWISE
PROVIDED
IN THIS
SUBTITLE,
A
CONTROLLER SHALL COMPLY WITH A REQUEST BY A CONSUMER TO EXERCISE A
CONSUMER RIGHT LISTED IN THIS SECTION.
(2)
(I)
A CONTROLLER SHALL RESPOND TO A CONSUMER REQUEST
NOT LATER THAN 45 DAYS AFTER THE CONTROLLER RECEIVES THE CONSUMER
REQUEST.
(II)
A CONTROLLER MAY EXTEND THE COMPLETION PERIOD BY
AN ADDITIONAL 45 DAYS IF:
WES MOORE, Governor
Ch. 455
– 19 –
1.
IT IS REASONABLY NECESSARY TO COMPLETE THE
REQUEST BASED ON THE COMPLEXITY AND NUMBER OF THE CONSUMER’S
REQUESTS; AND
2.
THE CONTROLLER INFORMS THE CONSUMER OF THE
EXTENSION AND THE REASON FOR THE EXTENSION WITHIN THE INITIAL 45–DAY
RESPONSE PERIOD.
(III) A CONTROLLER SHALL NOTIFY THE CONSUMER WITHIN 30
DAYS AFTER COMPLYING WITH THE CONSUMER’S REQUEST THAT THE CONTROLLER
HAS COMPLIED WITH THE CONSUMER’S REQUEST.
(3)
IF A CONTROLLER DECLINES TO ACT REGARDING A CONSUMER’S
REQUEST, THE CONTROLLER SHALL:
(I)
INFORM THE CONSUMER WITHOUT UNDUE DELAY, BUT NOT
LATER THAN 45 DAYS AFTER RECEIVING THE REQUEST, OF THE JUSTIFICATION FOR
DECLINING TO ACT; AND
(II)
PROVIDE INSTRUCTIONS FOR HOW TO APPEAL THE
DECISION.
(4)
(I)
A CONTROLLER SHALL PROVIDE INFORMATION TO A
CONSUMER IN RESPONSE TO A CONSUMER’S REQUEST TO EXERCISE RIGHTS UNDER
THIS SUBTITLE FREE OF CHARGE ONCE DURING ANY 12–MONTH PERIOD.
(II)
IF REQUESTS FROM A CONSUMER ARE MANIFESTLY
UNFOUNDED,
EXCESSIVE,
TECHNICALLY
INFEASIBLE,
OR
REPETITIVE,
A
CONTROLLER MAY:
1.
CHARGE THE CONSUMER A REASONABLE FEE TO
COVER THE ADMINISTRATIVE COSTS OF COMPLYING WITH THE REQUEST; OR
2.
DECLINE TO ACT ON THE REQUEST.
(III) THE CONTROLLER HAS THE BURDEN OF DEMONSTRATING
THE
MANIFESTLY
UNFOUNDED,
EXCESSIVE,
TECHNICALLY
INFEASIBLE,
OR
REPETITIVE NATURE OF THE REQUEST.
(5)
IF A CONTROLLER IS UNABLE TO AUTHENTICATE A REQUEST TO
EXERCISE A CONSUMER RIGHT AFFORDED UNDER SUBSECTION (B)(1) THROUGH (5)
OF
THIS
SECTION
USING
COMMERCIALLY
REASONABLE
EFFORTS,
THE
CONTROLLER:
Ch. 455
2024 LAWS OF MARYLAND
– 20 –
(I)
MAY NOT BE REQUIRED TO COMPLY WITH A REQUEST TO
INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION; AND
(II)
SHALL PROVIDE NOTICE TO THE CONSUMER THAT THE
CONTROLLER IS UNABLE TO AUTHENTICATE THE REQUEST TO EXERCISE THE RIGHT
UNTIL THE CONSUMER PROVIDES ADDITIONAL INFORMATION REASONABLY
NECESSARY TO AUTHENTICATE THE CONSUMER AND THE CONSUMER’S REQUEST TO
EXERCISE THE CONSUMER’S RIGHTS.
(6)
A CONTROLLER MAY NOT BE REQUIRED TO AUTHENTICATE AN
OPT–OUT REQUEST.
(7)
A CONTROLLER THAT HAS OBTAINED PERSONAL DATA ABOUT A
CONSUMER FROM A SOURCE OTHER THAN THE CONSUMER SHALL BE CONSIDERED
COMPLIANT WITH THE CONSUMER’S REQUEST TO DELETE THE CONSUMER’S DATA IN
ACCORDANCE WITH SUBSECTION (B)(4) OF THIS SECTION BY RETAINING A RECORD
OF THE DELETION REQUEST AND THE MINIMUM DATA NECESSARY FOR THE
PURPOSE OF ENSURING THAT THE CONSUMER’S PERSONAL DATA:
(I)
REMAINS DELETED FROM THE CONTROLLER’S RECORDS;
AND
(II)
IS NOT BEING USED FOR ANY OTHER PURPOSE.
(F)
(1)
A CONTROLLER SHALL ESTABLISH A PROCESS FOR A CONSUMER
TO APPEAL THE CONTROLLER’S REFUSAL TO ACT ON A CONSUMER RIGHTS REQUEST
WITHIN A REASONABLE PERIOD AFTER THE CONSUMER RECEIVES THE DECISION.
(2)
THE APPEAL PROCESS SHALL BE:
(I)
CONSPICUOUSLY AVAILABLE; AND
(II)
SIMILAR TO THE PROCESS FOR SUBMITTING REQUESTS TO
INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION.
(3)
NOT LATER THAN 60 DAYS AFTER RECEIVING AN APPEAL, A
CONTROLLER SHALL INFORM THE CONSUMER IN WRITING OF ANY ACTION TAKEN OR
NOT TAKEN IN RESPONSE TO THE APPEAL, INCLUDING A WRITTEN EXPLANATION OF
THE REASONS FOR THE DECISIONS.
(4)
IF A CONTROLLER DENIES AN APPEAL, THE CONTROLLER SHALL
PROVIDE THE CONSUMER WITH AN ONLINE MECHANISM, IF AVAILABLE, THROUGH
WHICH THE CONSUMER MAY CONTACT THE DIVISION TO SUBMIT A COMPLAINT.
WES MOORE, Governor
Ch. 455
– 21 –
14–4606.
(A)
(1)
A CONSUMER MAY DESIGNATE AN INDIVIDUAL TO SERVE AS THE
CONSUMER’S AUTHORIZED AGENT AND ACT ON THE CONSUMER’S BEHALF TO OPT
OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR ONE OR MORE
OF THE PURPOSES SPECIFIED IN § 14–4605(B)(7) OF THIS SUBTITLE.
(2)
A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT BY AN
INTERNET LINK OR A BROWSER SETTING, BROWSER EXTENSION, GLOBAL DEVICE
SETTING, OR OTHER SIMILAR TECHNOLOGY, INDICATING A CONSUMER’S INTENT TO
OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA.
(B)
A CONTROLLER SHALL COMPLY WITH AN OPT–OUT REQUEST RECEIVED
FROM AN AUTHORIZED AGENT IF, USING COMMERCIALLY REASONABLE EFFORTS,
THE CONTROLLER IS ABLE TO AUTHENTICATE:
(1)
THE IDENTITY OF THE CONSUMER; AND
(2)
THE
AUTHORIZED
AGENT’S
AUTHORITY
TO
ACT
ON
THE
CONSUMER’S BEHALF.
14–4607.
(A)
A CONTROLLER MAY NOT:
(1)
COLLECT PERSONAL DATA FOR THE SOLE PURPOSE OF CONTENT
PERSONALIZATION OR MARKETING WITHOUT THE CONSENT OF THE CONSUMER
WHOSE PERSONAL DATA IS COLLECTED;
(2) (1)
EXCEPT WHERE THE COLLECTION OR PROCESSING IS
STRICTLY NECESSARY TO PROVIDE OR MAINTAIN A SPECIFIC PRODUCT OR SERVICE
REQUESTED BY THE CONSUMER TO WHOM THE PERSONAL DATA PERTAINS AND
UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT, COLLECT,
PROCESS, OR SHARE SENSITIVE DATA CONCERNING A CONSUMER;
(3) (2)
SELL SENSITIVE DATA;
(4) (3)
PROCESS PERSONAL DATA IN VIOLATION OF STATE OR
FEDERAL LAWS THAT PROHIBIT UNLAWFUL DISCRIMINATION;
(5) (4)
PROCESS THE PERSONAL DATA OF A CONSUMER FOR THE
PURPOSES OF TARGETED ADVERTISING IF THE CONTROLLER KNEW OR SHOULD
Ch. 455
2024 LAWS OF MARYLAND
– 22 –
HAVE KNOWN THAT THE CONSUMER IS AT LEAST 13 YEARS OLD AND UNDER THE AGE
OF 18 YEARS;
(6) (5)
SELL THE PERSONAL DATA OF A CONSUMER WITHOUT THE
CONSUMER’S CONSENT IF THE CONTROLLER KNEW OR SHOULD HAVE KNOWN THAT
THE CONSUMER IS AT LEAST 13 YEARS OLD AND UNDER THE AGE OF 18 YEARS;
(7) (6)
DISCRIMINATE AGAINST A CONSUMER FOR EXERCISING A
CONSUMER RIGHT CONTAINED IN THIS SUBTITLE, INCLUDING DENYING GOODS OR
SERVICES, CHARGING DIFFERENT PRICES OR RATES FOR GOODS OR SERVICES, OR
PROVIDING A DIFFERENT LEVEL OF QUALITY OF GOODS OR SERVICES TO THE
CONSUMER;
(8) (7)
COLLECT, PROCESS, OR TRANSFER PERSONAL DATA OR
PUBLICLY AVAILABLE DATA IN A MANNER THAT UNLAWFULLY DISCRIMINATES IN OR
OTHERWISE UNLAWFULLY MAKES UNAVAILABLE THE EQUAL ENJOYMENT OF GOODS
OR SERVICES ON THE BASIS OF RACE, COLOR, RELIGION, NATIONAL ORIGIN, SEX,
SEXUAL
ORIENTATION,
GENDER
IDENTITY,
OR
DISABILITY,
UNLESS
THE
COLLECTION, PROCESSING, OR TRANSFER OF PERSONAL DATA IS FOR:
(I)
THE
CONTROLLER’S
SELF–TESTING
TO
PREVENT
OR
MITIGATE UNLAWFUL DISCRIMINATION;
(II)
THE CONTROLLER’S DIVERSIFYING OF AN APPLICANT,
PARTICIPANT, OR CUSTOMER POOL; OR
(III) A PRIVATE CLUB OR GROUP NOT OPEN TO THE PUBLIC, AS
DESCRIBED IN § 201(E) OF THE CIVIL RIGHTS ACT OF 1964; OR
(9) (8)
UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S
CONSENT, PROCESS PERSONAL DATA FOR A PURPOSE THAT IS NEITHER
REASONABLY NECESSARY TO, NOR COMPATIBLE WITH, THE DISCLOSED PURPOSES
FOR WHICH THE PERSONAL DATA IS PROCESSED, AS DISCLOSED TO THE CONSUMER.
(B)
(1)
A CONTROLLER SHALL:
(I)
LIMIT THE COLLECTION OF PERSONAL DATA TO WHAT IS
REASONABLY NECESSARY AND PROPORTIONATE TO PROVIDE OR MAINTAIN A
SPECIFIC PRODUCT OR SERVICE REQUESTED BY THE CONSUMER TO WHOM THE
DATA PERTAINS;
(II)
ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO
WES MOORE, Governor
Ch. 455
– 23 –
PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL
DATA APPROPRIATE TO THE VOLUME AND NATURE OF THE PERSONAL DATA AT
ISSUE; AND
(III) PROVIDE AN EFFECTIVE MECHANISM FOR A CONSUMER TO
REVOKE THE CONSUMER’S CONSENT UNDER THIS SECTION THAT IS AT LEAST AS
EASY AS THE MECHANISM BY WHICH THE CONSUMER PROVIDED THE CONSUMER’S
CONSENT.
(2)
IF A CONSUMER REVOKES CONSENT UNDER THIS SECTION, THE
CONTROLLER SHALL STOP PROCESSING THE CONSUMER’S PERSONAL DATA AS SOON
AS PRACTICABLE, BUT NOT LATER THAN 15 30 DAYS AFTER RECEIVING THE
REQUEST.
(C)
NOTHING IN SUBSECTION (A) OR (B) OF THIS SECTION MAY BE
CONSTRUED TO:
(1)
REQUIRE A CONTROLLER TO PROVIDE A PRODUCT OR SERVICE
THAT REQUIRES THE PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER
DOES NOT COLLECT OR MAINTAIN; OR
(2)
PROHIBIT A CONTROLLER FROM OFFERING A DIFFERENT PRICE,
RATE, LEVEL, QUALITY, OR SELECTION OF GOODS OR SERVICES TO A CONSUMER,
INCLUDING OFFERING GOODS OR SERVICES FOR NO FEE, IF THE OFFERING IS IN
CONNECTION WITH A CONSUMER’S VOLUNTARY PARTICIPATION IN A BONA FIDE
LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNTS, OR CLUB CARD PROGRAM,
PROVIDED THAT THE SELLING OF PERSONAL DATA IS NOT A CONDITION OF
PARTICIPATION IN THE PROGRAM.
(D)
A CONTROLLER SHALL PROVIDE A CONSUMER WITH A REASONABLY
ACCESSIBLE, CLEAR, AND MEANINGFUL PRIVACY NOTICE THAT INCLUDES:
(1)
THE CATEGORIES OF PERSONAL DATA PROCESSED BY THE
CONTROLLER, INCLUDING SENSITIVE DATA;
(2)
THE CONTROLLER’S PURPOSE FOR PROCESSING PERSONAL DATA;
(3)
HOW A CONSUMER MAY EXERCISE THE CONSUMER’S RIGHTS
UNDER
THIS
SUBTITLE,
INCLUDING
HOW
A
CONSUMER
MAY
APPEAL
A
CONTROLLER’S DECISION REGARDING THE CONSUMER’S REQUEST OR MAY REVOKE
CONSENT;
(4)
THE
CATEGORIES
OF
THIRD
PARTIES
WITH
WHICH
THE
CONTROLLER SHARES PERSONAL DATA WITH A LEVEL OF DETAIL THAT ENABLES A
Ch. 455
2024 LAWS OF MARYLAND
– 24 –
CONSUMER TO UNDERSTAND WHAT TYPE OF ENTITY EACH THIRD PARTY IS AND, TO
THE EXTENT POSSIBLE, HOW EACH THIRD PARTY MAY PROCESS THE PERSONAL
DATA THE TYPE OF, BUSINESS MODEL OF, OR PROCESSING CONDUCTED BY EACH
THIRD PARTY;
(5)
THE CATEGORIES OF PERSONAL DATA, INCLUDING SENSITIVE
DATA, THAT THE CONTROLLER SHARES WITH THIRD PARTIES; AND
(6)
AN ACTIVE E–MAIL ADDRESS OR OTHER ONLINE MECHANISM
THAT A CONSUMER MAY USE TO CONTACT THE CONTROLLER.
(E)
(1)
IF A CONTROLLER SELLS PERSONAL DATA TO THIRD PARTIES OR
PROCESSES PERSONAL DATA FOR TARGETED ADVERTISING OR FOR THE PURPOSES
OF PROFILING THE CONSUMER IN FURTHERANCE OF DECISIONS THAT PRODUCE
LEGAL OR SIMILARLY SIGNIFICANT EFFECTS, THE CONTROLLER SHALL CLEARLY
AND CONSPICUOUSLY DISCLOSE THE SALE OR PROCESSING, AS WELL AS THE
MANNER IN WHICH A CONSUMER MAY EXERCISE THE RIGHT TO OPT OUT OF THE
SALE OR PROCESSING.
(2)
THE DISCLOSURE REQUIRED UNDER PARAGRAPH (1) OF THIS
SUBSECTION SHALL BE PROMINENTLY DISPLAYED, AND USE CLEAR, EASY TO
UNDERSTAND,
AND
UNAMBIGUOUS
LANGUAGE,
TO
STATE
WHETHER
THE
CONSUMER’S INFORMATION WILL BE SOLD OR SHARED WITH A THIRD PARTY.
(F)
(1)
THE PRIVACY NOTICE UNDER SUBSECTION (D) OF THIS SECTION
SHALL ESTABLISH ONE OR MORE SECURE AND RELIABLE METHODS FOR A
CONSUMER TO SUBMIT A REQUEST TO EXERCISE A CONSUMER RIGHT IN
ACCORDANCE WITH THIS SUBTITLE THAT TAKE INTO ACCOUNT:
(I)
THE WAYS IN WHICH CONSUMERS NORMALLY INTERACT
WITH THE CONTROLLER;
(II)
THE NEED FOR SECURE AND RELIABLE COMMUNICATION
OF CONSUMER REQUESTS; AND
(III) THE ABILITY OF THE CONTROLLER TO VERIFY THE
IDENTITY OF A CONSUMER MAKING THE REQUEST.
(2)
(I)
A CONTROLLER MAY NOT REQUIRE A CONSUMER TO
CREATE A NEW ACCOUNT IN ORDER TO EXERCISE A CONSUMER RIGHT.
(II)
A CONTROLLER MAY REQUIRE A CONSUMER TO USE AN
EXISTING ACCOUNT TO EXERCISE A CONSUMER RIGHT.
WES MOORE, Governor
Ch. 455
– 25 –
(3)
A CONTROLLER MAY UTILIZE THE FOLLOWING METHODS TO
SATISFY PARAGRAPH (1) OF THIS SUBSECTION:
(I)
PROVIDING A CLEAR AND CONSPICUOUS LINK ON THE
CONTROLLER’S WEBSITE TO A WEBPAGE THAT ALLOWS A CONSUMER, OR AN
AUTHORIZED AGENT OF THE CONSUMER, TO OPT OUT OF THE TARGETED
ADVERTISING OR THE SALE OF THE CONSUMER’S PERSONAL DATA; OR
(II)
ON OR BEFORE OCTOBER 1, 2025, ALLOWING A CONSUMER
TO OPT OUT OF ANY PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR THE
PURPOSES OF TARGETED ADVERTISING, OR ANY SALE OF PERSONAL DATA,
THROUGH AN OPT–OUT PREFERENCE SIGNAL SENT, WITH THE CONSUMER’S
CONSENT, BY A PLATFORM, TECHNOLOGY, OR MECHANISM TO THE CONTROLLER
INDICATING THE CONSUMER’S INTENT TO OPT OUT OF THE PROCESSING OR SALE.
(4)
A
PLATFORM,
TECHNOLOGY,
OR
MECHANISM
USED
IN
ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION SHALL:
(I)
BE CONSUMER–FRIENDLY AND EASY TO USE BY THE
AVERAGE CONSUMER;
(II)
USE CLEAR, EASY TO UNDERSTAND, AND UNAMBIGUOUS
LANGUAGE;
(III) BE AS CONSISTENT AS POSSIBLE WITH ANY OTHER SIMILAR
PLATFORM, TECHNOLOGY, OR MECHANISM REQUIRED BY ANY FEDERAL OR STATE
LAW OR REGULATION;
(IV) ENABLE THE CONTROLLER TO REASONABLY DETERMINE
WHETHER THE CONSUMER:
1.
IS A RESIDENT OF THE STATE; AND
2.
HAS MADE A LEGITIMATE REQUEST TO OPT OUT OF
ANY SALE OF THE CONSUMER’S PERSONAL DATA OR TARGETED ADVERTISING; AND
(V)
REQUIRE A CONSUMER TO MAKE AN AFFIRMATIVE,
UNAMBIGUOUS, AND VOLUNTARY CHOICE IN ORDER TO OPT OUT OF ANY
PROCESSING OF THE CONSUMER’S PERSONAL DATA.
(5)
A
PLATFORM,
TECHNOLOGY,
OR
MECHANISM
USED
IN
ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION MAY NOT:
Ch. 455
2024 LAWS OF MARYLAND
– 26 –
(I)
UNFAIRLY DISADVANTAGE ANOTHER CONTROLLER; OR
(II)
USE A DEFAULT SETTING TO OPT A CONSUMER OUT OF ANY
PROCESSING OF THE CONSUMER’S PERSONAL DATA.
(G)
(1)
IF A CONSUMER’S DECISION TO OPT OUT OF THE PROCESSING OF
THE
CONSUMER’S
PERSONAL
DATA
FOR
THE
PURPOSES
OF
TARGETED
ADVERTISING, OR THE SALE OF PERSONAL DATA THROUGH AN OPT–OUT
PREFERENCE SIGNAL SENT IN ACCORDANCE WITH SUBSECTION (F)(3) OF THIS
SECTION CONFLICTS WITH THE CONSUMER’S EXISTING CONTROLLER–SPECIFIC
PRIVACY SETTING OR THE CONSUMER’S VOLUNTARY PARTICIPATION IN A
CONTROLLER’S BONA FIDE LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNTS,
OR CLUB CARD PROGRAM, THE CONTROLLER MAY NOTIFY THE CONSUMER OF A
CONFLICT AND PROVIDE THE CHOICE TO CONFIRM CONTROLLER–SPECIFIC
PRIVACY SETTINGS OR PARTICIPATION IN A PROGRAM LISTED IN THIS PARAGRAPH.
(2)
A CONTROLLER THAT RECOGNIZES SIGNALS APPROVED BY
OTHER STATES SHALL BE CONSIDERED IN COMPLIANCE WITH THIS SECTION.
14–4608.
(A)
(1)
IF A CONTROLLER USES A PROCESSOR TO PROCESS THE
PERSONAL DATA OF CONSUMERS, THE CONTROLLER AND THE PROCESSOR SHALL
ENTER INTO A CONTRACT THAT GOVERNS THE PROCESSOR’S DATA PROCESSING
PROCEDURES WITH RESPECT TO PROCESSING PERFORMED ON BEHALF OF THE
CONTROLLER.
(2)
THE CONTRACT SHALL BE BINDING AND SHALL CLEARLY SET
FORTH INSTRUCTIONS FOR:
(I)
PROCESSING INSTRUCTIONS FOR PROCESSING DATA;
(II)
THE NATURE AND PURPOSE OF PROCESSING;
(III) THE TYPE OF DATA SUBJECT TO PROCESSING;
(IV) THE DURATION OF PROCESSING; AND
(V)
THE RIGHTS AND OBLIGATIONS OF BOTH PARTIES.
(3)
THE CONTRACT SHALL REQUIRE THAT THE PROCESSOR:
WES MOORE, Governor
Ch. 455
– 27 –
(I)
ENSURE THAT EACH PERSON PROCESSING PERSONAL DATA
IS SUBJECT TO A DUTY OF CONFIDENTIALITY WITH RESPECT TO THE PERSONAL
DATA;
(II)
ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO
PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL
DATA, CONSIDERING THE VOLUME AND NATURE OF THE PERSONAL DATA;
(III) STOP PROCESSING DATA ON REQUEST BY THE CONTROLLER
MADE IN ACCORDANCE WITH A CONSUMER’S AUTHENTICATED REQUEST;
(IV) AT THE CONTROLLER’S DIRECTION, DELETE OR RETURN
ALL PERSONAL DATA TO THE CONTROLLER AS REQUESTED AT THE END OF THE
PROVISION OF SERVICE, UNLESS RETENTION OF THE PERSONAL DATA IS REQUIRED
BY LAW;
(V)
ON THE REASONABLE REQUEST OF THE CONTROLLER,
MAKE AVAILABLE TO THE CONTROLLER ALL INFORMATION IN THE PROCESSOR’S
POSSESSION NECESSARY TO DEMONSTRATE THE PROCESSOR’S COMPLIANCE WITH
THE OBLIGATIONS IN THIS SUBTITLE;
(VI) AFTER PROVIDING THE CONTROLLER AN OPPORTUNITY TO
OBJECT, ENGAGE A SUBCONTRACTOR TO ASSIST WITH PROCESSING PERSONAL DATA
ON THE CONTROLLER’S BEHALF ONLY IN ACCORDANCE WITH A WRITTEN CONTRACT
THAT REQUIRES THE SUBCONTRACTOR TO MEET THE PROCESSOR’S OBLIGATIONS
REGARDING THE PERSONAL DATA UNDER THE PROCESSOR’S CONTRACT WITH THE
CONTROLLER; AND
(VII) ALLOW AND COOPERATE WITH REASONABLE ASSESSMENTS
BY THE CONTROLLER, THE CONTROLLER’S DESIGNATED ASSESSOR, OR A QUALIFIED
AND INDEPENDENT ASSESSOR ARRANGED FOR BY THE PROCESSOR TO ASSESS THE
PROCESSOR’S POLICIES AND TECHNICAL AND ORGANIZATIONAL MEASURES IN
SUPPORT OF THE OBLIGATIONS UNDER THIS SUBTITLE.
(4)
(I)
ON REQUEST, THE PROCESSOR SHALL PROVIDE A REPORT
OF AN ASSESSMENT REQUIRED BY PARAGRAPH (3)(V) OF THIS SUBSECTION TO THE
CONTROLLER.
(II)
AN ASSESSMENT CONDUCTED IN ACCORDANCE WITH
PARAGRAPH (3)(V) OF THIS SUBSECTION SHALL BE CONDUCTED USING AN
APPROPRIATE AND ACCEPTED CONTROL STANDARD OR FRAMEWORK AND
ASSESSMENT PROCEDURE FOR THE ASSESSMENTS.
Ch. 455
2024 LAWS OF MARYLAND
– 28 –
(B)
(1)
IF A CONTROLLER USES A PROCESSOR TO PROCESS THE
PERSONAL DATA OF CONSUMERS, THE CONTROLLER SHALL PROVIDE THE
PROCESSOR WITH INSTRUCTIONS ON HOW TO PROCESS PERSONAL DATA.
