Law / United States / 
Maryland
Maryland Online Data Privacy Act (MODPA), consumer rights and appeal
Md. Code Ann., Com. Law § 14-4705
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- Give a Maryland consumer a means to confirm whether you process their personal data, access it, correct it, delete it, receive a portable copy, and obtain a list of third-party categories it was disclosed to.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P4
- Offer a Maryland consumer an opt-out of targeted advertising, sale of personal data, and profiling in furtherance of solely automated decisions with legal or similarly significant effects.NIST Privacy FrameworkCT.PO-P3
- Respond to a consumer rights request no later than 45 days after receipt, with one 45-day extension available if you tell the consumer the reason within the initial period, and provide a conspicuous process to appeal a refusal.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Maryland (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx
- Guidance body
- Office of the Attorney General of Maryland
- Open questions
- Does the free response 'once during any 12-month period' in § 14-4705(e)(4) allow one free response per consumer, or one for each consumer right the consumer exercises?
- Within what period after a consumer receives a refusal must a controller's appeal process remain open, given that § 14-4705(f)(1) says only 'a reasonable period'?
What it makes you log
Logging duty
Section 14-4705 gives the consumer rights to confirm, access, correct, delete, port and opt out, and requires a response within 45 days, an appeal process and a written explanation of an appeal outcome within 60 days. A controller that obtained data from another source is deemed to comply with a deletion request by retaining a record of the request and the minimum data needed to keep the data deleted; that is one route to compliance, not a duty, so it is not coded as a record duty. The controller bears the burden of showing a request is manifestly unfounded, excessive or repetitive, which allocates proof about a refusal and is not a record duty. A consumer's right to a list of the categories of third parties receiving data is a right of access, not a log. The section carries no territorial clause, so the hook is left empty.
- Kind
- None
- As of
What this law does
MODPA gives a Maryland consumer the right, exercisable against a controller, to confirm processing, access their personal data, correct inaccuracies, delete data, obtain a portable copy for automated-processing data, obtain a list of categories of third parties their data was disclosed to, and opt out of targeted advertising, sale, or profiling in furtherance of solely automated decisions with legal or similarly significant effects.
A controller must respond within 45 days of receipt, with one 45-day extension available if the controller informs the consumer of the extension and its reason within the initial period, and must establish a conspicuous process to appeal a refusal.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .