Makes health care decisions, in Maryland

Md. Code Ann., Com. Law sections 14-3502, 14-3503 (Maryland Personal Information Protection Act, Title 14, Subtitle 35, added by 2007 Md. Laws ch. 531 (S.B. 194)) · Read the law's page

• This binds any business that owns, maintains, or licenses the personal information of a Maryland resident; a business already complying with the security, notification, or destruction rules set by its own primary or functional federal or State regulator, or already subject to and in compliance with all four of section 501(b) of the Gramm-Leach-Bliley Act, section 216 of the Fair and Accurate Credit Transactions Act, the federal Interagency Guidelines Establishing Information Security Standards, and the federal Interagency Guidance on Response Programs, or with HIPAA, is deemed to comply with this duty.
• Absent that safe harbor, implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal information held and the size of the business, to protect it from unauthorized access, use, modification, or disclosure.
• When destroying a customer's, an employee's, or a former employee's records containing personal information, take reasonable steps to protect against unauthorized access to or use of that information, weighing the sensitivity of the records, the size of the business, the cost of different destruction methods, and available technology.
• Where a nonaffiliated third-party service provider will receive personal information under a written contract entered into on or after January 1, 2009, require by that contract that the provider also implement and maintain reasonable security procedures and practices appropriate to the information disclosed.
• A violation is an unfair or deceptive trade practice enforced by the Office of the Attorney General's Consumer Protection Division, for injunctive relief and a civil penalty of up to $10,000 per violation ($25,000 for a repeat violation); any person harmed may also bring a private action for injury or loss, and Title 13's own misdemeanor provision may extend to a violation of this duty.

Md. Code Ann., Com. Law § 14-4705 · Read the law's page

• Give a Maryland consumer a means to confirm whether you process their personal data, access it, correct it, delete it, receive a portable copy, and obtain a list of third-party categories it was disclosed to.
• Offer a Maryland consumer an opt-out of targeted advertising, sale of personal data, and profiling in furtherance of solely automated decisions with legal or similarly significant effects.
• Respond to a consumer rights request no later than 45 days after receipt, with one 45-day extension available if you tell the consumer the reason within the initial period, and provide a conspicuous process to appeal a refusal.

Md. Code Ann., Com. Law § 14-4710 · Read the law's page

• Conduct and document, on a regular basis, a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, including an assessment for each algorithm that you use.
• Treat targeted advertising, the sale of personal data, the processing of sensitive data and profiling that presents a reasonably foreseeable risk of unfair, abusive or deceptive treatment, an unlawful disparate impact, injury, an offensive intrusion or other substantial injury to a consumer as processing that presents a heightened risk of harm.
• Make each assessment weigh the benefits of the processing against the risks to the consumer's rights as mitigated by safeguards, and against the necessity and proportionality of the processing in relation to its stated purpose.
• Make an assessment available to the Division when it requires one that is relevant to an investigation.

Md. Code Ann., Com. Law §§13-321, 13-322 · Read the law's page

• If you are a food retailer operating a business establishment of at least 15,000 square feet that sells food exempt from the state sales and use tax, or a third-party service that facilitates delivery of that food, do not engage in dynamic pricing (offering a personalized price to a consumer based on the consumer's personal data, including through artificial intelligence or models that retrain or recalibrate in near real time) or use surveillance personal data to set a higher price for that food for a specific consumer or group of consumers.
• If you are any other merchant and you set the price of a consumer good or service using dynamic pricing or personal data, and you then advertise, label, or otherwise communicate that price, include a clear and conspicuous disclosure stating: "This price was set by an algorithm or by using your personal data."
• This disclosure duty does not apply to conduct regulated under the Insurance Article, to a financial institution or its affiliate subject to Title V of the Gramm-Leach-Bliley Act, to a food retailer or delivery provider already covered by the dynamic-pricing ban, or to a lower price offered to a consumer who is an employee of the merchant.
• Neither provision creates a private right of action; the Division of Consumer Protection must give 45 days' written notice and an opportunity to cure before bringing an enforcement action.