Processes personal data, in Maryland

Md. Code Ann., Com. Law §§ 14-3401, 14-3402 (Title 14, Subtitle 34) · Read the law's page

• Whether you are a business or an employer, do not publicly post or display an individual's Social Security number, and do not print it on a card the individual must use to access products or services you provide (Com. Law 14-3402(a)(1)-(2)).
• Do not require an individual to transmit, or initiate the transmission of, the individual's Social Security number over the Internet unless the connection is secure or the number is encrypted (Com. Law 14-3402(a)(3)-(4)).
• Do not require an individual to use the individual's Social Security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required (Com. Law 14-3402(a)(5)).
• Unless State or federal law requires it, do not print an individual's Social Security number on material you mail to the individual, do not include it in material you transmit electronically to the individual unless the connection is secure or the number is encrypted, and do not include it in material you send to the individual by facsimile (Com. Law 14-3402(a)(6)).

Md. Code Ann., Com. Law sections 14-3502, 14-3503 (Maryland Personal Information Protection Act, Title 14, Subtitle 35, added by 2007 Md. Laws ch. 531 (S.B. 194)) · Read the law's page

• This binds any business that owns, maintains, or licenses the personal information of a Maryland resident; a business already complying with the security, notification, or destruction rules set by its own primary or functional federal or State regulator, or already subject to and in compliance with all four of section 501(b) of the Gramm-Leach-Bliley Act, section 216 of the Fair and Accurate Credit Transactions Act, the federal Interagency Guidelines Establishing Information Security Standards, and the federal Interagency Guidance on Response Programs, or with HIPAA, is deemed to comply with this duty.
• Absent that safe harbor, implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal information held and the size of the business, to protect it from unauthorized access, use, modification, or disclosure.
• When destroying a customer's, an employee's, or a former employee's records containing personal information, take reasonable steps to protect against unauthorized access to or use of that information, weighing the sensitivity of the records, the size of the business, the cost of different destruction methods, and available technology.
• Where a nonaffiliated third-party service provider will receive personal information under a written contract entered into on or after January 1, 2009, require by that contract that the provider also implement and maintain reasonable security procedures and practices appropriate to the information disclosed.
• A violation is an unfair or deceptive trade practice enforced by the Office of the Attorney General's Consumer Protection Division, for injunctive relief and a civil penalty of up to $10,000 per violation ($25,000 for a repeat violation); any person harmed may also bring a private action for injury or loss, and Title 13's own misdemeanor provision may extend to a violation of this duty.

Md. Code Ann., Lab. & Empl. § 3-717 · Read the law's page

• If you are an employer, do not use a facial recognition service to create a facial template during an applicant's interview for employment unless the applicant consents (Lab. & Empl. 3-717(b)).
• Obtain the applicant's consent by a signed waiver that states in plain language the applicant's name, the date of the interview, that the applicant consents to the use of facial recognition during the interview, and whether the applicant read the consent waiver (Lab. & Empl. 3-717(c)).

Md. Code Ann., Com. Law §§ 14-4401 to 14-4408 (Title 14, Subtitle 44) · Read the law's page

• If you are a direct-to-consumer genetic testing company, give each consumer a high-level overview of your privacy policy and a privacy notice covering your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices, made publicly available and placed in a prominent area of your website (Com. Law 14-4403).
• Obtain the consumer's initial express consent, before you collect, use or disclose genetic data, that clearly describes the uses of the data collected and specifies who has access to the results and how the data may be shared (Com. Law 14-4404(1)).
• Obtain separate express consent before you transfer or disclose genetic data to anyone other than your vendors and service providers, before you use it beyond the primary purpose of the product or service the consumer requested, before you keep a biological sample after the initial testing is completed, and before you market to the consumer based on the data or let a third party market based on the consumer's order or purchase (Com. Law 14-4404(2)-(5)).
• Obtain informed consent that complies with the federal policy for the protection of human research subjects before you transfer or disclose genetic data to third parties for research, or for research under your control conducted to publish or produce generalizable knowledge (Com. Law 14-4404(6)).
• Establish legal policies and processes for disclosing genetic data to law enforcement or another government agency without the consumer's express written consent (Com. Law 14-4405(a)).
• Develop, implement and maintain a comprehensive security program to protect consumers' genetic data against unauthorized access, use or disclosure (Com. Law 14-4405(b)).
• Establish a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request destruction of the consumer's biological sample (Com. Law 14-4405(c)).
• Do not, without the consumer's written consent, disclose a consumer's genetic data to an entity offering health insurance, life insurance, disability insurance or long-term care insurance, or to an employer of the consumer (Com. Law 14-4405(d)).

Md. Code Ann., Com. Law §§ 14-4401(c) and (g)(3) (Title 14, Subtitle 44) · Read the law's page

• To keep data outside the Genetic Information Privacy Act's definition of genetic data, make sure it cannot reasonably be used to infer information about a consumer or linked to an identifiable consumer (Com. Law 14-4401(c)(1) and (g)(3)).
• Subject the data to administrative and technical measures to ensure that it cannot be associated with a particular consumer (Com. Law 14-4401(c)(2)(i)).
• Publicly commit to maintain and use the data in a deidentifiable form and not to attempt to reidentify it (Com. Law 14-4401(c)(2)(ii)).
• Bind each recipient of the data by legally enforceable contractual obligations that prohibit the recipient from attempting to reidentify it (Com. Law 14-4401(c)(2)(iii)).

Md. Code Ann., Com. Law § 14-4705 · Read the law's page

• Give a Maryland consumer a means to confirm whether you process their personal data, access it, correct it, delete it, receive a portable copy, and obtain a list of third-party categories it was disclosed to.
• Offer a Maryland consumer an opt-out of targeted advertising, sale of personal data, and profiling in furtherance of solely automated decisions with legal or similarly significant effects.
• Respond to a consumer rights request no later than 45 days after receipt, with one 45-day extension available if you tell the consumer the reason within the initial period, and provide a conspicuous process to appeal a refusal.

Md. Code Ann., Com. Law § 14-4710 · Read the law's page

• Conduct and document, on a regular basis, a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, including an assessment for each algorithm that you use.
• Treat targeted advertising, the sale of personal data, the processing of sensitive data and profiling that presents a reasonably foreseeable risk of unfair, abusive or deceptive treatment, an unlawful disparate impact, injury, an offensive intrusion or other substantial injury to a consumer as processing that presents a heightened risk of harm.
• Make each assessment weigh the benefits of the processing against the risks to the consumer's rights as mitigated by safeguards, and against the necessity and proportionality of the processing in relation to its stated purpose.
• Make an assessment available to the Division when it requires one that is relevant to an investigation.

Md. Code Ann., Com. Law §§ 14-4701(d), (gg), (hh), 14-4707(a) · Read the law's page

• Do not collect, process, or share sensitive data, including genetic or biometric data, unless strictly necessary to provide a product or service the consumer requested. MODPA supplies no separate consent-only path around this necessity requirement.
• Never sell sensitive data. MODPA bans the sale of sensitive data outright.
• Treat an identifier your product derives from a public photo, video, or audio recording specifically to identify a person as covered biometric data, and therefore sensitive data, even though a bare photograph or recording by itself is excluded. The exclusion does not survive identification-purpose derivation.
• Do not process a consumer's personal data for targeted advertising, or sell it, if you know or should know the consumer is under 18.
• Do not sell a Maryland consumer's personal data if you know or should know the purchaser seeks to use it for immigration enforcement, and do not knowingly sell it to a federal, State, or local governmental unit that engaged in or supported civil immigration enforcement through personnel or material resources in the preceding six months.

Md. Code Ann., Com. Law §§ 14-4701, 14-4702 (Title 14, Subtitle 47) · Read the law's page

• Determine whether you conduct business in Maryland or target products or services to Maryland residents, and controlled or processed at least 35,000 consumers' personal data (excluding data processed solely to complete a payment transaction) or at least 10,000 consumers' personal data while deriving more than 20% of gross revenue from selling personal data, before treating MODPA as out of scope.
• Treat Maryland's 35,000-consumer applicability floor as materially lower than many peer states' 100,000-consumer floor when deciding whether MODPA reaches your Maryland-facing processing.
• Allocate controller duties (determining the purpose and means of processing) and processor duties (processing on a controller's behalf) correctly before assigning any of MODPA's other duties.

