Law / United States / 
Maryland
Maryland Personal Information Protection Act (MPIPA), breach notification
Md. Code Ann., Com. Law §§ 14-3501, 14-3504 (Title 14, Subtitle 35)
In force.
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Notify each affected Maryland individual as soon as reasonably practicable, and no later than 45 days after discovering or being notified of the breach, once you determine a likelihood that personal information has been or will be misused.
- If you maintain computerized data that you do not own or license, notify the owner or licensee of a breach as soon as reasonably practicable, and no later than 10 days after you discover or are notified of the breach (Com. Law 14-3504(c)).
- Where a law enforcement agency delays that notice to the owner or licensee, notify them as soon as reasonably practicable, and no later than 7 days after the agency determines that notification will not impede a criminal investigation or jeopardize homeland or national security (Com. Law 14-3504(d)).
- Treat biometric data used to uniquely authenticate identity when accessing a system or account, such as a fingerprint, voiceprint, or retina or iris image, as its own triggering data element for this notification duty, separate from a name combined with a Social Security or financial account number.
- Where notification is delayed because a law enforcement agency says it would impede an investigation, notify within 7 days after that delay is cleared, or by the original 45-day deadline, whichever is later.
- Expect a MPIPA violation to be privately actionable. Unlike MODPA, MPIPA's enforcement section does not exclude the Consumer Protection Act's private-action-for-damages provision.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Maryland (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 13-411 of the Commercial Law Article makes a violation of any provision of Title 13 a misdemeanor punishable by a fine not exceeding $1,000 or imprisonment not exceeding one year or both, unless another criminal penalty is specifically provided elsewhere, in addition to civil penalties; section 14-3508 makes a violation of the subtitle subject to the enforcement and penalty provisions of Title 13.
Penalty structure
The highest tier is recorded: up to $25,000 for each subsequent violation of the same kind after a finding of a violation, and up to $10,000 for each first violation. Reached through § 14-3508(2)'s incorporation of Title 13's enforcement and penalty provisions: § 13-410 subjects a merchant who violates Title 13, which a MPIPA breach-notice violation is under § 14-3508(1), to a civil fine of up to $10,000 for each violation, rising to up to $25,000 for each subsequent violation of the same kind. The fines are civil penalties recoverable by the State in a civil action or an administrative cease-and-desist proceeding; the Consumer Protection Division weighs the severity of the violation, the violator's good faith, any history of prior violations, the deterrent effect, and any corrective action taken in setting the amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Who enforces it
Enforcement body
Maryland Attorney General, Division of Consumer Protection, under Title 13's unfair or deceptive trade practice enforcement and penalty provisions, incorporated by § 14-3508
Settledness
- As of
- Guidance link
- https://oag.maryland.gov/i-need-to/Pages/Guidelines-for-Businesses-to-Comply-with-the-Maryland-Personal-Information-Protection-Act.aspx
- Guidance body
- Office of the Attorney General of Maryland
- Open questions
- What degree of probability is a 'likelihood that personal information has been or will be misused' under Md. Code Ann., Com. Law § 14-3504(b), given that the Attorney General's guidance restates the test as 'a reasonable chance'?
- How long may a business delay notice 'to determine the scope of the breach, identify the individuals affected, or restore the integrity of the system' under § 14-3504(d)(1)(ii), when subsection (d)(2) sets an outer limit only for a delay at a law enforcement agency's request?
What it makes you log
What the log must hold
Decision basis
Log retention
Runs from the date the determination that notice is not required is made, and applies only to the records of that determination.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
A business that discovers or is notified of a breach of the security of a system must investigate in good faith and promptly whether personal information of a Maryland resident has been or will be misused. If the investigation ends with a determination that notice to individuals is not required, the business must maintain records that reflect that determination for 3 years after it is made. The records are those of the decision, so the contents are coded as the decision's basis. The section names no regulator access, audit or review of those records. The separate duties to notify individuals (subsections (b) to (g)) and to give the Attorney General advance notice with the number affected, the description, the steps taken and a sample notice (subsection (h)) are notifications, not a record the business keeps. The period is a minimum with no stated maximum. Section 14-3501 is cited by the row, and its definition of business (any business entity) carries no territorial wording, so the hook rests on the residence of the individual in subsection (b)(1).
- Kind
- Explicit
- As of
- Provision
- Md. Code Ann., Com. Law § 14-3504(b)(4)
- Trigger
- security_incident
What this law does
The Maryland Personal Information Protection Act, a separate chapter untouched by MODPA's enactment or later recodification, requires a business that owns, licenses, or maintains computerized data including personal information to notify each affected Maryland individual once it determines a likelihood the breach caused or will cause misuse, as soon as reasonably practicable and no later than 45 days after discovering or being notified of the breach, extended by 7 days after a law-enforcement delay is cleared where that falls later than the original 45-day deadline.
'Personal information' includes biometric data generated by automatic measurement of an individual's biological characteristics, such as a fingerprint, voiceprint, genetic print, or retina or iris image, used to uniquely authenticate identity when accessing a system or account, alongside the more familiar Social Security, driver's license, or financial account number data elements.
MPIPA's own enforcement section, § 14-3508, makes a violation an unfair or deceptive trade practice subject to Title 13's enforcement and penalty provisions, and unlike MODPA's § 14-4713, it does not exclude § 13-408, the Maryland Consumer Protection Act's private-action-for-damages provision, so a MPIPA violation is privately actionable through that route. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .