Law / United States / 
Maryland
Maryland Genetic Information Privacy Act and Online Data Privacy Act, deidentified data
Md. Code Ann., Com. Law §§ 14-4401(c) and (g)(3) (Title 14, Subtitle 44)
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To keep data outside the Genetic Information Privacy Act's definition of genetic data, make sure it cannot reasonably be used to infer information about a consumer or linked to an identifiable consumer (Com. Law 14-4401(c)(1) and (g)(3)).
- Subject the data to administrative and technical measures to ensure that it cannot be associated with a particular consumer (Com. Law 14-4401(c)(2)(i)).
- Publicly commit to maintain and use the data in a deidentifiable form and not to attempt to reidentify it (Com. Law 14-4401(c)(2)(ii)).
- Bind each recipient of the data by legally enforceable contractual obligations that prohibit the recipient from attempting to reidentify it (Com. Law 14-4401(c)(2)(iii)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 13-411 of the Commercial Law Article makes a violation of any provision of Title 13 a misdemeanor punishable by a fine not exceeding $1,000 or imprisonment not exceeding one year or both, unless another criminal penalty is specifically provided elsewhere, in addition to civil penalties.
Penalty structure
Section 13-410 subjects a merchant who violates Title 13 to a fine not exceeding $25,000 for each subsequent repeat of the same violation after a finding of a violation, and to a fine not exceeding $10,000 for each violation before that.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Who enforces it
Enforcement body
Maryland Attorney General, Consumer Protection Division, under the enforcement and penalty provisions of Title 13 of the Commercial Law Article; an individual who sustains injury or loss may sue under section 13-408.
Settledness
- As of
What it makes you log
Logging duty
Section 14-4401(c) states the conditions for treating data as deidentified. It states no log or record duty.
- Kind
- None
- As of
What this law does
Section 14-4401(c) of the Commercial Law Article defines deidentified data as data that cannot reasonably be used to infer information about a consumer or linked to an identifiable consumer and that is subject to administrative and technical measures to ensure that it cannot be associated with a particular consumer, a public commitment by the company to maintain and use it in a deidentifiable form and not attempt to reidentify it, and legally enforceable contractual obligations that prohibit a recipient from attempting to reidentify it.
Section 14-4401(g)(3) provides that genetic data does not include deidentified data. The Maryland Online Data Privacy Act gives de-identified data the meaning stated in section 14-4401 of the Commercial Law Article. The Maryland Online Data Privacy Act excludes de-identified data from the personal data it governs.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .