Maryland Online Data Privacy Act: Securing Trust

Are you worried your personal data might be exposed online? Maryland has rolled out a new online data privacy law that promises to change the way companies handle your information. Governor Wes Moore signed it in May 2024, and it will start on October 1, 2025.

The law has rules much like those in Europe, clearly stating who gets to control and process your data. In this article, we break down what the law covers and why it matters. Have you ever felt uneasy about your privacy online? This new act is here to help you feel a little safer every time you log on.

maryland online data privacy act: Securing Trust

Maryland's new law, MDODPA, was approved by Governor Wes Moore on May 9, 2024, and will kick in on October 1, 2025. This is a big step forward for protecting your personal data. Now, Maryland becomes the seventeenth state to have full online privacy rules. Imagine finding out that companies must now change how they handle your data to meet these fresh standards.

At its heart, the law draws a clear line between controllers and processors. Controllers decide why and how your information is used, while processors work with that data for them. This setup follows a model similar to what the European Union uses, aiming to boost transparency and trust. In simple terms, MDODPA sets firm rules for how companies share privacy notices, keep data safe, and respect your rights as a consumer. It’s all about making your digital world a little safer.

Applicability & Thresholds under the Maryland Data Privacy Act

If your company handles personal data for Maryland residents, you need to check if you meet a few clear-cut rules. For example, if you process information for 35,000 or more Maryland residents during the past calendar year, this law applies to you.

Also, if you work with data from at least 10,000 residents and more than 20% of your gross revenue comes from selling personal data, you must follow the act. Some data is not counted toward these numbers because it is already protected by federal laws like HIPAA or GLBA, or because it concerns your employees or contractors.

Knowing these thresholds is important. If your company fits any of these criteria, take a close look at your data practices and update your policies to meet Maryland’s focused approach to online data protection.

Core Obligations for Controllers & Processors

Controllers are the ones who decide why and how your personal data is used. Processors, on the other hand, work behind the scenes to manage that data as the controllers guide them. Both roles carry big responsibilities under Maryland law. This law is all about shining a light on data practices and making sure your information stays safe. Companies need to adjust how they work so they clearly explain how data is handled and cut down risks like targeted ads, computer-driven profiling, and the sale of personal info. It all boils down to being on the front foot with data privacy rules. For example, if you notice a processing activity that looks risky, a proper check not only puts consumers at ease but also ticks all the legal boxes. (You can review the data privacy rules here: https://ourmobilehealth.com?p=862.)

• Companies must share clear, detailed privacy notices that explain what data gets gathered, why it’s collected, and how it is shared with others.

• They need to follow strict data minimization rules that limit both the amount and type of data collected, often setting the bar higher than other privacy rules.

• Every high-risk processing activity, like using data for targeted ads or sales, calls for a documented risk check, done following clear steps.

• Contracts should spell out who is the controller and who is the processor so that everyone knows their role.

• Consumer opt-out requests must be handled quickly, ensuring that people are always in control of their personal information.

• It’s important to keep records of data processing so that a company can easily prove it’s following the law when needed.

This approach builds trust by making sure companies stand behind every step they take with personal data, so you always know that your information is looked after.

Consumer Rights & Opt-Outs under the Maryland Act

If you live in Maryland, you have clear rights about your personal data. The law lets you check if your data is being used, find out why it’s being used, and decide what happens to it. You can ask to see what information is on file, fix any mistakes, or even delete details you don’t want stored. You can also ask to have your data given to you in a way that you can easily use it elsewhere. Plus, you can choose not to let your data be sold or used for ads that match your interests.

If you make a request, it must be answered within 45 days. In more complicated cases, there can be one extra 45-day period. Enforcement of these rules is handled by the Attorney General, so your rights are well protected, even though you can’t file a private lawsuit on your own.

1. Confirm whether your data is being processed
2. Request a copy of your personal data
3. Fix any incorrect information
4. Delete your personal data
5. Export your data in a portable format
6. Opt out of having your data sold
7. Opt out of targeted advertising

Special Provisions: Sensitive Data, Minors & Health Information

Biometric data means the automatic measurement of your physical traits that help verify who you are. Maryland treats this as extra sensitive, so companies only collect what they absolutely need and handle it with extra care.

The law also keeps minors safe by blocking the use of personal data from Maryland residents under 18 for sales or targeted ads. Companies need to set up age checks to make sure users are adults before they use any data for ads.

Consumer health information gets even stronger protection. Only trusted employees with strict confidentiality agreements can access it, and any partners handling this data must follow the same rules. Plus, businesses are not allowed to use geofencing (using exact location info to send alerts or track movement) within 1,750 feet of any healthcare facility. This important rule helps keep your sensitive health data secure and respects your privacy.

Lawmakers are now looking at HB 1365, a proposal that aims to align these rules with similar state laws. The bill would offer clearer guidelines for managing personal data while keeping safety standards high. In truth, it’s all about making sure your information is handled in a transparent and secure way.

Enforcement, Penalties & Exceptions in MODPA

Under MODPA, the Maryland Attorney General’s Consumer Protection Division takes active steps to keep your privacy safe. They set up a process that gives companies a 60-day grace period to fix problems before any penalties are applied. This clear timeframe means businesses need to act fast when issues pop up.

• They watch over data handling closely to catch any breaches.
• They promptly inform controllers if something seems off.
• A 60-day period is provided so controllers can correct issues.
• The number and type of violations are carefully considered.
• Fines can go up to $10,000 for each mistake.
• If the same issue happens again, fines can increase to $25,000 per violation.

Beyond these measures, the law also allows for a few exceptions. Business practices that follow other regulations, measures taken to improve cybersecurity, actions to stop fraud, and some internal operations are treated with a bit more flexibility. For example, steps taken solely to fend off cyberattacks or prevent fraudulent activities are part of these exceptions. This means not every error is seen as a company fault, sometimes quick, decisive action is needed to manage unexpected problems.

By combining firm penalties with sensible exceptions, MODPA works to create a safe and fair space for everyone in Maryland while giving businesses room to protect their systems and stay responsive.

Compliance Timeline, Amendments & Ongoing Updates

The Maryland Online Data Privacy Act kicks in on October 1, 2025. This is your cue to start reviewing how you handle data. Check your current protocols, plan some team training, and get ready for a friendly run-through of updated privacy steps. Imagine your team gathering around, looking over clear data flow charts, and making sure every part of your process is up to the new rules.

There’s also news on the horizon. HB 1365 is in the works to tweak some of the current restrictions so they fit better with laws from other states. Keep an eye on the official Maryland privacy blog for fresh updates, helpful guidelines, and useful resources. Stay updated, stay ready, and adjust your processes in time to keep trust strong and follow the rules.

Final Words

In the action, we walked through the maryland online data privacy act's key dates and requirements.
We covered who must comply, clear controller and processor duties, and consumer rights.
We also discussed strict rules for sensitive data and minor protections, along with potential penalties and exceptions.
Finally, we broke down the necessary steps to be ready for the October 1, 2025 deadline.
The overview guides you toward confident, secure compliance and a future of sound digital health practices.

FAQ