Law / United States / 
Maryland
Maryland Online Data Privacy Act (MODPA), publicly available information exemption and biometric carve-back
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- periodic
- Who audits it
- Self, Regulator
- Where the report goes
- Produced on request
What it requires
- Never treat biometric data you collect about a Maryland consumer without that consumer's knowledge as publicly available, even if the source photo or recording appeared on a public page; MODPA's own carve-back excludes it from the exemption regardless.
- Limit any personal data you collect on a Maryland consumer to what is reasonably necessary and proportionate to the specific product or service they requested.
- If you meet MODPA's 35,000-consumer or 10,000-consumer-plus-20%-revenue thresholds, expect enforcement through the enforcement provisions of the Maryland Consumer Protection Act; the Act does not incorporate that Act's private action for damages.
These lines are LexLint's reading of the law's text. Also read by: Office of the Maryland Attorney General (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://oag.maryland.gov/Resources-Info/Pages/data-privacy.aspx
- Guidance body
- Office of the Maryland Attorney General
- Open questions
- When a business scrapes a photograph that a consumer posted publicly, is the face geometry it computes from the photograph 'biometric data collected by a business about a consumer without the consumer's knowledge' under MODPA's definition of publicly available information?
- What facts show that a controller 'reasonably believes' that a consumer or widely distributed media 'lawfully made available' information to the general public when the page's terms prohibit automated collection?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment, on a regular basis, for each heightened-risk processing activity (targeted advertising, sale, sensitive data, and profiling that presents a foreseeable risk of harm), including each algorithm used. The assessment weighs the benefits of the processing against the risks to the consumer, which cannot be shown without a written record, and the Consumer Protection Division may require a controller to make a relevant assessment available in an investigation and may evaluate it for compliance. Section 14-4605 treats a controller that obtained data from a source other than the consumer as compliant with a deletion request by retaining a record of the request, which is an option and not a duty, and section 14-4608 has the processor allow and cooperate with the controller's assessments and report on request. The Act sets no retention period and no log contents, so no retention value is recorded.
- Kind
- Implicit
- As of
- Provision
- Md. Code Com. Law section 14-4610(b) as originally enacted (a controller conducts and documents, on a regular basis, a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer) and 14-4610(d)(1) (the Division may require the assessment to be made available)
- Trigger
- personal_data_processing
What this law does
MODPA excludes publicly available information from personal data, defined to mean information that a person lawfully obtains from a record of a governmental entity, reasonably believes a consumer or widely distributed media have lawfully made available to the general public, or, if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed it.
The definition carries an express carve-back: publicly available information does not include biometric data collected by a business about a consumer without the consumer's knowledge, so a scraper harvesting public biometric identifiers, such as faces from public photos for facial-recognition purposes, cannot rely on the publicly-available exemption in Maryland, although a photograph is not itself biometric data.
MODPA also requires a controller to limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains.
The Act applies to a controller conducting business in Maryland, or targeting Maryland residents, that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), or of at least 10,000 consumers while deriving more than 20% of gross revenue from personal-data sales. As enacted, the chapter was codified at Com. Law section 14-4601 et seq.
Section 14-4601 is now an unrelated Forensic Nurse Examiner Training Grant Program provision. Section 14-4701 carries this Act's own definitions and cross-references its consumer-rights section at section 14-4705, so section 14-4701 et seq. is the current citation of the Act. The Act's own enactment clause states it shall take effect , correcting an earlier drafting date.
Enforcement runs through the enforcement and penalty provisions of Title 13 of the Commercial Law Article (the Maryland Consumer Protection Act), except for section 13-408. Section 13-408, which the Act excludes, is the Consumer Protection Act's section allowing any person to bring an action to recover for injury or loss.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .