MD. SB 613. Consumer Personal Information Privacy.

From Privacy Wiki
Jump to navigation Jump to search
MD. SB 613. Consumer Personal Information Privacy.
Short Title
Official Text MD. SB 613. Consumer Personal Information Privacy.
Country/Jurisdiction United States
State or Province Maryland
Regulatory Bodies
Date Enacted 2021
Scope of the Law General Business
Information
Taxonomy Aggregation, Decisional Interference, Exclusion, Identification, Insecurity, Interrogation, Secondary Use, Surveillance
Strategies


Text of the law

SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, That the Laws of Maryland read as follows:
Article – Commercial Law
SUBTITLE 42. CONSUMER PERSONAL INFORMATION PRIVACY.
14–4201.
(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS INDICATED.
(B) (1) “AGGREGATE CONSUMER INFORMATION” MEANS INFORMATION THAT RELATES TO A GROUP OR CATEGORY OF CONSUMERS, FROM WHICH INDIVIDUAL CONSUMER IDENTITIES HAVE BEEN REMOVED, THAT IS NOT LINKED OR REASONABLY LINKABLE TO ANY CONSUMER, INCLUDING THROUGH A DEVICE. Aggregation
(2) “AGGREGATE CONSUMER INFORMATION” DOES NOT INCLUDE AN INDIVIDUAL CONSUMER RECORD THAT HAS BEEN DE–IDENTIFIED.
(C) (1) “BIOMETRIC INFORMATION” MEANS AN INDIVIDUAL’S PHYSIOLOGICAL, BIOLOGICAL, OR BEHAVIORAL CHARACTERISTICS, INCLUDING AN INDIVIDUAL’S DEOXYRIBONUCLEIC ACID, THAT CAN BE USED, ALONE OR IN COMBINATION WITH EACH OTHER OR WITH OTHER IDENTIFYING DATA, TO ESTABLISH INDIVIDUAL IDENTITY.
(2) “BIOMETRIC INFORMATION” INCLUDES:
(I) IMAGERY OF THE IRIS, RETINA, FINGERPRINT, FACE, HAND, PALM, AND VEIN PATTERNS, AND VOICE RECORDINGS FROM WHICH AN IDENTIFIED TEMPLATE, SUCH AS A FACE PRINT, A MINUTIAE TEMPLATE, OR A VOICEPRINT, CAN BE EXTRACTED; AND
(II) KEYSTROKE PATTERNS OR RHYTHMS, GAIT PATTERNS OR RHYTHMS, AND SLEEP, HEALTH, OR EXERCISE DATA THAT CONTAIN IDENTIFYING INFORMATION.
(D) “BUSINESS” MEANS:
(1) A SOLE PROPRIETORSHIP, A PARTNERSHIP, A LIMITED LIABILITY COMPANY, A CORPORATION, AN ASSOCIATION, OR ANY OTHER LEGAL ENTITY THAT:
(I) IS ORGANIZED OR OPERATED FOR THE PROFIT OR FINANCIAL BENEFIT OF ITS SHAREHOLDERS OR OTHER OWNERS;
(II) COLLECTS THE PERSONAL INFORMATION OF STATE CONSUMERS; AND
(III) SATISFIES ONE OR MORE OF THE FOLLOWING THRESHOLDS:
1. HAS ANNUAL GROSS REVENUES IN EXCESS OF $25,000,000;
2. ANNUALLY BUYS, RECEIVES FOR THE BUSINESS’S COMMERCIAL PURPOSES, SELLS, OR SHARES FOR COMMERCIAL PURPOSES, ALONE OR IN COMBINATION, THE PERSONAL INFORMATION OF 100,000 OR MORE CONSUMERS, HOUSEHOLDS, OR DEVICES; OR
3. DERIVES AT LEAST ONE–HALF OF ITS ANNUAL REVENUES FROM SELLING CONSUMERS’ PERSONAL INFORMATION; OR
(2) ANY ENTITY THAT:
(I) CONTROLS OR IS CONTROLLED BY A BUSINESS UNDER ITEM (1) OF THIS SUBSECTION; AND
(II) SHARES A NAME, SERVICE MARK, OR TRADEMARK WITH THE BUSINESS.
(E) “BUSINESS PURPOSE” MEANS THE REASON FOR THE USE OF PERSONAL INFORMATION BY A BUSINESS OR A SERVICE PROVIDER.
(F) (1) “COLLECT” MEANS TO BUY, RENT, GATHER, OBTAIN, RECEIVE, OR ACCESS ANY PERSONAL INFORMATION PERTAINING TO A CONSUMER BY ANY MEANS.
(2) “COLLECT” INCLUDES TO RECEIVE INFORMATION FROM THE CONSUMER, EITHER ACTIVELY OR PASSIVELY, OR BY OBSERVING THE CONSUMER’S BEHAVIOR.
(G) “CONSUMER” MEANS AN INDIVIDUAL WHO RESIDES IN THE STATE.
(H) “DE–IDENTIFIED” MEANS, WITH RESPECT TO INFORMATION, PROCESSED SO THAT THE INFORMATION CANNOT REASONABLY IDENTIFY, RELATE TO, DESCRIBE, BE CAPABLE OF BEING ASSOCIATED WITH, OR BE LINKED, DIRECTLY OR INDIRECTLY, TO A PARTICULAR CONSUMER, IF A BUSINESS THAT USES DE–IDENTIFIED INFORMATION:
(1) HAS IMPLEMENTED TECHNICAL SAFEGUARDS THAT PROHIBIT RE–IDENTIFICATION OF THE CONSUMER TO WHOM THE INFORMATION MAY PERTAIN;
(2) HAS IMPLEMENTED BUSINESS PROCESSES THAT SPECIFICALLY PROHIBIT RE–IDENTIFICATION OF THE INFORMATION;
(3) HAS IMPLEMENTED BUSINESS PROCESSES TO PREVENT INADVERTENT RELEASE OF DE–IDENTIFIED INFORMATION; AND
(4) MAKES NO ATTEMPT TO RE–IDENTIFY THE INFORMATION.
(I) (1) “DESIGNATED METHOD FOR SUBMITTING REQUESTS” MEANS A MAILING ADDRESS, AN E–MAIL ADDRESS, AN INTERNET WEBSITE, AN INTERNET PORTAL, A TELEPHONE NUMBER, OR ANY OTHER APPLICABLE CONTACT INFORMATION THROUGH WHICH A CONSUMER MAY SUBMIT A REQUEST OR DIRECTION UNDER THIS SUBTITLE.
(2) “DESIGNATED METHOD FOR SUBMITTING REQUESTS” INCLUDES A CONSUMER–FRIENDLY MEANS OF CONTACTING A BUSINESS APPROVED BY THE ATTORNEY GENERAL UNDER § 14–4211(A)(4) OF THIS SUBTITLE.
(J) “DEVICE” MEANS A PHYSICAL OBJECT THAT IS CAPABLE OF CONNECTING TO THE INTERNET, DIRECTLY OR INDIRECTLY, OR TO ANOTHER DEVICE.
(K) “HOMEPAGE” MEANS:
(1) THE INTRODUCTORY PAGE OF AN INTERNET WEBSITE AND ANY INTERNET WEBPAGE WHERE PERSONAL INFORMATION IS COLLECTED; OR
(2) IN THE CASE OF AN ONLINE SERVICE OR APPLICATION:
(I) THE SERVICE OR APPLICATION PLATFORM PAGE OR DOWNLOAD PAGE;
(II) A LINK WITHIN THE SERVICE OR APPLICATION, SUCH AS FROM THE SERVICE OR APPLICATION CONFIGURATION, “ABOUT”, “INFORMATION”, OR SETTINGS PAGE; OR
(III) ANY OTHER LOCATION THAT ALLOWS A CONSUMER TO REVIEW THE NOTICE REQUIRED BY § 14–4202(A) OF THIS SUBTITLE, WHETHER BEFORE OR AFTER DOWNLOADING THE APPLICATION OR SERVICE.
(L) “INFER” MEANS TO DERIVE INFORMATION, DATA, ASSUMPTIONS, OR CONCLUSIONS FROM FACTS, EVIDENCE, OR ANOTHER SOURCE OF INFORMATION OR DATA.
(M) (1) “PERSONAL INFORMATION” MEANS INFORMATION RELATING TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER AND INFORMATION THAT IDENTIFIES, RELATES TO, DESCRIBES, IS CAPABLE OF BEING ASSOCIATED WITH, OR COULD REASONABLY BE LINKED, DIRECTLY OR INDIRECTLY, WITH A PARTICULAR CONSUMER OR THE CONSUMER’S DEVICE.
(2) “PERSONAL INFORMATION” DOES NOT INCLUDE:
(I) INFORMATION THAT IS LAWFULLY MADE AVAILABLE FROM FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS; OR
(II) CONSUMER INFORMATION THAT IS DE–IDENTIFIED OR AGGREGATE CONSUMER INFORMATION.
(N) “PROBABILISTIC IDENTIFIER” MEANS THE IDENTIFICATION OF A CONSUMER OR A DEVICE TO A DEGREE OF CERTAINTY OF MORE PROBABLE THAN NOT BASED ON ANY CATEGORIES OF PERSONAL INFORMATION INCLUDED IN, OR SIMILAR TO, THE CATEGORIES LISTED IN SUBSECTION (M) OF THIS SECTION.
(O) “PROCESSING” MEANS AN OPERATION OR A SET OF OPERATIONS THAT IS PERFORMED ON PERSONAL DATA OR ON SETS OF PERSONAL DATA, WHETHER OR NOT BY AUTOMATED MEANS.
(P) “PSEUDONYMIZE” MEANS THE PROCESSING OF PERSONAL INFORMATION IN A MANNER THAT RENDERS THE PERSONAL INFORMATION NO LONGER ATTRIBUTABLE TO A SPECIFIC CONSUMER WITHOUT THE USE OF ADDITIONAL INFORMATION IF THE ADDITIONAL INFORMATION IS KEPT SEPARATELY AND IS SUBJECT TO TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THAT THE PERSONAL INFORMATION IS NOT ATTRIBUTED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER.
(Q) “RESEARCH” MEANS SCIENTIFIC, SYSTEMATIC STUDY AND OBSERVATION, INCLUDING BASIC RESEARCH OR APPLIED RESEARCH THAT IS IN THE PUBLIC INTEREST AND THAT ADHERES TO ALL OTHER APPLICABLE ETHICS AND PRIVACY LAWS OR STUDIES CONDUCTED IN THE PUBLIC INTEREST IN THE AREA OF PUBLIC HEALTH.
(R) “SERVICE” MEANS WORK, LABOR, AND SERVICES, INCLUDING SERVICES FURNISHED IN CONNECTION WITH THE SALE OR REPAIR OF GOODS.
(S) “SERVICE PROVIDER” MEANS A PERSON THAT PROCESSES INFORMATION ON BEHALF OF A BUSINESS AND TO WHICH THE BUSINESS DISCLOSES A CONSUMER’S PERSONAL INFORMATION FOR A BUSINESS PURPOSE IN ACCORDANCE WITH A WRITTEN CONTRACT IF THE CONTRACT PROHIBITS THE ENTITY RECEIVING THE INFORMATION FROM RETAINING, USING, OR DISCLOSING THE PERSONAL INFORMATION FOR ANY PURPOSE OTHER THAN FOR THE SPECIFIC PURPOSE OF PERFORMING THE SERVICES SPECIFIED IN THE CONTRACT FOR THE BUSINESS, OR AS OTHERWISE ALLOWED BY THIS SUBTITLE.
