Free State Lawmakers Debate Data Privacy Legislation

Maryland soon could join the not-so-exclusive club for states that have forged divergent data privacy regulatory paths. Last month, New Jersey became the fourteenth state (and the first this year) to enact a comprehensive data privacy law, a development that I highlighted in a January 2024 post to the Free State Foundation's blog. Yet another bill awaits the signature of New Hampshire Governor Chris Sununu.

As I detailed most recently in "More States Compound the Dreaded Privacy 'Patchwork' Problem," a July 2023 Perspectives from FSF Scholars, the longstanding lack of a federal data privacy regime – specifically, one that preempts inconsistent state-specific approaches – has fostered an unworkable situation that creates compliance headaches for companies and confusion for consumers.

Hearings on the Maryland Online Data Privacy Act of 2024 (the Act) were held on February 13, 2024, by the House Economic Matters Committee (House Bill 567) and on February 14, 2024 by the Senate Finance Committee (Senate Bill 541).

The Act establishes a familiar set of consumer rights: to know that personal data is being collected; to access, correct, delete, and receive a copy of personal data; to obtain a list of the categories of third parties to which personal data is disclosed; to opt out of the processing of personal data for targeted advertising and automated profiling; and to opt out of its sale.

Perhaps most notably, the Act goes further than other state laws in limiting the personal data that companies may collect – that is, "data minimization" ("A controller shall … [l]imit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains.")

On its face, the Act does not create a private right of action. As was the case with the New Jersey law reference above, however, the Act's draft language has prompted concerns that it "do[es] not explicitly provide for exclusive Attorney General enforcement" (emphasis added). Specifically, Section 14-4613, which defines a violation of the Act as "[a]n unfair, abusive, or deceptive trade practice … [s]ubject to the enforcement and penalty provisions contained in Title 13 of this article," also ambiguously asserts that it "does not prevent a consumer from pursuing any other remedy provided by law."

Breaking from the approach embraced by other states, and thus further complicating compliance for companies, the Act does not provide businesses with an opportunity to cure alleged violations.

If enacted, the Act would go into effect on October 1, 2024.