Processes biometric data, in Maryland

Md. Code Ann., Com. Law sections 14-3502, 14-3503 (Maryland Personal Information Protection Act, Title 14, Subtitle 35, added by 2007 Md. Laws ch. 531 (S.B. 194)) · Read the law's page

• This binds any business that owns, maintains, or licenses the personal information of a Maryland resident; a business already complying with the security, notification, or destruction rules set by its own primary or functional federal or State regulator, or already subject to and in compliance with all four of section 501(b) of the Gramm-Leach-Bliley Act, section 216 of the Fair and Accurate Credit Transactions Act, the federal Interagency Guidelines Establishing Information Security Standards, and the federal Interagency Guidance on Response Programs, or with HIPAA, is deemed to comply with this duty.
• Absent that safe harbor, implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal information held and the size of the business, to protect it from unauthorized access, use, modification, or disclosure.
• When destroying a customer's, an employee's, or a former employee's records containing personal information, take reasonable steps to protect against unauthorized access to or use of that information, weighing the sensitivity of the records, the size of the business, the cost of different destruction methods, and available technology.
• Where a nonaffiliated third-party service provider will receive personal information under a written contract entered into on or after January 1, 2009, require by that contract that the provider also implement and maintain reasonable security procedures and practices appropriate to the information disclosed.
• A violation is an unfair or deceptive trade practice enforced by the Office of the Attorney General's Consumer Protection Division, for injunctive relief and a civil penalty of up to $10,000 per violation ($25,000 for a repeat violation); any person harmed may also bring a private action for injury or loss, and Title 13's own misdemeanor provision may extend to a violation of this duty.

Md. Code Ann., Lab. & Empl. § 3-717 · Read the law's page

• If you are an employer, do not use a facial recognition service to create a facial template during an applicant's interview for employment unless the applicant consents (Lab. & Empl. 3-717(b)).
• Obtain the applicant's consent by a signed waiver that states in plain language the applicant's name, the date of the interview, that the applicant consents to the use of facial recognition during the interview, and whether the applicant read the consent waiver (Lab. & Empl. 3-717(c)).

Md. Code Ann., Com. Law §§ 14-4701(d), (gg), (hh), 14-4707(a) · Read the law's page

• Do not collect, process, or share sensitive data, including genetic or biometric data, unless strictly necessary to provide a product or service the consumer requested. MODPA supplies no separate consent-only path around this necessity requirement.
• Never sell sensitive data. MODPA bans the sale of sensitive data outright.
• Treat an identifier your product derives from a public photo, video, or audio recording specifically to identify a person as covered biometric data, and therefore sensitive data, even though a bare photograph or recording by itself is excluded. The exclusion does not survive identification-purpose derivation.
• Do not process a consumer's personal data for targeted advertising, or sell it, if you know or should know the consumer is under 18.
• Do not sell a Maryland consumer's personal data if you know or should know the purchaser seeks to use it for immigration enforcement, and do not knowingly sell it to a federal, State, or local governmental unit that engaged in or supported civil immigration enforcement through personnel or material resources in the preceding six months.

Md. Code Com. Law § 14-4601 et seq. as originally enacted (2024 Md. Laws ch. 454, HB 567), now codified at § 14-4701 et seq. · Read the law's page

• Never treat biometric data you collect about a Maryland consumer without that consumer's knowledge as publicly available, even if the source photo or recording appeared on a public page; MODPA's own carve-back excludes it from the exemption regardless.
• Limit any personal data you collect on a Maryland consumer to what is reasonably necessary and proportionate to the specific product or service they requested.
• If you meet MODPA's 35,000-consumer or 10,000-consumer-plus-20%-revenue thresholds, expect enforcement through the enforcement provisions of the Maryland Consumer Protection Act; the Act does not incorporate that Act's private action for damages.

Md. Code Ann., Com. Law §§ 14-3501, 14-3504 (Title 14, Subtitle 35) · Read the law's page

• Notify each affected Maryland individual as soon as reasonably practicable, and no later than 45 days after discovering or being notified of the breach, once you determine a likelihood that personal information has been or will be misused.
• If you maintain computerized data that you do not own or license, notify the owner or licensee of a breach as soon as reasonably practicable, and no later than 10 days after you discover or are notified of the breach (Com. Law 14-3504(c)).
• Where a law enforcement agency delays that notice to the owner or licensee, notify them as soon as reasonably practicable, and no later than 7 days after the agency determines that notification will not impede a criminal investigation or jeopardize homeland or national security (Com. Law 14-3504(d)).
• Treat biometric data used to uniquely authenticate identity when accessing a system or account, such as a fingerprint, voiceprint, or retina or iris image, as its own triggering data element for this notification duty, separate from a name combined with a Social Security or financial account number.
• Where notification is delayed because a law enforcement agency says it would impede an investigation, notify within 7 days after that delay is cleared, or by the original 45-day deadline, whichever is later.
• Expect a MPIPA violation to be privately actionable. Unlike MODPA, MPIPA's enforcement section does not exclude the Consumer Protection Act's private-action-for-damages provision.