(2)
A PROCESSOR SHALL:
(I) (1)
ADHERE TO THE CONTRACT AND INSTRUCTIONS OF A
CONTROLLER;
(II) (2)
ASSIST
THE
CONTROLLER
IN
MEETING
THE
CONTROLLER’S OBLIGATIONS UNDER THIS SUBTITLE, INCLUDING, CONSIDERING
THE NATURE OF PROCESSING AND THE INFORMATION AVAILABLE TO THE
PROCESSOR:
1. (I) BY APPROPRIATE TECHNICAL AND ORGANIZATIONAL
MEASURES
AS
MUCH
AS
REASONABLY
PRACTICABLE
TO
FULFILL
THE
CONTROLLER’S OBLIGATION TO RESPOND TO CONSUMER RIGHTS REQUESTS,
CONSIDERING THE NATURE OF PROCESSING AND THE INFORMATION AVAILABLE TO
THE PROCESSOR; AND
2. (II) BY ASSISTING THE CONTROLLER IN MEETING THE
CONTROLLER’S OBLIGATIONS IN RELATION TO THE SECURITY OF PROCESSING THE
PERSONAL DATA AND IN RELATION TO THE NOTIFICATION OF A BREACH OF THE
SECURITY OF A SYSTEM, AS DEFINED IN § 14–3504 OF THIS TITLE; AND
(III) (3)
PROVIDE NECESSARY INFORMATION TO ENABLE THE
CONTROLLER TO CONDUCT AND DOCUMENT DATA PROTECTION ASSESSMENTS.
(C)
NOTHING IN THIS SECTION MAY BE CONSTRUED TO RELIEVE A
CONTROLLER OR A PROCESSOR FROM THE LIABILITIES IMPOSED ON THE
CONTROLLER OR PROCESSOR BY VIRTUE OF THE CONTROLLER’S OR PROCESSOR’S
ROLE IN THE PROCESSING RELATIONSHIP IN ACCORDANCE WITH THIS SECTION.
(D)
(1)
THE DETERMINATION OF WHETHER A PERSON IS ACTING AS A
CONTROLLER OR A PROCESSOR WITH RESPECT TO A SPECIFIC PROCESSING OF DATA
IS A FACT–BASED DETERMINATION THAT DEPENDS ON THE CONTEXT IN WHICH
PERSONAL DATA IS BEING PROCESSED.
(2)
A PERSON IS CONSIDERED TO BE A CONTROLLER IF THE PERSON:
(I)
IS NOT LIMITED IN THE PERSON’S PROCESSING OF SPECIFIC
PERSONAL DATA IN ACCORDANCE WITH A CONTROLLER’S INSTRUCTIONS; OR
WES MOORE, Governor
Ch. 455
– 29 –
(II)
FAILS TO ADHERE TO A CONTROLLER’S INSTRUCTIONS
WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA.
(3)
A PROCESSOR THAT CONTINUES TO ADHERE TO A CONTROLLER’S
INSTRUCTIONS WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA
REMAINS A PROCESSOR.
(4)
IF A PROCESSOR OR THIRD PARTY BEGINS, ALONE OR JOINTLY
WITH OTHERS, DETERMINING THE PURPOSES AND MEANS OF THE PROCESSING OF
PERSONAL DATA, THE PROCESSOR:
(I)
IS A CONTROLLER WITH RESPECT TO THE PROCESSING; AND
(II)
MAY BE SUBJECT TO AN ENFORCEMENT ACTION UNDER
THIS SUBTITLE.
(E)
NOTHING IN THIS SECTION MAY BE CONSTRUED TO ALTER A
CONTROLLER’S OBLIGATION TO LIMIT A PERSON’S PROCESSING OF PERSONAL DATA
OR TO TAKE STEPS TO ENSURE THAT A PROCESSOR ADHERES TO THE CONTROLLER’S
INSTRUCTIONS.
14–4609.
(A)
IF A THIRD PARTY USES OR SHARES A CONSUMER’S INFORMATION IN A
MANNER INCONSISTENT WITH PROMISES MADE TO THE CONSUMER AT THE TIME OF
COLLECTION OF THE INFORMATION, THE THIRD PARTY SHALL PROVIDE AN
AFFECTED CONSUMER WITH NOTICE OF THE NEW OR CHANGED PRACTICE BEFORE
IMPLEMENTING THE NEW OR CHANGED PRACTICE.
(B)
THE NOTICE PROVIDED UNDER SUBSECTION (A) OF THIS SECTION
SHALL BE PROVIDED IN A MANNER AND AT A TIME REASONABLY CALCULATED TO
ALLOW A CONSUMER TO EXERCISE THE RIGHTS PROVIDED UNDER THIS SUBTITLE.
14–4610.
(A)
IN
THIS
SECTION, “PROCESSING
ACTIVITIES
THAT
PRESENT A
HEIGHTENED RISK OF HARM TO A CONSUMER” MEANS:
(1)
THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF
TARGETED ADVERTISING;
(2)
THE SALE OF PERSONAL DATA;
(3)
THE PROCESSING OF SENSITIVE DATA; AND
Ch. 455
2024 LAWS OF MARYLAND
– 30 –
(4)
THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF
PROFILING, IN WHICH THE PROFILING PRESENTS A REASONABLY FORESEEABLE
RISK OF:
(I)
UNFAIR, ABUSIVE, OR DECEPTIVE TREATMENT OF A
CONSUMER;
(II)
HAVING
AN
UNLAWFUL
DISPARATE
IMPACT
ON
A
CONSUMER;
(III) FINANCIAL, PHYSICAL, OR REPUTATIONAL INJURY TO A
CONSUMER;
(IV) A PHYSICAL OR OTHER INTRUSION ON THE SOLITUDE OR
SECLUSION OR THE PRIVATE AFFAIRS OR CONCERNS OF A CONSUMER IN WHICH THE
INTRUSION WOULD BE OFFENSIVE TO A REASONABLE PERSON; OR
(V)
OTHER SUBSTANTIAL INJURY TO A CONSUMER.
(B)
A CONTROLLER SHALL CONDUCT AND DOCUMENT, ON A REGULAR
BASIS, A DATA PROTECTION ASSESSMENT FOR EACH OF THE CONTROLLER’S
PROCESSING ACTIVITIES THAT PRESENT A HEIGHTENED RISK OF HARM TO A
CONSUMER, INCLUDING AN ASSESSMENT FOR EACH ALGORITHM THAT IS USED.
