Law / United States / 
Maryland
Maryland Online Data Privacy Act (MODPA), data protection assessments
Md. Code Ann., Com. Law § 14-4710
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document, on a regular basis, a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, including an assessment for each algorithm that you use.
- Treat targeted advertising, the sale of personal data, the processing of sensitive data and profiling that presents a reasonably foreseeable risk of unfair, abusive or deceptive treatment, an unlawful disparate impact, injury, an offensive intrusion or other substantial injury to a consumer as processing that presents a heightened risk of harm.
- Make each assessment weigh the benefits of the processing against the risks to the consumer's rights as mitigated by safeguards, and against the necessity and proportionality of the processing in relation to its stated purpose.
- Make an assessment available to the Division when it requires one that is relevant to an investigation.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document, on a regular basis, a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, including each algorithm used (14-4710(b)), and the assessment must weigh the benefits of the processing against the risks to the consumer's rights and the necessity and proportionality of the processing (14-4710(c)). The Division may require a controller to make an assessment available to it when relevant to an investigation and may evaluate it for compliance (14-4710(d)); the section refers only to the Division and does not define it. "On a regular basis" is the controller's own cadence and sets no fixed interval, and the section sets no period for keeping an assessment. The section has no scope clause; the reach and the consumer definition are in 14-4701 and 14-4702, which the scope row cites.
- Kind
- Explicit
- As of
- Provision
- Md. Code Ann., Com. Law 14-4710(b), (c) and (d)(1)
- Trigger
- personal_data_processing
What this law does
MODPA requires a controller to conduct and document, on a regular basis, a data protection assessment for each of its processing activities that present a heightened risk of harm to a consumer, including an assessment for each algorithm that is used.
The activities that present a heightened risk of harm are targeted advertising, the sale of personal data, the processing of sensitive data, and profiling that presents a reasonably foreseeable risk of unfair, abusive or deceptive treatment, an unlawful disparate impact, injury, an offensive intrusion or other substantial injury to a consumer.
Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other interested parties and the public against the potential risks to the rights of the consumer and the necessity and proportionality of the processing in relation to its stated purpose.
The Division may require a controller to make available to the Division an assessment that is relevant to an investigation, may evaluate it for compliance, and the controller's assessment may be used in an action to enforce the subtitle. An assessment is confidential and exempt from disclosure under the federal Freedom of Information Act or the Public Information Act. The section applies to processing activities that occur on or after .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or makes high-risk automated decisions.