Md. Code Ann., Com. Law §§ 14-4713, 14-4714 · Read the law's page

• Expect MODPA violations to be enforced exclusively by the Maryland Attorney General's Division of Consumer Protection under Title 13's unfair, abusive, or deceptive trade practice machinery, never by a private plaintiff. MODPA expressly excludes Title 13's private-action-for-damages provision, section 13-408, from its enforcement scheme.
• Do not rely on an unconditional right to cure. The Division may, at its discretion, issue a notice of violation and give at least 60 days to cure only where it determines a cure is possible, and this mechanism applies only to a violation occurring on or before April 1, 2027.

COMAR 10.25.05 · Read the law's page

• If you are the Maryland Health Care Commission and provide a de-identified standard analytic file under an approved application, provide a data extract that contains only data elements that are not considered PHI because the extract excludes direct and indirect individual identifiers as defined in the HIPAA Privacy Rule (COMAR 10.25.05.03C(1)).
• If you are the Maryland Health Care Commission and provide a limited data set under an approved application, provide a data extract that contains a limited set of indirect individual identifiers as defined in the HIPAA Privacy Rule and excludes direct individual identifiers (COMAR 10.25.05.03C(2)).
• If you are a governmental entity requesting data from the Maryland Medical Care Data Base, include in your written data request the safeguards against re-identification of an individual in a product that you will create or publish publicly (COMAR 10.25.05.05B(4)).

COMAR 10.25.18 · Read the law's page

• If you operate a health information exchange, disclose de-identified data or a limited data set to a care management organization for population health management only when an internal review committee designated by the organization has entered into a data use agreement with you and attested that the request is for population health management and limited to the minimum necessary (COMAR 10.25.18.10B(1)).
• Disclose de-identified data to a qualified research organization only when a privacy board has confirmed that the requesting entity is a qualified research organization and that the requested data is for research, limited to the minimum necessary, serves a legitimate purpose consistent with the interest of the subject individuals, and meets the de-identification standard in 45 CFR 164.514(a) to (c) (COMAR 10.25.18.10C(1)).
• If you are a qualified research organization receiving data from a health information exchange for research, contractually agree not to link de-identified data received from the exchange with other data sources to re-identify it and not otherwise to attempt to re-identify it (COMAR 10.25.18.10C(7)(a)).
• Treat as de-identified data only health information that neither identifies nor provides a reasonable basis to identify an individual and that meets 45 CFR 164.514(a) and (b) (COMAR 10.25.18.02B(21)).

Md. Code Ann., Com. Law §§ 14-3501, 14-3504 (Title 14, Subtitle 35) · Read the law's page

• Notify each affected Maryland individual as soon as reasonably practicable, and no later than 45 days after discovering or being notified of the breach, once you determine a likelihood that personal information has been or will be misused.
• If you maintain computerized data that you do not own or license, notify the owner or licensee of a breach as soon as reasonably practicable, and no later than 10 days after you discover or are notified of the breach (Com. Law 14-3504(c)).
• Where a law enforcement agency delays that notice to the owner or licensee, notify them as soon as reasonably practicable, and no later than 7 days after the agency determines that notification will not impede a criminal investigation or jeopardize homeland or national security (Com. Law 14-3504(d)).
• Treat biometric data used to uniquely authenticate identity when accessing a system or account, such as a fingerprint, voiceprint, or retina or iris image, as its own triggering data element for this notification duty, separate from a name combined with a Social Security or financial account number.
• Where notification is delayed because a law enforcement agency says it would impede an investigation, notify within 7 days after that delay is cleared, or by the original 45-day deadline, whichever is later.
• Expect a MPIPA violation to be privately actionable. Unlike MODPA, MPIPA's enforcement section does not exclude the Consumer Protection Act's private-action-for-damages provision.