(T) “THIRD PARTY” MEANS A PERSON THAT IS NOT THE BUSINESS THAT COLLECTS PERSONAL INFORMATION FROM CONSUMERS UNDER THIS SUBTITLE OR A SERVICE PROVIDER OF THAT BUSINESS.
(U) (1) “THIRD–PARTY DISCLOSURE” MEANS A TRANSFER OF A CONSUMER’S PERSONAL INFORMATION BY THE BUSINESS TO A THIRD PARTY, INCLUDING SELLING, RENTING, RELEASING, DISSEMINATING, MAKING AVAILABLE, TRANSFERRING, OR OTHERWISE COMMUNICATING ORALLY, IN WRITING, OR BY ELECTRONIC OR OTHER MEANS.
(2) “THIRD–PARTY DISCLOSURE” DOES NOT INCLUDE:
(I) A DISCLOSURE BY A BUSINESS OF PERSONAL INFORMATION OF A CONSUMER TO A SERVICE PROVIDER THAT IS NECESSARY TO THE PERFORMANCE OF A BUSINESS PURPOSE INCLUDED IN A NOTICE UNDER § 14–4202 OF THIS SUBTITLE;
(II) IDENTIFICATION BY A BUSINESS OF A CONSUMER WHO HAS OPTED OUT OF THE SALE OF THE CONSUMER’S PERSONAL INFORMATION FOR THE PURPOSE OF ALERTING THIRD PARTIES THAT THE CONSUMER HAS OPTED OUT OF THE SALE OF THE CONSUMER’S PERSONAL INFORMATION; OR
(III) THE TRANSFER BY A BUSINESS TO A THIRD PARTY OF THE PERSONAL INFORMATION OF A CONSUMER AS AN ASSET THAT IS PART OF A MERGER, AN ACQUISITION, A BANKRUPTCY, OR ANY OTHER TRANSACTION IN WHICH THE THIRD PARTY ASSUMES CONTROL OF ALL OR PART OF THE BUSINESS IF THAT INFORMATION IS USED OR SHARED CONSISTENTLY WITH THE NOTICE RECEIVED BY CONSUMERS UNDER § 14–4202 OF THIS SUBTITLE.
(V) “UNIQUE IDENTIFIER” MEANS A PERSISTENT IDENTIFIER THAT CAN BE USED TO RECOGNIZE A CONSUMER OR A DEVICE THAT IS LINKED TO A CONSUMER OR HOUSEHOLD, OVER TIME AND ACROSS DIFFERENT SERVICES, INCLUDING:
(1) A DEVICE IDENTIFIER;
(2) AN INTERNET PROTOCOL ADDRESS;
(3) A COOKIE, BEACON, PIXEL TAG, MOBILE AD IDENTIFIER, OR SIMILAR TECHNOLOGY;
(4) A CONSUMER NUMBER, UNIQUE PSEUDONYM, OR USER ALIAS; OR
(5) A TELEPHONE NUMBER OR ANY OTHER FORM OF PERSISTENT OR PROBABILISTIC IDENTIFIER THAT CAN BE USED TO IDENTIFY A PARTICULAR CONSUMER OR DEVICE.
14–4202. Exclusion
(A) A BUSINESS THAT COLLECTS A CONSUMER’S PERSONAL INFORMATION SHALL, AT OR BEFORE THE POINT OF COLLECTION, NOTIFY A CONSUMER OF:
(1) THE CATEGORIES OF PERSONAL INFORMATION THE BUSINESS WILL COLLECT ABOUT THAT CONSUMER;
(2) THE BUSINESS PURPOSES FOR WHICH THE CATEGORIES OF PERSONAL INFORMATION MAY BE USED;
(3) THE CATEGORIES OF THIRD PARTIES TO WHICH THE BUSINESS DISCLOSES PERSONAL INFORMATION;
(4) THE BUSINESS PURPOSE FOR THIRD–PARTY DISCLOSURE; AND
(5) THE CONSUMER’S RIGHTS TO REQUEST:
(I) A COPY OF THE CONSUMER’S PERSONAL INFORMATION UNDER § 14–4203 OF THIS SUBTITLE;
(II) THE DELETION OF THE CONSUMER’S PERSONAL INFORMATION UNDER § 14–4205 OF THIS SUBTITLE; AND
(III) TO OPT OUT OF THIRD–PARTY DISCLOSURE UNDER § 14–4206 OF THIS SUBTITLE.
(B) A BUSINESS MAY NOT COLLECT ADDITIONAL CATEGORIES OF PERSONAL INFORMATION OR USE PERSONAL INFORMATION COLLECTED FOR ADDITIONAL PURPOSES WITHOUT FIRST PROVIDING THE CONSUMER WITH NOTICE CONSISTENT WITH THIS SECTION.
14–4203.
(A) A CONSUMER MAY REQUEST THAT A BUSINESS THAT COLLECTS A CONSUMER’S PERSONAL INFORMATION DISCLOSE TO THAT CONSUMER:
(1) THE SPECIFIC PIECES OF PERSONAL INFORMATION THE BUSINESS HAS COLLECTED ABOUT THAT CONSUMER;
(2) THE SOURCES FROM WHICH THE CONSUMER’S PERSONAL INFORMATION WAS COLLECTED;
(3) THE NAMES OF THIRD PARTIES TO WHICH THE BUSINESS DISCLOSED THE CONSUMER’S PERSONAL INFORMATION; AND
(4) THE BUSINESS PURPOSE FOR THIRD–PARTY DISCLOSURE.
(B) A BUSINESS SHALL PROVIDE THE INFORMATION SPECIFIED IN SUBSECTION (A) OF THIS SECTION TO A CONSUMER ONLY ON RECEIPT OF A VERIFIABLE CONSUMER REQUEST.