(C)
(1)
A DATA PROTECTION ASSESSMENT CONDUCTED IN ACCORDANCE
WITH THIS SECTION SHALL IDENTIFY AND WEIGH THE BENEFITS THAT MAY FLOW
DIRECTLY AND INDIRECTLY FROM THE PROCESSING TO THE CONTROLLER, THE
CONSUMER, OTHER INTERESTED PARTIES, AND THE PUBLIC AGAINST:
(I)
THE POTENTIAL RISKS TO THE RIGHTS OF THE CONSUMER
ASSOCIATED WITH THE PROCESSING AS MITIGATED BY SAFEGUARDS THAT MAY BE
EMPLOYED BY THE CONTROLLER TO REDUCE THESE RISKS; AND
(II)
THE NECESSITY AND PROPORTIONALITY OF PROCESSING IN
RELATION TO THE STATED PURPOSE OF THE PROCESSING.
(2)
THE CONTROLLER SHALL FACTOR INTO A DATA PROTECTION
ASSESSMENT:
(I)
THE USE OF DE–IDENTIFIED DATA;
(II)
THE REASONABLE EXPECTATIONS OF CONSUMERS;
WES MOORE, Governor
Ch. 455
– 31 –
(III) THE CONTEXT OF THE PROCESSING; AND
(IV) THE RELATIONSHIP BETWEEN THE CONTROLLER AND THE
CONSUMER WHOSE PERSONAL DATA WILL BE PROCESSED.
(D)
(1)
THE DIVISION MAY REQUIRE THAT A CONTROLLER MAKE
AVAILABLE TO THE DIVISION A DATA PROTECTION ASSESSMENT THAT IS RELEVANT
TO AN INVESTIGATION CONDUCTED BY THE DIVISION.
(2)
(I)
THE DIVISION MAY EVALUATE A DATA PROTECTION
ASSESSMENT FOR COMPLIANCE WITH THE RESPONSIBILITIES ESTABLISHED IN THIS
SUBTITLE.
(II)
A CONTROLLER’S DATA PROTECTION ASSESSMENT MAY BE
USED IN AN ACTION TO ENFORCE THIS SUBTITLE.
(3)
A DATA PROTECTION ASSESSMENT IS CONFIDENTIAL AND IS
EXEMPT FROM DISCLOSURE UNDER THE FEDERAL FREEDOM OF INFORMATION ACT
OR THE PUBLIC INFORMATION ACT.
(E)
A
SINGLE
DATA
PROTECTION
ASSESSMENT
MAY
ADDRESS
A
COMPARABLE
SET
OF
PROCESSING
OPERATIONS
THAT
INCLUDE
SIMILAR
ACTIVITIES.
(F)
IF A CONTROLLER CONDUCTS A DATA PROTECTION ASSESSMENT FOR
THE PURPOSE OF COMPLYING WITH ANOTHER APPLICABLE LAW OR REGULATION,
THE DATA PROTECTION ASSESSMENT SHALL BE CONSIDERED TO SATISFY THE
REQUIREMENTS ESTABLISHED IN THIS SECTION IF THE DATA PROTECTION
ASSESSMENT IS REASONABLY SIMILAR IN SCOPE AND EFFECT TO THE DATA
PROTECTION
ASSESSMENT
THAT
WOULD
OTHERWISE
BE
CONDUCTED
IN
ACCORDANCE WITH THIS SECTION.
(G)
TO THE EXTENT THAT ANY INFORMATION CONTAINED IN A DATA
PROTECTION ASSESSMENT DISCLOSED TO THE DIVISION INCLUDES INFORMATION
SUBJECT TO ATTORNEY–CLIENT PRIVILEGE OR WORK PRODUCT PROTECTION, THE
DISCLOSURE MAY NOT CONSTITUTE A WAIVER OF THAT PRIVILEGE OR PROTECTION.
(H)
A DATA PROTECTION ASSESSMENT CONDUCTED UNDER THIS SECTION:
(1)
SHALL APPLY TO PROCESSING ACTIVITIES THAT OCCUR ON OR
AFTER OCTOBER 1, 2025; AND
(2)
IS NOT REQUIRED FOR PROCESSING ACTIVITIES THAT OCCUR
BEFORE OCTOBER 1, 2025.
Ch. 455
2024 LAWS OF MARYLAND
– 32 –
14–4611.
(A)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A
CONTROLLER OR A PROCESSOR TO:
(1)
RE–IDENTIFY DE–IDENTIFIED DATA;
(2)
MAINTAIN DATA IN AN IDENTIFIABLE FORM; OR
(3)
COLLECT,
OBTAIN,
RETAIN,
OR
ACCESS
ANY
DATA
OR
TECHNOLOGY IN ORDER TO BE CAPABLE OF ASSOCIATING AN AUTHENTICATED
CONSUMER REQUEST WITH PERSONAL DATA.
(B)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A
CONTROLLER OR PROCESSOR TO COMPLY WITH AN AUTHENTICATED CONSUMER
RIGHTS REQUEST IF THE CONTROLLER:
(1)
IS NOT REASONABLY CAPABLE OF ASSOCIATING THE REQUEST
WITH THE PERSONAL DATA OR IT WOULD BE UNREASONABLY BURDENSOME FOR THE
CONTROLLER TO ASSOCIATE THE REQUEST WITH THE PERSONAL DATA;
(2)
DOES NOT USE THE PERSONAL DATA TO RECOGNIZE OR RESPOND
TO THE SPECIFIC CONSUMER WHO IS THE SUBJECT OF THE PERSONAL DATA OR
ASSOCIATE THE PERSONAL DATA WITH OTHER PERSONAL DATA ABOUT THE SAME
SPECIFIC CONSUMER; AND
(3)
DOES NOT SELL THE PERSONAL DATA TO A THIRD PARTY OR
OTHERWISE VOLUNTARILY DISCLOSE THE PERSONAL DATA TO A THIRD PARTY
OTHER THAN A PROCESSOR, EXCEPT AS OTHERWISE ALLOWED IN THIS SUBTITLE.
(C)
(1)
A CONTROLLER THAT DISCLOSES DE–IDENTIFIED DATA SHALL:
(I)
EXERCISE
REASONABLE
OVERSIGHT
TO
MONITOR
COMPLIANCE
WITH
ANY
CONTRACTUAL
COMMITMENTS
TO
WHICH
THE
DE–IDENTIFIED DATA IS SUBJECT; AND
(II)
TAKE APPROPRIATE STEPS TO ADDRESS ANY BREACHES OF
ANY CONTRACTUAL COMMITMENTS.
(2)
THE DETERMINATION OF WHETHER OVERSIGHT IS REASONABLE
AND WHETHER APPROPRIATE STEPS WERE TAKEN IN ACCORDANCE WITH
PARAGRAPH (1) OF THIS SUBSECTION SHALL TAKE INTO ACCOUNT WHETHER THE
WES MOORE, Governor
Ch. 455
– 33 –
DISCLOSED DATA INCLUDES DATA THAT WOULD BE CONSIDERED SENSITIVE DATA IF
THE DATA WERE RE–IDENTIFIED.
