Sends automated texts, in Maryland

Md. Code Ann., Com. Law §§ 14-3201 to 14-3202 · Read the law's page

• Do not violate the federal Telemarketing and Consumer Fraud and Abuse Prevention Act as implemented by the Federal Trade Commission's Telemarketing Sales Rule, or the federal Telephone Consumer Protection Act as implemented by the Federal Communications Commission's telemarketing and telephone solicitation rules; either violation is independently unlawful, and independently actionable, under Maryland law.

Md. Code Ann., Com. Law §§ 14-3401, 14-3402 (Title 14, Subtitle 34) · Read the law's page

• Whether you are a business or an employer, do not publicly post or display an individual's Social Security number, and do not print it on a card the individual must use to access products or services you provide (Com. Law 14-3402(a)(1)-(2)).
• Do not require an individual to transmit, or initiate the transmission of, the individual's Social Security number over the Internet unless the connection is secure or the number is encrypted (Com. Law 14-3402(a)(3)-(4)).
• Do not require an individual to use the individual's Social Security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required (Com. Law 14-3402(a)(5)).
• Unless State or federal law requires it, do not print an individual's Social Security number on material you mail to the individual, do not include it in material you transmit electronically to the individual unless the connection is secure or the number is encrypted, and do not include it in material you send to the individual by facsimile (Com. Law 14-3402(a)(6)).

Md. Code Ann., Com. Law sections 14-3502, 14-3503 (Maryland Personal Information Protection Act, Title 14, Subtitle 35, added by 2007 Md. Laws ch. 531 (S.B. 194)) · Read the law's page

• This binds any business that owns, maintains, or licenses the personal information of a Maryland resident; a business already complying with the security, notification, or destruction rules set by its own primary or functional federal or State regulator, or already subject to and in compliance with all four of section 501(b) of the Gramm-Leach-Bliley Act, section 216 of the Fair and Accurate Credit Transactions Act, the federal Interagency Guidelines Establishing Information Security Standards, and the federal Interagency Guidance on Response Programs, or with HIPAA, is deemed to comply with this duty.
• Absent that safe harbor, implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal information held and the size of the business, to protect it from unauthorized access, use, modification, or disclosure.
• When destroying a customer's, an employee's, or a former employee's records containing personal information, take reasonable steps to protect against unauthorized access to or use of that information, weighing the sensitivity of the records, the size of the business, the cost of different destruction methods, and available technology.
• Where a nonaffiliated third-party service provider will receive personal information under a written contract entered into on or after January 1, 2009, require by that contract that the provider also implement and maintain reasonable security procedures and practices appropriate to the information disclosed.
• A violation is an unfair or deceptive trade practice enforced by the Office of the Attorney General's Consumer Protection Division, for injunctive relief and a civil penalty of up to $10,000 per violation ($25,000 for a repeat violation); any person harmed may also bring a private action for injury or loss, and Title 13's own misdemeanor provision may extend to a violation of this duty.

Md. Code Ann., Com. Law §§ 14-4401 to 14-4408 (Title 14, Subtitle 44) · Read the law's page

• If you are a direct-to-consumer genetic testing company, give each consumer a high-level overview of your privacy policy and a privacy notice covering your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices, made publicly available and placed in a prominent area of your website (Com. Law 14-4403).
• Obtain the consumer's initial express consent, before you collect, use or disclose genetic data, that clearly describes the uses of the data collected and specifies who has access to the results and how the data may be shared (Com. Law 14-4404(1)).
• Obtain separate express consent before you transfer or disclose genetic data to anyone other than your vendors and service providers, before you use it beyond the primary purpose of the product or service the consumer requested, before you keep a biological sample after the initial testing is completed, and before you market to the consumer based on the data or let a third party market based on the consumer's order or purchase (Com. Law 14-4404(2)-(5)).
• Obtain informed consent that complies with the federal policy for the protection of human research subjects before you transfer or disclose genetic data to third parties for research, or for research under your control conducted to publish or produce generalizable knowledge (Com. Law 14-4404(6)).
• Establish legal policies and processes for disclosing genetic data to law enforcement or another government agency without the consumer's express written consent (Com. Law 14-4405(a)).
• Develop, implement and maintain a comprehensive security program to protect consumers' genetic data against unauthorized access, use or disclosure (Com. Law 14-4405(b)).
• Establish a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request destruction of the consumer's biological sample (Com. Law 14-4405(c)).
• Do not, without the consumer's written consent, disclose a consumer's genetic data to an entity offering health insurance, life insurance, disability insurance or long-term care insurance, or to an employer of the consumer (Com. Law 14-4405(d)).