Law / United States / 
Maryland
Maryland Online Data Privacy Act (MODPA), Attorney General enforcement and cure period
Md. Code Ann., Com. Law §§ 14-4713, 14-4714
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect MODPA violations to be enforced exclusively by the Maryland Attorney General's Division of Consumer Protection under Title 13's unfair, abusive, or deceptive trade practice machinery, never by a private plaintiff. MODPA expressly excludes Title 13's private-action-for-damages provision, section 13-408, from its enforcement scheme.
- Do not rely on an unconditional right to cure. The Division may, at its discretion, issue a notice of violation and give at least 60 days to cure only where it determines a cure is possible, and this mechanism applies only to a violation occurring on or before .
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Maryland (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx
- Guidance body
- Office of the Attorney General of Maryland
- Open questions
- Will the Division treat a violation as one for which 'a cure is possible' under § 14-4714(b) when the personal data has already been sold or disclosed to a third party?
- Does § 14-4713(b), which says the section 'does not prevent a consumer from pursuing any other remedy provided by law', let a consumer sue under another statute for conduct that violates MODPA, even though § 14-4713(a)(2) excludes § 13-408?
What it makes you log
Logging duty
Section 14-4713 makes a violation of the subtitle an unfair, abusive or deceptive trade practice enforced under Title 13 of the Commercial Law Article (except section 13-408), and section 14-4714 lets the Division issue a notice of violation and gives the controller or processor at least 60 days to cure for violations on or before . A notice of violation and a cure period are steps in enforcement; neither requires the controller to keep a record or log. The enforcement sections carry no territorial clause, so the hook is left empty.
- Kind
- None
- As of
What this law does
A MODPA violation is an unfair, abusive, or deceptive trade practice enforced under the Maryland Consumer Protection Act's (Title 13) machinery, except that MODPA expressly excludes section 13-408, the Consumer Protection Act's private-action-for-damages provision, from its enforcement scheme, so a MODPA violation is not independently privately actionable through that route.
Section 14-4713(b) preserves any other remedy provided by law as a savings clause, not a grant of a private cause of action. Before initiating an enforcement action for a violation occurring on or before , the Division of Consumer Protection may, in its discretion, issue a notice of violation where it determines a cure is possible, giving the controller or processor at least 60 days to cure; there is no unconditional right to cure, and this mechanism itself sunsets.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .