SENATE BILL 930
I3 1lr2391
By: Senator Lee
Introduced and read first time: February 10, 2021
Assigned to: Rules
A BILL ENTITLED
1 AN ACT concerning
2 Maryland Online Consumer Protection Act
3 FOR the purpose of requiring certain businesses that collect a consumer’s personal
4 information to provide certain notices to the consumer at or before the point of
5 collection; authorizing a consumer to submit a certain request for information to a
6 business that collects the consumer’s personal information; requiring a business to
7 comply with a certain request for information in a certain manner and within a
8 certain period of time; establishing certain exceptions to a consumer’s request for
9 personal information; requiring a business to establish a means for consumers to
10 submit certain requests; requiring a business to provide certain information to a
11 consumer in a certain manner; prohibiting a business from retaining certain
12 personal information, re–identifying or linking certain data, or disclosing certain
13 personal information under certain circumstances; requiring a business to include
14 certain information in a certain policy or website and update certain information
15 periodically; requiring a business to ensure that an individual responsible for
16 handling certain consumer inquiries is informed of certain requirements relating to
17 consumer personal information privacy and how to direct consumers to exercise their
18 rights; authorizing a consumer to request a business to delete certain personal
19 information and requiring a business to comply with the request in a certain manner;
20 authorizing a consumer to demand that a business not disclose the consumer’s
21 personal information to third parties and requiring a business to comply with the
22 consumer’s request to opt out in a certain manner; authorizing a business to require
23 an authentication of a certain request; prohibiting a business from taking certain
24 actions against a consumer who exercises the consumer’s rights to consumer
25 personal information privacy; providing for certain exceptions to an otherwise
26 authorized disclosure of consumer personal information; establishing that a violation
27 of this Act is an unfair, abusive, or deceptive trade practice and is subject to certain
28 enforcement and penalty provisions; authorizing the Office of the Attorney General
29 to adopt certain regulations; providing for the application of this Act; providing for a
30 delayed effective date; defining certain terms; and generally relating to privacy of
31 consumer personal information.
EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW.
[Brackets] indicate matter deleted from existing law.
*sb0930*
 2 SENATE BILL 930
1 BY adding to
2 Article – Commercial Law
3 Section 14–4301 through 14–4314 to be under the new subtitle “Subtitle 43.
4 Consumer Personal Information Privacy”
5 Annotated Code of Maryland
6 (2013 Replacement Volume and 2020 Supplement)
7 SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND,
8 That the Laws of Maryland read as follows:
9 Article – Commercial Law
10 SUBTITLE 43. CONSUMER PERSONAL INFORMATION PRIVACY.
11 14–4301.
12 (A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS
13 INDICATED.
14 (B) (1)
“AGGREGATE CONSUMER INFORMATION” MEANS INFORMATION
15 THAT RELATES TO A GROUP OR CATEGORY OF CONSUMERS, FROM WHICH
16 INDIVIDUAL CONSUMER IDENTITIES HAVE BEEN REMOVED, THAT IS NOT LINKED OR
17 REASONABLY LINKABLE TO ANY CONSUMER, INCLUDING THROUGH A DEVICE.
18 (2) “AGGREGATE CONSUMER INFORMATION” DOES NOT INCLUDE AN
19 INDIVIDUAL CONSUMER RECORD THAT HAS BEEN DE–IDENTIFIED.
20 (C) (1)
“BIOMETRIC INFORMATION” MEANS AN INDIVIDUAL’S
21 PHYSIOLOGICAL, BIOLOGICAL, OR BEHAVIORAL CHARACTERISTICS, INCLUDING AN
22 INDIVIDUAL’S DNA, THAT CAN BE USED, ALONE OR IN COMBINATION WITH EACH
23 OTHER OR WITH OTHER IDENTIFYING DATA, TO ESTABLISH INDIVIDUAL IDENTITY.
24 (2) “BIOMETRIC INFORMATION” INCLUDES:
25 (I)
IMAGERY OF THE IRIS, RETINA, FINGERPRINT, FACE, HAND,
26 PALM, AND VEIN PATTERNS, AND VOICE RECORDINGS FROM WHICH AN IDENTIFIER
27 TEMPLATE, SUCH AS A FACE PRINT, A MINUTIAE TEMPLATE, OR A VOICEPRINT, CAN
28 BE EXTRACTED; AND
29 (II)
KEYSTROKE PATTERNS OR RHYTHMS, GAIT PATTERNS OR
30 RHYTHMS, AND SLEEP, HEALTH, OR EXERCISE DATA THAT CONTAIN IDENTIFYING
31 INFORMATION.
 SENATE BILL 930 3
1 (D) “BUSINESS” MEANS:
2 (1)A SOLE PROPRIETORSHIP, A PARTNERSHIP, A LIMITED LIABILITY
3 COMPANY, A CORPORATION, AN ASSOCIATION, OR ANY OTHER LEGAL ENTITY THAT:
4 (I)IS ORGANIZED OR OPERATED FOR THE PROFIT OR
5 FINANCIAL BENEFIT OF ITS OWNERS;
6 (II)
COLLECTS THE PERSONAL INFORMATION OF AN
7 INDIVIDUAL OR CONSUMER; AND
8 (III) SATISFIES ONE OR MORE OF THE FOLLOWING THRESHOLDS:
9 1. HAS ANNUAL GROSS REVENUES IN EXCESS OF
10 $25,000,000;
11 2. ANNUALLY BUYS, RECEIVES FOR THE BUSINESS’S
12 COMMERCIAL PURPOSES, SELLS, OR SHARES FOR COMMERCIAL PURPOSES, ALONE
13 OR IN COMBINATION, THE PERSONAL INFORMATION OF 100,000 OR MORE
14 CONSUMERS, HOUSEHOLDS, OR DEVICES; OR
15 3.
DERIVES AT LEAST ONE–HALF OF ITS ANNUAL
16 REVENUES FROM SELLING CONSUMERS’ PERSONAL INFORMATION; OR
17 (2) ANY ENTITY THAT:
18 (I) CONTROLS OR IS CONTROLLED BY A BUSINESS UNDER ITEM
19 (1) OF THIS SUBSECTION; AND
20 (II) SHARES A NAME, SERVICE MARK, OR TRADEMARK WITH THE
21 BUSINESS.
22 (E) “BUSINESS PURPOSE” MEANS THE USE OF PERSONAL INFORMATION BY
23 A BUSINESS OR A SERVICE PROVIDER IN A MANNER REASONABLY NECESSARY TO
24 ACHIEVE THE OPERATIONAL PURPOSE FOR WHICH THE INFORMATION WAS
25 COLLECTED.
26 (F) (1)“COLLECT” MEANS TO BUY, RENT, GATHER, OBTAIN, RECEIVE, OR
27 ACCESS ANY PERSONAL INFORMATION PERTAINING TO A CONSUMER BY ANY MEANS.
28 (2)
“COLLECT” INCLUDES TO RECEIVE INFORMATION FROM THE
29 CONSUMER OR BY OBSERVING THE CONSUMER’S BEHAVIOR.
 4 SENATE BILL 930
1 (G) “CONSUMER” MEANS AN INDIVIDUAL WHO RESIDES IN THE STATE.
2 (H) “DE–IDENTIFIED” MEANS, WITH RESPECT TO INFORMATION,
3 PROCESSED SO THAT THE INFORMATION CANNOT REASONABLY IDENTIFY, RELATE
4 TO, DESCRIBE, BE CAPABLE OF BEING ASSOCIATED WITH, OR BE LINKED TO A
5 PARTICULAR CONSUMER, IF A BUSINESS THAT USES
6 DE–IDENTIFIED INFORMATION:
7 (1) HAS IMPLEMENTED TECHNICAL SAFEGUARDS THAT PROHIBIT
8 RE–IDENTIFICATION OF THE CONSUMER TO WHOM THE INFORMATION MAY
9 PERTAIN;
10 (2) HAS IMPLEMENTED BUSINESS PROCESSES THAT SPECIFICALLY
11 PROHIBIT RE–IDENTIFICATION OF THE INFORMATION;
12 (3) HAS IMPLEMENTED BUSINESS PROCESSES TO PREVENT
13 INADVERTENT RELEASE OF DE–IDENTIFIED INFORMATION; AND
14 (4) MAKES NO ATTEMPT TO RE–IDENTIFY THE INFORMATION.
15 (I) (1) “DESIGNATED METHOD FOR SUBMITTING REQUESTS” MEANS A
16 MAILING ADDRESS, AN E–MAIL ADDRESS, AN INTERNET WEBSITE, AN INTERNET
17 PORTAL, A TELEPHONE NUMBER, OR ANY OTHER APPLICABLE CONTACT
18 INFORMATION THROUGH WHICH A CONSUMER MAY SUBMIT A REQUEST OR
19 DIRECTION UNDER THIS SUBTITLE.
20 (2) “DESIGNATED METHOD FOR SUBMITTING REQUESTS” INCLUDES
21 A CONSUMER–FRIENDLY MEANS OF CONTACTING A BUSINESS APPROVED BY THE
22 ATTORNEY GENERAL UNDER § 14–4311(A)(4) OF THIS SUBTITLE.
23 (J) “DEVICE” MEANS A PHYSICAL OBJECT THAT IS CAPABLE OF
24 CONNECTING TO THE INTERNET OR TO ANOTHER DEVICE.
25 (K) “HOMEPAGE” MEANS:
26 (1) THE INTRODUCTORY PAGE OF AN INTERNET WEBSITE AND ANY
27 INTERNET WEBPAGE WHERE PERSONAL INFORMATION IS COLLECTED; OR
28 (2) IN THE CASE OF AN ONLINE SERVICE OR APPLICATION:
29 (I) THE SERVICE OR APPLICATION PLATFORM PAGE OR
30 DOWNLOAD PAGE;
 SENATE BILL 930 5
1 (II)A LINK WITHIN THE SERVICE OR APPLICATION, SUCH AS
2 FROM THE SERVICE OR APPLICATION CONFIGURATION, “ABOUT”, “INFORMATION”,
3 OR SETTINGS PAGE; OR
4 (III) ANY OTHER LOCATION THAT ALLOWS A CONSUMER TO
5 REVIEW THE NOTICE REQUIRED BY § 14–4302(A) OF THIS SUBTITLE, WHETHER
6 BEFORE OR AFTER DOWNLOADING THE APPLICATION OR SERVICE.
7 (L) “INFER” MEANS TO DERIVE INFORMATION, DATA, ASSUMPTIONS, OR
8 CONCLUSIONS FROM FACTS, EVIDENCE, OR ANOTHER SOURCE OF INFORMATION OR
9 DATA.
10 (M) (1) “PERSONAL INFORMATION” MEANS INFORMATION THAT
11 IDENTIFIES, RELATES TO, DESCRIBES, IS REASONABLY CAPABLE OF BEING
12 ASSOCIATED WITH, OR COULD REASONABLY BE LINKED, DIRECTLY OR INDIRECTLY,
13 WITH A PARTICULAR CONSUMER OR THE CONSUMER’S DEVICE.
14 (2) “PERSONAL INFORMATION” DOES NOT INCLUDE:
15 (I)
PUBLICLY AVAILABLE INFORMATION THAT IS LAWFULLY
16 MADE AVAILABLE FROM FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS;
17 (II) DE–IDENTIFIED CONSUMER INFORMATION; OR
18 (III) AGGREGATE CONSUMER INFORMATION.
19 (N) “PROBABILISTIC IDENTIFIER” MEANS THE IDENTIFICATION OF A
20 CONSUMER OR A DEVICE TO A DEGREE OF CERTAINTY OF MORE PROBABLE THAN
21 NOT BASED ON CATEGORIES OF PERSONAL INFORMATION INCLUDED IN, OR SIMILAR
22 TO, THE CATEGORIES LISTED UNDER SUBSECTION (M) OF THIS SECTION.
23 (O) “PROCESSING” MEANS AN OPERATION OR A SET OF OPERATIONS THAT
24 IS PERFORMED ON PERSONAL INFORMATION OR ON SETS OF PERSONAL
25 INFORMATION, WHETHER OR NOT BY AUTOMATED MEANS.
26 (P) “PSEUDONYMIZE” MEANS THE PROCESSING OF PERSONAL
27 INFORMATION IN A MANNER THAT RENDERS THE PERSONAL INFORMATION NO
28 LONGER ATTRIBUTABLE TO A SPECIFIC CONSUMER WITHOUT THE USE OF
29 ADDITIONAL INFORMATION, IF THE ADDITIONAL INFORMATION IS KEPT
30 SEPARATELY AND IS SUBJECT TO TECHNICAL AND ADMINISTRATIVE SAFEGUARDS
31 TO ENSURE THAT THE PERSONAL INFORMATION IS NOT ATTRIBUTED TO AN
32 IDENTIFIED OR IDENTIFIABLE CONSUMER.
 6 SENATE BILL 930
1 (Q) “RESEARCH” MEANS SCIENTIFIC, SYSTEMATIC STUDY AND
2 OBSERVATION, INCLUDING BASIC RESEARCH OR APPLIED RESEARCH THAT IS IN THE
3 PUBLIC INTEREST AND THAT ADHERES TO APPLICABLE ETHICS AND PRIVACY LAWS
4 OR STUDIES CONDUCTED IN THE PUBLIC INTEREST IN THE AREA OF PUBLIC HEALTH.
5 (R) “SERVICE” MEANS WORK, LABOR, AND SERVICES, INCLUDING SERVICES
6 FURNISHED IN CONNECTION WITH THE SALE OR REPAIR OF GOODS.
7 (S) “SERVICE PROVIDER” MEANS A PERSON THAT PROCESSES
8 INFORMATION ON BEHALF OF A BUSINESS AND TO WHICH THE BUSINESS DISCLOSES
9 A CONSUMER’S PERSONAL INFORMATION FOR A BUSINESS PURPOSE IN
10 ACCORDANCE WITH A WRITTEN CONTRACT IF THE CONTRACT PROHIBITS THE
11 ENTITY RECEIVING THE INFORMATION FROM RETAINING, USING, OR DISCLOSING
12 THE PERSONAL INFORMATION FOR ANY PURPOSE OTHER THAN FOR THE SPECIFIC
13 PURPOSE OF PERFORMING THE SERVICES SPECIFIED IN THE CONTRACT FOR THE
14 BUSINESS, OR AS OTHERWISE ALLOWED BY THIS SUBTITLE.
15 (T) “THIRD PARTY” MEANS A PERSON THAT IS NOT THE BUSINESS THAT
16 COLLECTS PERSONAL INFORMATION FROM CONSUMERS UNDER THIS SUBTITLE OR
17 A SERVICE PROVIDER OF THAT BUSINESS.
18 (U) (1) “THIRD–PARTY DISCLOSURE” MEANS A TRANSFER OF A
19 CONSUMER’S PERSONAL INFORMATION BY THE BUSINESS TO A THIRD PARTY,
20 INCLUDING SELLING, RENTING, RELEASING, DISSEMINATING, MAKING AVAILABLE,
21 TRANSFERRING, OR OTHERWISE COMMUNICATING ORALLY, IN WRITING, OR BY
22 ELECTRONIC OR OTHER MEANS.
23 (2) “THIRD–PARTY DISCLOSURE” DOES NOT INCLUDE:
24 (I) A DISCLOSURE BY A BUSINESS OF PERSONAL INFORMATION
25 OF A CONSUMER TO A SERVICE PROVIDER THAT IS NECESSARY TO THE
26 PERFORMANCE OF A BUSINESS PURPOSE INCLUDED IN A NOTICE UNDER § 14–4302
27 OF THIS SUBTITLE;
28 (II)
IDENTIFICATION BY A BUSINESS OF A CONSUMER WHO HAS
29 OPTED OUT OF THE SALE OF THE CONSUMER’S PERSONAL INFORMATION FOR THE
30 PURPOSE OF ALERTING THIRD PARTIES THAT THE CONSUMER HAS OPTED OUT OF
31 THE SALE OF THE CONSUMER’S PERSONAL INFORMATION; OR
32 (III) THE TRANSFER BY A BUSINESS TO A THIRD PARTY OF THE
33 PERSONAL INFORMATION OF A CONSUMER AS AN ASSET THAT IS PART OF A MERGER,
34 AN ACQUISITION, A BANKRUPTCY, OR ANY OTHER TRANSACTION IN WHICH THE
35 THIRD PARTY ASSUMES CONTROL OF ALL OR PART OF THE BUSINESS IF THAT
 SENATE BILL 930 7
1 INFORMATION IS USED OR SHARED CONSISTENTLY WITH THE NOTICE RECEIVED BY
2 CONSUMERS UNDER § 14–4302 OF THIS SUBTITLE.
3 (V) “UNIQUE IDENTIFIER” MEANS A PERSISTENT IDENTIFIER THAT CAN BE
4 USED TO RECOGNIZE A CONSUMER OR A DEVICE THAT IS LINKED TO A CONSUMER
5 OR HOUSEHOLD, OVER TIME AND ACROSS DIFFERENT TECHNOLOGIES, INCLUDING:
6 (1) A DEVICE IDENTIFIER;
7 (2) AN INTERNET PROTOCOL ADDRESS;
8 (3) A COOKIE, BEACON, PIXEL TAG, MOBILE AD IDENTIFIER, OR
9 SIMILAR TECHNOLOGY;
10 (4) A CONSUMER NUMBER, UNIQUE PSEUDONYM, OR USER ALIAS; OR
11 (5) A TELEPHONE NUMBER OR ANY OTHER FORM OF PERSISTENT OR
12 PROBABILISTIC IDENTIFIER THAT CAN BE USED TO IDENTIFY A PARTICULAR
13 CONSUMER OR DEVICE.
14 14–4302.