14–4612.
(A)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO RESTRICT A
CONTROLLER’S OR PROCESSOR’S ABILITY TO:
(1)
COMPLY
WITH
FEDERAL,
STATE,
OR
LOCAL
LAWS
OR
REGULATIONS;
(2)
COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY,
INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL, STATE, LOCAL, OR OTHER
GOVERNMENTAL AUTHORITY COMPLY WITH A CIVIL OR CRIMINAL SUBPOENA OR
SUMMONS BY A FEDERAL, STATE, LOCAL, OR OTHER JUDICIAL BODY, CRIMINAL, OR
REGULATORY INQUIRY, INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL,
STATE, LOCAL, OR OTHER GOVERNMENTAL AUTHORITY;
(3)
COOPERATE WITH LAW ENFORCEMENT AGENCIES CONCERNING
CONDUCT OR ACTIVITY THAT THE CONTROLLER OR PROCESSOR REASONABLY AND
IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR LOCAL LAWS OR
REGULATIONS;
(4)
INVESTIGATE, ESTABLISH, EXERCISE, PREPARE FOR, OR DEFEND
A LEGAL CLAIM;
(5)
PROVIDE A PRODUCT OR SERVICE SPECIFICALLY REQUESTED BY
A CONSUMER;
(6)
PERFORM UNDER A CONTRACT TO WHICH A CONSUMER IS A
PARTY, INCLUDING FULFILLING THE TERMS OF A WRITTEN WARRANTY;
(7)
TAKE STEPS AT THE REQUEST OF A CONSUMER BEFORE
ENTERING INTO A CONTRACT;
(8)
TAKE IMMEDIATE STEPS TO PROTECT AN INTEREST THAT IS
ESSENTIAL FOR THE LIFE OR PHYSICAL SAFETY OF A CONSUMER OR ANOTHER
INDIVIDUAL AND WHEN THE PROCESSING CANNOT BE MANIFESTLY BASED ON
ANOTHER LEGAL BASIS;
(9)
PREVENT,
DETECT,
PROTECT
AGAINST,
INVESTIGATE,
PROSECUTE THOSE RESPONSIBLE, OR OTHERWISE RESPOND TO A SECURITY
INCIDENT, IDENTITY THEFT, FRAUD, HARASSMENT, MALICIOUS OR DECEPTIVE
ACTIVITY, OR ANY OTHER TYPE OF ILLEGAL ACTIVITY;
Ch. 455
2024 LAWS OF MARYLAND
– 34 –
(10) PRESERVE THE INTEGRITY OR SECURITY OF SYSTEMS; OR
(11) ASSIST ANOTHER CONTROLLER, PROCESSOR, OR THIRD PARTY
WITH AN OBLIGATION UNDER THIS SUBTITLE.
(B)
(1)
THIS SUBSECTION DOES
NOT APPLY TO AN OBLIGATION
REQUIRED UNDER § 14–4611 OF THIS SUBTITLE.
(2)
AN OBLIGATION IMPOSED ON A CONTROLLER OR PROCESSOR
UNDER THIS SUBTITLE MAY NOT RESTRICT A CONTROLLER’S OR PROCESSOR’S
ABILITY TO COLLECT, USE, OR RETAIN PERSONAL DATA FOR INTERNAL USE TO:
(I)
EFFECTUATE A PRODUCT RECALL;
(II)
IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR
EXISTING OR INTENDED FUNCTIONALITY; OR
(III) PERFORM INTERNAL OPERATIONS THAT ARE:
1.
REASONABLY ALIGNED WITH THE EXPECTATIONS OF
THE CONSUMER OR CAN BE REASONABLY ANTICIPATED BASED ON THE CONSUMER’S
EXISTING RELATIONSHIP WITH THE CONTROLLER; OR
2.
OTHERWISE COMPATIBLE WITH PROCESSING DATA IN
FURTHERANCE OF:
A.
THE
PROVISION
OF
A
PRODUCT
OR
SERVICE
SPECIFICALLY REQUESTED BY A CONSUMER; OR
B.
THE PERFORMANCE OF A CONTRACT TO WHICH THE
CONSUMER IS A PARTY.
(C)
(1)
AN OBLIGATION IMPOSED ON A CONTROLLER OR A PROCESSOR
UNDER THIS SUBTITLE DOES NOT APPLY WHEN COMPLIANCE BY THE CONTROLLER
OR PROCESSOR WITH THE SUBTITLE WOULD VIOLATE AN EVIDENTIARY PRIVILEGE
UNDER STATE LAW.
(2)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO PREVENT A
CONTROLLER OR PROCESSOR FROM PROVIDING PERSONAL DATA CONCERNING A
CONSUMER TO A PERSON COVERED BY AN EVIDENTIARY PRIVILEGE UNDER STATE
LAW AS PART OF A PRIVILEGED COMMUNICATION.
WES MOORE, Governor
Ch. 455
– 35 –
(D)
(1)
A CONTROLLER OR PROCESSOR THAT DISCLOSES PERSONAL
DATA TO A PROCESSOR OR A THIRD–PARTY CONTROLLER IN COMPLIANCE WITH THIS
SUBTITLE IS NOT IN VIOLATION OF THIS SUBTITLE IF THE PROCESSOR OR
THIRD–PARTY CONTROLLER THAT RECEIVES THE PERSONAL DATA VIOLATES THIS
SUBTITLE AND,:
(I)
AT
THE
TIME
THE
DISCLOSING
CONTROLLER
OR
PROCESSOR DISCLOSED THE PERSONAL DATA, THE DISCLOSING CONTROLLER OR
PROCESSOR DID NOT HAVE ACTUAL KNOWLEDGE THAT THE RECEIVING PROCESSOR
OR THIRD–PARTY CONTROLLER WOULD VIOLATE THIS SUBTITLE; AND
(II)
THE DISCLOSING CONTROLLER WAS, AND REMAINED, IN
COMPLIANCE WITH ITS OBLIGATIONS AS THE DISCLOSER OF THE PERSONAL DATA.
(2)
A THIRD–PARTY CONTROLLER OR PROCESSOR THAT RECEIVES
PERSONAL DATA FROM A CONTROLLER OR PROCESSOR IN COMPLIANCE WITH THIS
SUBTITLE IS NOT IN VIOLATION OF THIS SUBTITLE FOR THE INDEPENDENT
MISCONDUCT
OF
THE
CONTROLLER
OR
PROCESSOR
FROM
WHICH
THE
THIRD–PARTY CONTROLLER OR PROCESSOR RECEIVED THE PERSONAL DATA.
(E)
NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO:
(1)
IMPOSE AN OBLIGATION ON A CONTROLLER OR A PROCESSOR
THAT ADVERSELY AFFECTS THE RIGHTS OR FREEDOMS OF ANY PERSON, INCLUDING
THE RIGHTS OF A PERSON TO FREEDOM OF SPEECH OR FREEDOM OF THE PRESS AS
GUARANTEED IN THE FIRST AMENDMENT TO THE U.S. CONSTITUTION; OR
(2)
APPLY TO A PERSON’S PROCESSING OF PERSONAL DATA DURING
THE PERSON’S PERSONAL OR HOUSEHOLD ACTIVITIES.
(F)
IF A CONTROLLER OR PROCESSOR PROCESSES PERSONAL DATA IN
ACCORDANCE WITH AN EXEMPTION UNDER THIS SECTION, THE CONTROLLER OR
PROCESSOR SHALL DEMONSTRATE THAT THE PROCESSING:
(1)
QUALIFIES FOR AN EXEMPTION; AND
(2)
COMPLIES WITH THE REQUIREMENTS OF SUBSECTION (G) OF THIS
SECTION.
(G)
PERSONAL DATA PROCESSED BY A CONTROLLER OR PROCESSOR IN
ACCORDANCE WITH THIS SECTION:
(1)
SHALL
BE
SUBJECT
TO
REASONABLE
ADMINISTRATIVE,
TECHNICAL, AND PHYSICAL MEASURES TO:
Ch. 455
2024 LAWS OF MARYLAND
– 36 –
(I)
PROTECT
THE
CONFIDENTIALITY,
INTEGRITY,
AND
ACCESSIBILITY OF THE PERSONAL DATA; AND
(II)
REDUCE REASONABLY FORESEEABLE RISKS OF HARM TO
CONSUMERS RELATING TO THE COLLECTION, USE, OR RETENTION OF PERSONAL
DATA; AND
(2)
MAY BE PROCESSED TO THE EXTENT THAT THE PROCESSING IS:
(I)
REASONABLY NECESSARY AND PROPORTIONATE TO THE
PURPOSES LISTED IN THIS SECTION; AND
(II)
ADEQUATE,
RELEVANT,
AND
LIMITED
TO
WHAT
IS
NECESSARY IN RELATION TO THE SPECIFIC PURPOSES LISTED IN THIS SECTION.
(H)
A PERSON THAT PROCESSES PERSONAL DATA FOR A PURPOSE
EXPRESSLY IDENTIFIED IN THIS SECTION MAY NOT BE CONSIDERED A CONTROLLER
SOLELY BASED ON THE PROCESSING OF PERSONAL DATA.
14–4613.
(A)
EXCEPT AS PROVIDED IN SUBSECTION (B) OF THIS SECTION, A
VIOLATION OF THIS SUBTITLE IS:
(1)
AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE PRACTICE WITHIN
THE MEANING OF TITLE 13 OF THIS ARTICLE; AND
(2)
SUBJECT TO THE ENFORCEMENT AND PENALTY PROVISIONS
CONTAINED IN TITLE 13 OF THIS ARTICLE, EXCEPT FOR § 13–408 OF THIS ARTICLE.
(B)
THIS SECTION DOES NOT PREVENT A CONSUMER FROM PURSUING ANY
OTHER REMEDY PROVIDED BY LAW.
14–4614.
(A)
THIS SECTION APPLIES TO AN ENFORCEMENT ACTION UNDER § 14–4613
OF THIS SUBTITLE FOR AN ALLEGED VIOLATION THAT OCCURS ON OR BEFORE APRIL
1, 2027.
(B)
BEFORE INITIATING ANY ACTION UNDER § 14–4613 OF THIS SUBTITLE,
THE DIVISION MAY ISSUE A NOTICE OF VIOLATION TO THE CONTROLLER OR
PROCESSOR IF THE DIVISION DETERMINES THAT A CURE IS POSSIBLE.
WES MOORE, Governor
Ch. 455
– 37 –
(C)
(1)
IF THE DIVISION ISSUES A NOTICE OF VIOLATION UNDER
SUBSECTION (B) OF THIS SECTION, THE CONTROLLER OR PROCESSOR SHALL HAVE
AT LEAST 60 DAYS TO CURE THE VIOLATION AFTER RECEIPT OF THE NOTICE.
(2)
IF THE CONTROLLER OR PROCESSOR FAILS TO CURE THE
VIOLATION WITHIN THE TIME PERIOD SPECIFIED BY THE DIVISION, THE DIVISION
MAY BRING AN ENFORCEMENT ACTION UNDER § 14–4613 OF THIS SUBTITLE.
(D)
IN DETERMINING WHETHER TO GRANT A CONTROLLER OR PROCESSOR
AN OPPORTUNITY TO CURE AN ALLEGED VIOLATION, THE DIVISION MAY CONSIDER
THE FOLLOWING FACTORS:
(1)
THE NUMBER OF VIOLATIONS;
(2)
THE SIZE AND COMPLEXITY OF THE CONTROLLER OR PROCESSOR;
(3)
THE
NATURE
AND
EXTENT
OF
THE
CONTROLLER’S
OR
PROCESSOR’S PROCESSING ACTIVITIES;
(4)
THE LIKELIHOOD OF INJURY TO THE PUBLIC;
(5)
THE SAFETY OF PERSONS OR PROPERTY;
(6)
WHETHER THE ALLEGED VIOLATION WAS LIKELY CAUSED BY A
HUMAN OR TECHNICAL ERROR; AND
(7)
THE EXTENT TO WHICH THE CONTROLLER OR PROCESSOR HAS
VIOLATED THIS SUBTITLE OR SIMILAR LAWS IN THE PAST.
SECTION 2. AND BE IT FURTHER ENACTED, That § 14–4612 of the Commercial
Law Article, as enacted by Section 1 of this Act, shall be construed to apply only
prospectively and may not be applied or interpreted to have any effect on or application to
any personal data processing activities before April 1, 2025 2026.
SECTION 3. AND BE IT FURTHER ENACTED, That, if any provision of this Act or
the application thereof to any person or circumstance is held invalid for any reason in a
court of competent jurisdiction, the invalidity does not affect other provisions or any other
application of this Act that can be given effect without the invalid provision or application,
and for this purpose the provisions of this Act are declared severable.
SECTION 4. AND BE IT FURTHER ENACTED, That this Act shall take effect
October 1, 2024 2025.
Approved by the Governor, May 9, 2024.