(C) (1) A BUSINESS THAT RECEIVES A VERIFIABLE CONSUMER REQUEST FROM A CONSUMER TO ACCESS PERSONAL INFORMATION SHALL PROMPTLY TAKE STEPS TO DELIVER, FREE OF CHARGE TO THE CONSUMER, THE PERSONAL INFORMATION REQUIRED BY THIS SECTION.
(2) THE INFORMATION MAY BE DELIVERED BY MAIL OR ELECTRONICALLY, AND IF PROVIDED ELECTRONICALLY, THE INFORMATION SHALL BE IN A PORTABLE AND, TO THE EXTENT TECHNICALLY FEASIBLE, READILY USEABLE FORMAT THAT ALLOWS THE CONSUMER TO TRANSMIT THIS INFORMATION TO ANOTHER ENTITY WITHOUT HINDRANCE.
(D) A BUSINESS MAY PROVIDE PERSONAL INFORMATION TO A CONSUMER AT ANY TIME, NOTWITHSTANDING § 14–4204 OF THIS SUBTITLE, BUT MAY NOT BE REQUIRED TO PROVIDE PERSONAL INFORMATION TO THE SAME CONSUMER MORE THAN TWICE IN A 12–MONTH PERIOD.
(E) THIS SECTION MAY NOT REQUIRE A BUSINESS TO:
(1) RETAIN ANY PERSONAL INFORMATION ABOUT A CONSUMER COLLECTED FOR A SINGLE ONE–TIME TRANSACTION IF, IN THE ORDINARY COURSE OF BUSINESS, THAT INFORMATION ABOUT THE CONSUMER IS NOT RETAINED;
(2) RE–IDENTIFY OR OTHERWISE LINK ANY DATA THAT, IN THE ORDINARY COURSE OF BUSINESS, IS NOT MAINTAINED IN A MANNER THAT WOULD BE CONSIDERED PERSONAL INFORMATION; OR
(3) DISCLOSE ANY SPECIFIC PERSONAL INFORMATION THAT WOULD ADVERSELY AFFECT THE LEGAL RIGHTS OF OTHER CONSUMERS.
(F) IF VERIFIED REQUESTS FROM A CONSUMER ARE MANIFESTLY UNFOUNDED OR EXCESSIVE, IN PARTICULAR BECAUSE OF THEIR REPETITIVE CHARACTER, A BUSINESS MAY EITHER CHARGE A REASONABLE FEE, TAKING INTO ACCOUNT THE ADMINISTRATIVE COSTS OF PROVIDING THE INFORMATION OR COMMUNICATION OR TAKING THE ACTION REQUESTED, OR REFUSE TO ACT ON THE REQUEST AND NOTIFY THE CONSUMER OF THE REASON FOR REFUSING THE REQUEST.
14–4204.
(A) (1) A BUSINESS SHALL, IN A FORM THAT IS REASONABLY ACCESSIBLE TO CONSUMERS, MAKE AVAILABLE TO CONSUMERS TWO OR MORE DESIGNATED METHODS FOR SUBMITTING CONSUMER VERIFIED REQUESTS, INCLUDING, IF THE BUSINESS MAINTAINS AN INTERNET WEBSITE, A LINK ON THE HOMEPAGE OF THE WEBSITE.
(2) A BUSINESS MAY NOT REQUIRE THE CONSUMER TO CREATE AN ACCOUNT WITH THE BUSINESS IN ORDER TO MAKE A VERIFIABLE CONSUMER REQUEST.
(B) (1) A BUSINESS SHALL DELIVER TO A CONSUMER FREE OF CHARGE WITHIN 45 DAYS AFTER RECEIVING A VERIFIABLE CONSUMER REQUEST FROM THE CONSUMER THE INFORMATION REQUIRED IN § 14–4203 OF THIS SUBTITLE IN A READILY USEABLE FORMAT THAT ALLOWS THE CONSUMER TO TRANSMIT THE INFORMATION FROM ONE ENTITY TO ANOTHER ENTITY WITHOUT HINDRANCE.
(2) THE TIME PERIOD TO PROVIDE THE REQUIRED INFORMATION MAY BE EXTENDED ONCE BY UP TO AN ADDITIONAL 45 DAYS WHEN REASONABLY NECESSARY, IF THE CONSUMER IS PROVIDED NOTICE OF THE EXTENSION WITHIN THE FIRST 45–DAY PERIOD.
(C) A BUSINESS IS NOT REQUIRED TO PROVIDE THE INFORMATION REQUIRED BY § 14–4203 OF THIS SUBTITLE TO THE SAME CONSUMER MORE THAN TWICE IN A 12–MONTH PERIOD.
(D) A BUSINESS SHALL INCLUDE THE FOLLOWING INFORMATION IN ITS ONLINE PRIVACY POLICY IF THE BUSINESS HAS AN ONLINE PRIVACY POLICY, OR IF THE BUSINESS DOES NOT MAINTAIN A POLICY, ON ITS INTERNET WEBSITE, AND UPDATE THAT INFORMATION AT LEAST ONCE EVERY 12 MONTHS:
(1) THE CATEGORIES OF PERSONAL INFORMATION THE BUSINESS COLLECTS ABOUT CONSUMERS;
(2) THE BUSINESS PURPOSES FOR WHICH THE CATEGORIES OF PERSONAL INFORMATION ARE USED;
(3) THE CATEGORIES OF THIRD PARTIES TO WHICH THE BUSINESS DISCLOSES PERSONAL INFORMATION;
(4) THE BUSINESS PURPOSE FOR THIRD–PARTY DISCLOSURE; AND
(5) THE CONSUMER’S RIGHTS TO REQUEST:
(I) A COPY OF THE CONSUMER’S PERSONAL INFORMATION IN ACCORDANCE WITH § 14–4203 OF THIS SUBTITLE;
(II) THE DELETION OF THE CONSUMER’S PERSONAL INFORMATION IN ACCORDANCE WITH § 14–4205 OF THIS SUBTITLE; AND
(III) TO OPT OUT OF THIRD–PARTY DISCLOSURE IN ACCORDANCE WITH § 14–4206 OF THIS SUBTITLE.
(E) A BUSINESS SHALL ENSURE THAT ALL INDIVIDUALS RESPONSIBLE FOR HANDLING CONSUMER INQUIRIES ABOUT THE BUSINESS’S PRIVACY PRACTICES OR THE BUSINESS’S COMPLIANCE WITH THIS SUBTITLE ARE INFORMED OF ALL REQUIREMENTS IN THIS SUBTITLE AND HOW TO DIRECT CONSUMERS TO EXERCISE THEIR RIGHTS.
(F) A BUSINESS SHALL USE ANY PERSONAL INFORMATION COLLECTED FROM THE CONSUMER IN CONNECTION WITH THE BUSINESS’S VERIFICATION OF THE CONSUMER’S REQUEST SOLELY FOR THE PURPOSES OF VERIFICATION.
14–4205.
(A) A CONSUMER MAY REQUEST THAT A BUSINESS DELETE ANY PERSONAL INFORMATION ABOUT THE CONSUMER THAT THE BUSINESS HAS COLLECTED FROM THE CONSUMER.
(B) A BUSINESS THAT COLLECTS PERSONAL INFORMATION ABOUT CONSUMERS SHALL DISCLOSE, IN ACCORDANCE WITH § 14–4202 OF THIS SUBTITLE, THE CONSUMER’S RIGHTS TO REQUEST THE DELETION OF THE CONSUMER’S PERSONAL INFORMATION.
(C) A BUSINESS THAT RECEIVES A VERIFIABLE CONSUMER REQUEST FROM A CONSUMER TO DELETE THE CONSUMER’S PERSONAL INFORMATION IN ACCORDANCE WITH SUBSECTION (A) OF THIS SECTION SHALL DELETE THE CONSUMER’S PERSONAL INFORMATION FROM ITS RECORDS AND DIRECT ANY SERVICE PROVIDERS TO DELETE THE CONSUMER’S PERSONAL INFORMATION FROM THE SERVICE PROVIDERS’ RECORDS. Decisional Interference
(D) A BUSINESS OR A SERVICE PROVIDER MAY NOT BE REQUIRED TO COMPLY WITH A CONSUMER’S REQUEST TO DELETE THE CONSUMER’S PERSONAL INFORMATION IF IT IS NECESSARY FOR THE BUSINESS OR SERVICE PROVIDER TO MAINTAIN THE CONSUMER’S PERSONAL INFORMATION IN ORDER TO:
(1) COMPLETE THE TRANSACTION FOR WHICH THE PERSONAL INFORMATION WAS COLLECTED, PROVIDE A GOOD OR SERVICE REQUESTED BY THE CONSUMER OR REASONABLY ANTICIPATED WITHIN THE CONTEXT OF A BUSINESS’S ONGOING BUSINESS RELATIONSHIP WITH THE CONSUMER, OR OTHERWISE PERFORM A CONTRACT BETWEEN THE BUSINESS AND THE CONSUMER;
(2) DETECT SECURITY INCIDENTS, PROTECT AGAINST MALICIOUS, DECEPTIVE, FRAUDULENT, OR ILLEGAL ACTIVITY, OR PROSECUTE THOSE RESPONSIBLE FOR THAT ACTIVITY;
(3) IDENTIFY OR REPAIR ERRORS THAT IMPAIR EXISTING INTENDED FUNCTIONALITY;
(4) EXERCISE FREE SPEECH, ENSURE THE RIGHT OF ANOTHER CONSUMER TO EXERCISE THE RIGHT OF FREE SPEECH, OR EXERCISE ANOTHER RIGHT PROVIDED FOR BY LAW;
(5) ENGAGE IN PUBLIC OR PEER–REVIEWED SCIENTIFIC, HISTORICAL, OR STATISTICAL RESEARCH IN THE PUBLIC INTEREST THAT ADHERES TO ALL OTHER APPLICABLE ETHICS AND PRIVACY LAWS, WHEN THE BUSINESSES’ DELETION OF THE INFORMATION IS LIKELY TO RENDER IMPOSSIBLE OR TO SERIOUSLY IMPAIR THE ACHIEVEMENT OF THE RESEARCH, IF THE CONSUMER HAS PROVIDED INFORMED CONSENT; OR
(6) COMPLY WITH A LEGAL OBLIGATION.
14–4206.
(A) (1) A CONSUMER MAY, AT ANY TIME, DEMAND THAT A BUSINESS NOT DISCLOSE THE CONSUMER’S PERSONAL INFORMATION TO THIRD PARTIES.
(2) THIS RIGHT MAY BE REFERRED TO AS THE “RIGHT TO OPT OUT OF THIRD–PARTY DISCLOSURE”.
(B) NOTWITHSTANDING SUBSECTION (A) OF THIS SECTION, A BUSINESS MAY NOT DISCLOSE THE PERSONAL INFORMATION OF A CONSUMER TO A THIRD PARTY IF THE BUSINESS HAS ACTUAL KNOWLEDGE OR WILLFULLY DISREGARDS THE FACT THAT THE CONSUMER IS UNDER THE AGE OF 18 YEARS.
(C) (1) A BUSINESS THAT HAS RECEIVED DIRECTION FROM A CONSUMER NOT TO DISCLOSE THE CONSUMER’S PERSONAL INFORMATION TO THIRD PARTIES MAY NOT DISCLOSE THE CONSUMER’S PERSONAL INFORMATION TO THIRD PARTIES UNLESS THE CONSUMER LATER PROVIDES EXPRESS AUTHORIZATION FOR THAT DISCLOSURE.
(2) A BUSINESS THAT HAS RECEIVED DIRECTION FROM A CONSUMER NOT TO DISCLOSE THE CONSUMER’S PERSONAL INFORMATION TO THIRD PARTIES MAY NOT REQUEST AUTHORIZATION TO DISCLOSE THE CONSUMER’S PERSONAL INFORMATION TO THIRD PARTIES FOR AT LEAST 12 MONTHS.
(D) (1) A BUSINESS SHALL PROVIDE A CLEAR AND CONSPICUOUS LINK ON THE INTERNET HOMEPAGE OF THE BUSINESS TO AN INTERNET WEBPAGE THAT ENABLES A CONSUMER, OR A PERSON AUTHORIZED BY THE CONSUMER, TO OPT OUT OF THE THIRD–PARTY DISCLOSURE OF THE CONSUMER’S PERSONAL INFORMATION.
(2) A BUSINESS MAY NOT REQUIRE A CONSUMER TO CREATE AN ACCOUNT IN ORDER TO EXERCISE THIS RIGHT.
(E) A CONSUMER MAY AUTHORIZE ANOTHER PERSON SOLELY TO OPT OUT OF THE SALE OR DISCLOSURE OF THE CONSUMER’S PERSONAL INFORMATION ON THE CONSUMER’S BEHALF, AND A BUSINESS SHALL COMPLY WITH AN OPT–OUT REQUEST RECEIVED FROM A PERSON AUTHORIZED BY THE CONSUMER TO ACT ON THE CONSUMER’S BEHALF, IN ACCORDANCE WITH REGULATIONS ADOPTED BY THE ATTORNEY GENERAL. Decisional Interference
14–4207.
A BUSINESS MAY NOT DISCRIMINATE AGAINST A CONSUMER BECAUSE THE CONSUMER EXERCISED ANY OF THE CONSUMER’S RIGHTS UNDER THIS SUBTITLE, INCLUDING BY:
(1) DENYING GOODS OR SERVICES TO THE CONSUMER;
(2) CHARGING DIFFERENT PRICES OR RATES FOR GOODS OR SERVICES, INCLUDING THROUGH THE USE OF DISCOUNTS OR OTHER BENEFITS OR IMPOSING PENALTIES;
(3) PROVIDING A DIFFERENT LEVEL OR QUALITY OF GOODS OR SERVICES TO THE CONSUMER; OR
(4) SUGGESTING THAT THE CONSUMER WILL RECEIVE A DIFFERENT PRICE OR RATE FOR GOODS OR SERVICES OR A DIFFERENT LEVEL OR QUALITY OF GOODS OR SERVICES.
14–4208.
(A) THE OBLIGATIONS IMPOSED BY THIS SUBTITLE MAY NOT RESTRICT THE ABILITY OF ANY BUSINESS OR THIRD PARTY TO:
(1) COMPLY WITH FEDERAL, STATE, OR LOCAL LAWS;
(2) COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL, STATE, OR LOCAL AUTHORITY;
(3) COOPERATE WITH LAW ENFORCEMENT AGENCIES CONCERNING CONDUCT OR ACTIVITY THAT THE BUSINESS, SERVICE PROVIDER, OR THIRD PARTY REASONABLY AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR LOCAL LAW;
(4) EXERCISE LEGAL RIGHTS OR PRIVILEGES; OR
(5) ENGAGE IN NEWS–GATHERING ACTIVITIES PROTECTED BY THE FIRST AMENDMENT.
(B) THIS SUBTITLE DOES NOT APPLY TO:
(1) A BUSINESS COLLECTING OR DISCLOSING PERSONAL INFORMATION OF THE BUSINESS’S EMPLOYEES TO THE EXTENT THAT THE BUSINESS IS COLLECTING OR DISCLOSING THE INFORMATION WITHIN THE SCOPE OF ITS ROLE AS AN EMPLOYER;
(2) HEALTH INFORMATION THAT IS COLLECTED BY A COVERED ENTITY OR BUSINESS ASSOCIATE GOVERNED BY THE PRIVACY, SECURITY, AND BREACH NOTIFICATION RULES ISSUED BY THE U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES IN 45 C.F.R. PARTS 160 AND 164, ESTABLISHED IN ACCORDANCE WITH THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 AND THE FEDERAL HEALTH INFORMATION TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT;
(3) A COVERED ENTITY GOVERNED BY THE PRIVACY, SECURITY, AND BREACH NOTIFICATION RULES ISSUED BY THE U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES IN 45 C.F.R. PARTS 160 AND 164, ESTABLISHED IN ACCORDANCE WITH THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996, TO THE EXTENT THE PROVIDER OR COVERED ENTITY MAINTAINS PATIENT INFORMATION IN THE SAME MANNER AS MEDICAL INFORMATION OR PROTECTED HEALTH INFORMATION AS DESCRIBED IN ITEM (2) OF THIS SUBSECTION;
(4) INFORMATION COLLECTED AS PART OF A CLINICAL TRIAL SUBJECT TO THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS, ALSO KNOWN AS THE COMMON RULE, PURSUANT TO GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY THE INTERNATIONAL COUNCIL FOR HARMONISATION OR IN ACCORDANCE WITH HUMAN SUBJECT PROTECTION REQUIREMENTS OF THE U.S. FOOD AND DRUG ADMINISTRATION;
(5) SALE OF PERSONAL INFORMATION TO OR FROM A CONSUMER REPORTING AGENCY IF THAT INFORMATION IS TO BE REPORTED IN, OR USED TO GENERATE, A “CONSUMER REPORT” AS DEFINED BY 15 U.S.C. § 1681(A) AND USE OF THAT INFORMATION IS LIMITED BY THE FEDERAL FAIR CREDIT REPORTING ACT;
(6) PERSONAL INFORMATION COLLECTED, PROCESSED, SOLD, OR DISCLOSED UNDER THE FEDERAL GRAMM–LEACH–BLILEY ACT AND IMPLEMENTING REGULATIONS;
(7) PERSONAL INFORMATION COLLECTED, PROCESSED, SOLD, OR DISCLOSED UNDER THE FEDERAL DRIVER’S PRIVACY PROTECTION ACT OF 1994; AND
(8) EDUCATION INFORMATION COVERED BY THE FEDERAL FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT, U.S.C. § 1232G AND 34 C.F.R. PART 99. Interrogation, Surveillance, Insecurity, Decisional Interference
14–4209.
