Places automated calls, in Maryland

Md. Code Ann., Com. Law §§ 14-3201 to 14-3202 · Read the law's page

• Do not violate the federal Telemarketing and Consumer Fraud and Abuse Prevention Act as implemented by the Federal Trade Commission's Telemarketing Sales Rule, or the federal Telephone Consumer Protection Act as implemented by the Federal Communications Commission's telemarketing and telephone solicitation rules; either violation is independently unlawful, and independently actionable, under Maryland law.

Md. Code Ann., Com. Law §§ 14-3401, 14-3402 (Title 14, Subtitle 34) · Read the law's page

• Whether you are a business or an employer, do not publicly post or display an individual's Social Security number, and do not print it on a card the individual must use to access products or services you provide (Com. Law 14-3402(a)(1)-(2)).
• Do not require an individual to transmit, or initiate the transmission of, the individual's Social Security number over the Internet unless the connection is secure or the number is encrypted (Com. Law 14-3402(a)(3)-(4)).
• Do not require an individual to use the individual's Social Security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required (Com. Law 14-3402(a)(5)).
• Unless State or federal law requires it, do not print an individual's Social Security number on material you mail to the individual, do not include it in material you transmit electronically to the individual unless the connection is secure or the number is encrypted, and do not include it in material you send to the individual by facsimile (Com. Law 14-3402(a)(6)).

Md. Code Ann., Com. Law sections 14-3502, 14-3503 (Maryland Personal Information Protection Act, Title 14, Subtitle 35, added by 2007 Md. Laws ch. 531 (S.B. 194)) · Read the law's page

• This binds any business that owns, maintains, or licenses the personal information of a Maryland resident; a business already complying with the security, notification, or destruction rules set by its own primary or functional federal or State regulator, or already subject to and in compliance with all four of section 501(b) of the Gramm-Leach-Bliley Act, section 216 of the Fair and Accurate Credit Transactions Act, the federal Interagency Guidelines Establishing Information Security Standards, and the federal Interagency Guidance on Response Programs, or with HIPAA, is deemed to comply with this duty.
• Absent that safe harbor, implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal information held and the size of the business, to protect it from unauthorized access, use, modification, or disclosure.
• When destroying a customer's, an employee's, or a former employee's records containing personal information, take reasonable steps to protect against unauthorized access to or use of that information, weighing the sensitivity of the records, the size of the business, the cost of different destruction methods, and available technology.
• Where a nonaffiliated third-party service provider will receive personal information under a written contract entered into on or after January 1, 2009, require by that contract that the provider also implement and maintain reasonable security procedures and practices appropriate to the information disclosed.
• A violation is an unfair or deceptive trade practice enforced by the Office of the Attorney General's Consumer Protection Division, for injunctive relief and a civil penalty of up to $10,000 per violation ($25,000 for a repeat violation); any person harmed may also bring a private action for injury or loss, and Title 13's own misdemeanor provision may extend to a violation of this duty.

Md. Code Ann., Com. Law §§ 14-4401 to 14-4408 (Title 14, Subtitle 44) · Read the law's page

• If you are a direct-to-consumer genetic testing company, give each consumer a high-level overview of your privacy policy and a privacy notice covering your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices, made publicly available and placed in a prominent area of your website (Com. Law 14-4403).
• Obtain the consumer's initial express consent, before you collect, use or disclose genetic data, that clearly describes the uses of the data collected and specifies who has access to the results and how the data may be shared (Com. Law 14-4404(1)).
• Obtain separate express consent before you transfer or disclose genetic data to anyone other than your vendors and service providers, before you use it beyond the primary purpose of the product or service the consumer requested, before you keep a biological sample after the initial testing is completed, and before you market to the consumer based on the data or let a third party market based on the consumer's order or purchase (Com. Law 14-4404(2)-(5)).
• Obtain informed consent that complies with the federal policy for the protection of human research subjects before you transfer or disclose genetic data to third parties for research, or for research under your control conducted to publish or produce generalizable knowledge (Com. Law 14-4404(6)).
• Establish legal policies and processes for disclosing genetic data to law enforcement or another government agency without the consumer's express written consent (Com. Law 14-4405(a)).
• Develop, implement and maintain a comprehensive security program to protect consumers' genetic data against unauthorized access, use or disclosure (Com. Law 14-4405(b)).
• Establish a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request destruction of the consumer's biological sample (Com. Law 14-4405(c)).
• Do not, without the consumer's written consent, disclose a consumer's genetic data to an entity offering health insurance, life insurance, disability insurance or long-term care insurance, or to an employer of the consumer (Com. Law 14-4405(d)).

Md. Code Ann., Com. Law §§ 14-4501 to 14-4503 · Read the law's page

• Before making, or causing to be made, a telephone solicitation that uses an automated system for the selection or dialing of telephone numbers, or that plays a recorded message when the call connects, get the called party's prior express written consent: a signed written agreement (an electronic signature can qualify) naming the number to be called, with a clear and conspicuous disclosure that signing authorizes those automated or recorded solicitations and that the called party need not sign it, or agree to it as a condition of any purchase.
• This consent duty does not reach an isolated solicitation outside a pattern of repeated transactions, a business-to-business sale by a solicitor lawfully operating for at least 3 years under the same name, a solicitation to maintain or repair goods the person bought from you, a single call answering the customer's own inquiry or request, an informational communication with an existing customer that becomes a solicitation on the customer's further inquiry, noncommercial public opinion research, or a noncommercial religious, charitable, political, or educational solicitation for a nonprofit registered with the Secretary of State and exempt under section 501(c)(3), (4), or (6) of the Internal Revenue Code; the caller-identification, calling-hours and call-frequency duties apply regardless.
• On every telephone solicitation, transmit your originating telephone number, and your name where your carrier makes it available, to the called party's caller identification service (the seller's name and customer service number may stand in), do not act to block that transmission, and do not use technology that displays a different number to conceal your identity.
• Do not make a telephone solicitation, including one made through automated dialing or a recorded message, between 8 p.m. and 8 a.m. in the called party's time zone, more than three times to the same person in a 24-hour period on the same subject matter regardless of the numbers used, or while intentionally altering your voice to disguise your identity in order to defraud, confuse, or injure the called party or obtain their personal information.

Md. Code Ann., Pub. Util. §§ 8-204 to 8-205 · Read the law's page

• Do not use an automated dialing, push-button, or tone-activated system with a prerecorded message to solicit a purchase, lease, or rental, offer a gift or prize, conduct a poll, or request survey information used to solicit purchases, unless you have a preexisting business relationship with, or the consent of, the person called.
• Disconnect the prerecorded message machine from the recipient's line within 5 seconds after either party ends the call.
• If your telephone service or equipment lets you choose whether to display your number, do not block or otherwise prevent its transmission to the person you are soliciting.