RESEARCH WITH PERSONAL INFORMATION THAT MAY HAVE BEEN COLLECTED FROM A CONSUMER IN THE COURSE OF THE CONSUMER’S INTERACTIONS WITH A BUSINESS’S SERVICE OR DEVICE FOR OTHER PURPOSES SHALL BE:
(1) USED SOLELY FOR RESEARCH PURPOSES THAT ARE COMPATIBLE WITH THE CONTEXT IN WHICH THE PERSONAL INFORMATION WAS COLLECTED;
(2) RESTRICTED FROM USE FOR ANY COMMERCIAL PURPOSE;
(3) SUBSEQUENTLY PSEUDONYMIZED AND DE–IDENTIFIED, OR DE–IDENTIFIED AND IN THE AGGREGATE, SO THAT THE INFORMATION CANNOT REASONABLY IDENTIFY, RELATE TO, DESCRIBE, BE CAPABLE OF BEING ASSOCIATED WITH, OR BE LINKED, DIRECTLY OR INDIRECTLY, TO A PARTICULAR CONSUMER;
(4) MADE SUBJECT TO TECHNICAL SAFEGUARDS THAT PROHIBIT RE–IDENTIFICATION OF THE CONSUMER TO WHOM THE INFORMATION MAY PERTAIN;
(5) SUBJECT TO BUSINESS PROCESSES THAT SPECIFICALLY PROHIBIT RE–IDENTIFICATION OF THE INFORMATION;
(6) MADE SUBJECT TO BUSINESS PROCESSES TO PREVENT INADVERTENT RELEASE OF DE–IDENTIFIED INFORMATION;
(7) PROTECTED FROM ANY RE–IDENTIFICATION ATTEMPTS; AND
(8) SUBJECTED BY THE BUSINESS CONDUCTING THE RESEARCH TO ADDITIONAL SECURITY CONTROLS THAT LIMIT ACCESS TO THE RESEARCH DATA TO ONLY THOSE INDIVIDUALS IN A BUSINESS AS ARE NECESSARY TO CARRY OUT THE RESEARCH PURPOSE. Surveillance, Interrogation, Secondary Use, Aggregation, Identification
14–4210.
(A) WHENEVER THE OFFICE OF THE ATTORNEY GENERAL HAS REASON TO BELIEVE THAT ANY BUSINESS, SERVICE PROVIDER, OR OTHER PERSON IS IN VIOLATION OF THIS SUBTITLE, AND THAT PROCEEDINGS WOULD BE IN THE PUBLIC INTEREST, THE ATTORNEY GENERAL MAY:
(1) BRING AN ACTION IN THE NAME OF THE STATE AGAINST THE PARTY TO RESTRAIN THE VIOLATION BY TEMPORARY RESTRAINING ORDER OR PRELIMINARY OR PERMANENT INJUNCTION; AND
(2) SEEK A CIVIL PENALTY NOT EXCEEDING $2,500 FOR EACH VIOLATION OR NOT EXCEEDING $7,500 FOR EACH INTENTIONAL VIOLATION.
(B) (1) A BUSINESS THAT DISCLOSES PERSONAL INFORMATION TO A SERVICE PROVIDER MAY NOT BE LIABLE UNDER THIS SUBTITLE IF THE SERVICE PROVIDER RECEIVING THE PERSONAL INFORMATION USES THE PERSONAL INFORMATION IN VIOLATION OF THE RESTRICTIONS SET FORTH IN THIS SUBTITLE, IF, AT THE TIME OF DISCLOSING THE PERSONAL INFORMATION, THE BUSINESS DOES NOT HAVE ACTUAL KNOWLEDGE, OR REASON TO BELIEVE, THAT THE SERVICE PROVIDER INTENDS TO COMMIT A VIOLATION.
(2) A SERVICE PROVIDER MAY NOT BE LIABLE UNDER THIS SUBTITLE FOR THE OBLIGATIONS OF A BUSINESS FOR WHICH IT PROVIDES SERVICES AS SET FORTH IN THIS SUBTITLE.
14–4211.
(A) ON OR BEFORE JULY 1, 2021, THE OFFICE OF THE ATTORNEY GENERAL SHALL SOLICIT BROAD PUBLIC PARTICIPATION AND ADOPT REGULATIONS TO FURTHER THE PURPOSES OF THIS SUBTITLE, INCLUDING:
(1) UPDATING AS NEEDED ADDITIONAL CATEGORIES OF PERSONAL INFORMATION TO THOSE UNDER § 14–4208(B) OF THIS SUBTITLE IN ORDER TO ADDRESS CHANGES IN TECHNOLOGY, DATA COLLECTION PRACTICES, OBSTACLES TO IMPLEMENTATION, AND PRIVACY CONCERNS;
(2) UPDATING AS NEEDED THE DEFINITION OF UNIQUE IDENTIFIERS TO ADDRESS CHANGES IN TECHNOLOGY, DATA COLLECTION, OBSTACLES TO IMPLEMENTATION, AND PRIVACY CONCERNS;
(3) ESTABLISHING ANY EXCEPTIONS NECESSARY TO COMPLY WITH STATE OR FEDERAL LAW, INCLUDING EXCEPTIONS RELATING TO TRADE SECRETS AND INTELLECTUAL PROPERTY RIGHTS;
(4) ADOPTING REGULATIONS AND PROCEDURES:
(I) TO FACILITATE AND GOVERN THE SUBMISSION OF VERIFIABLE CONSUMER REQUESTS UNDER §§ 14–4203 THROUGH 14–4206 OF THIS SUBTITLE;
(II) TO GOVERN RESPONSES BY BUSINESSES AND SERVICE PROVIDERS TO VERIFIABLE CONSUMER REQUESTS UNDER §§ 14–4203 THROUGH 14–4206 OF THIS SUBTITLE; AND
(III) FOR THE DEVELOPMENT AND USE OF A RECOGNIZABLE AND UNIFORM OPT–OUT LOGO OR BUTTON BY ALL BUSINESSES TO PROMOTE CONSUMER AWARENESS OF THE OPPORTUNITY TO OPT OUT OF THIRD–PARTY DISCLOSURE OF CONSUMER PERSONAL INFORMATION;
(5) ADJUSTING THE MONETARY THRESHOLD IN § 14–4201(D)(1)(III)1 OF THIS SUBTITLE IN JANUARY OF EVERY ODD–NUMBERED YEAR TO REFLECT ANY INCREASE IN THE UNITED STATES BUREAU OF LABOR STATISTICS’ CONSUMER PRICE INDEX;
(6) ENSURING THAT THE NOTICES AND INFORMATION THAT BUSINESSES ARE REQUIRED TO PROVIDE UNDER THIS SUBTITLE ARE PROVIDED IN A MANNER THAT MAY BE EASILY UNDERSTOOD BY THE AVERAGE CONSUMER, ARE ACCESSIBLE TO CONSUMERS WITH DISABILITIES, AND ARE AVAILABLE IN THE LANGUAGE PRIMARILY USED TO INTERACT WITH THE CONSUMER, INCLUDING ADOPTING REGULATIONS, PROCEDURES, AND GUIDELINES REGARDING FINANCIAL INCENTIVE OFFERINGS; AND
(7) FURTHERING THE PURPOSES OF §§ 14–4203 THROUGH 14–4206 OF THIS SUBTITLE, WITH THE GOAL OF MINIMIZING THE ADMINISTRATIVE BURDEN ON CONSUMERS, TAKING INTO ACCOUNT AVAILABLE TECHNOLOGY, SECURITY CONCERNS, AND THE BURDEN ON THE BUSINESS, TO GOVERN A DETERMINATION BY A BUSINESS THAT A REQUEST FOR INFORMATION RECEIVED BY A CONSUMER IS A VERIFIABLE CONSUMER REQUEST, INCLUDING TREATING A REQUEST SUBMITTED THROUGH A PASSWORD–PROTECTED ACCOUNT MAINTAINED BY THE CONSUMER WITH THE BUSINESS WHILE THE CONSUMER IS LOGGED INTO THE ACCOUNT AS A VERIFIABLE CONSUMER REQUEST AND PROVIDING A MECHANISM FOR A CONSUMER WHO DOES NOT MAINTAIN AN ACCOUNT WITH THE BUSINESS TO REQUEST INFORMATION THROUGH THE BUSINESS’S AUTHENTICATION OF THE CONSUMER’S IDENTITY.
(B) THE ATTORNEY GENERAL MAY ADOPT ADDITIONAL REGULATIONS AS NECESSARY TO CARRY OUT THIS SUBTITLE.
(C) THE ATTORNEY GENERAL MAY NOT BRING AN ENFORCEMENT ACTION UNDER THIS SUBTITLE UNTIL 6 MONTHS AFTER THE PUBLICATION OF THE FINAL REGULATIONS ISSUED IN ACCORDANCE WITH THIS SECTION.
14–4212.
(A) WHEREVER POSSIBLE, LAW RELATING TO CONSUMERS’ PERSONAL INFORMATION SHOULD BE CONSTRUED TO HARMONIZE WITH THE PROVISIONS OF THIS SUBTITLE.
(B) IN THE EVENT OF A CONFLICT BETWEEN OTHER LAWS AND THIS SUBTITLE, THE PROVISIONS OF THE LAW THAT AFFORD THE GREATEST PROTECTION FOR THE RIGHT OF PRIVACY FOR CONSUMERS SHALL CONTROL.
14–4213. IF A SERIES OF STEPS OR TRANSACTIONS WHERE COMPONENT PARTS OF A SINGLE TRANSACTION WERE TAKEN WITH THE INTENTION OF AVOIDING THE REACH OF THIS SUBTITLE, A COURT SHALL DISREGARD THE INTERMEDIATE STEPS OR TRANSACTIONS FOR PURPOSES OF CARRYING OUT THE PURPOSES OF THIS SUBTITLE.
14–4214. ANY PROVISION OF A CONTRACT OR AN AGREEMENT OF ANY KIND THAT PURPORTS TO WAIVE OR LIMIT IN ANY WAY A CONSUMER’S RIGHTS UNDER THIS SUBTITLE, INCLUDING ANY RIGHT TO A REMEDY OR MEANS OF ENFORCEMENT, SHALL BE CONSIDERED CONTRARY TO PUBLIC POLICY AND SHALL BE VOID AND UNENFORCEABLE.
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect January 1, 2021.



Disclaimer: The text of this law may not be the most recent version. We make no warranties or representations about the accuracy, completeness, or adequacy of the information contained on this site. Please check official sources.

Retrieved from "https://privacy.wiki/index.php?title=MD._SB_613._Consumer_Personal_Information_Privacy.&oldid=6498"