15 (A) A BUSINESS THAT COLLECTS A CONSUMER’S PERSONAL INFORMATION
16 SHALL, AT OR BEFORE THE POINT OF COLLECTION, CLEARLY AND CONSPICUOUSLY
17 NOTIFY A CONSUMER OF:
18 (1) THE CATEGORIES OF PERSONAL INFORMATION THE BUSINESS
19 WILL COLLECT ABOUT THAT CONSUMER;
20 (2)THE BUSINESS PURPOSES FOR WHICH THE CATEGORIES OF
21 PERSONAL INFORMATION MAY BE USED;
22 (3) THE CATEGORIES OF THIRD PARTIES TO WHICH THE BUSINESS
23 DISCLOSES PERSONAL INFORMATION;
24 (4) THE BUSINESS PURPOSES FOR THIRD–PARTY DISCLOSURE; AND
25 (5) THE CONSUMER’S RIGHT TO REQUEST:
26 (I) A COPY OF THE CONSUMER’S PERSONAL INFORMATION
27 UNDER § 14–4303 OF THIS SUBTITLE;
28 (II) DELETION OF THE CONSUMER’S PERSONAL INFORMATION
 8 SENATE BILL 930
1 UNDER § 14–4305 OF THIS SUBTITLE; AND
2 (III) TO OPT OUT OF THIRD–PARTY DISCLOSURE UNDER §
3 14–4306 OF THIS SUBTITLE.
4 (B) A BUSINESS MAY NOT COLLECT ADDITIONAL CATEGORIES OF PERSONAL
5 INFORMATION OR USE PERSONAL INFORMATION COLLECTED FOR ADDITIONAL
6 PURPOSES WITHOUT FIRST PROVIDING THE CONSUMER WITH NOTICE CONSISTENT
7 WITH THIS SECTION.
8 14–4303.
9 (A) A CONSUMER MAY REQUEST THAT A BUSINESS THAT COLLECTS A
10 CONSUMER’S PERSONAL INFORMATION DISCLOSE TO THAT CONSUMER:
11 (1) THE SPECIFIC PIECES OF PERSONAL INFORMATION THE
12 BUSINESS HAS COLLECTED ABOUT THAT CONSUMER;
13 (2)THE SOURCES FROM WHICH THE CONSUMER’S PERSONAL
14 INFORMATION WAS COLLECTED;
15 (3) THE NAMES OF THIRD PARTIES TO WHICH THE BUSINESS
16 DISCLOSED THE CONSUMER’S PERSONAL INFORMATION; AND
17 (4) THE BUSINESS PURPOSES FOR THIRD–PARTY DISCLOSURE.
18 (B) A BUSINESS SHALL PROVIDE THE INFORMATION SPECIFIED IN
19 SUBSECTION (A) OF THIS SECTION TO A CONSUMER ONLY ON RECEIPT OF A
20 VERIFIABLE CONSUMER REQUEST.
21 (C) (1) SUBJECT TO PARAGRAPH (2) OF THIS SUBSECTION, AFTER
22 RECEIVING A VERIFIABLE CONSUMER REQUEST, A BUSINESS SHALL PROMPTLY
23 TAKE STEPS TO PROVIDE, FREE OF CHARGE TO THE CONSUMER, THE PERSONAL
24 INFORMATION REQUIRED BY THIS SECTION.
25 (2) THE INFORMATION MAY BE PROVIDED BY:
26 (I) UNITED STATES MAIL; OR
27 (II)
ELECTRONIC DELIVERY THAT IS PORTABLE AND, TO THE
28 EXTENT TECHNICALLY FEASIBLE, IN A READILY USEABLE FORMAT THAT ALLOWS
29 THE CONSUMER TO TRANSMIT THIS INFORMATION TO ANOTHER ENTITY WITHOUT
30 HINDRANCE.
 SENATE BILL 930 9
1 (D) A BUSINESS MAY PROVIDE PERSONAL INFORMATION TO A CONSUMER
2 AT ANY TIME, NOTWITHSTANDING § 14–4304 OF THIS SUBTITLE, BUT IS NOT
3 REQUIRED TO PROVIDE PERSONAL INFORMATION TO THE SAME CONSUMER MORE
4 THAN ONCE IN A 6–MONTH PERIOD.
5 (E) IF VERIFIED REQUESTS FROM A CONSUMER ARE EXCESSIVE, BECAUSE
6 OF THEIR REPETITIVE CHARACTER, A BUSINESS MAY:
7 (1) CHARGE A REASONABLE FEE, TAKING INTO ACCOUNT THE
8 ADMINISTRATIVE COSTS OF PROVIDING THE INFORMATION OR COMMUNICATION OR
9 TAKING THE ACTION REQUESTED; OR
10 (2) REFUSE TO ACT ON THE REQUEST AND NOTIFY THE CONSUMER OF
11 THE REASON FOR REFUSING THE REQUEST.
12 (F) A BUSINESS MAY NOT REQUIRE A CONSUMER TO CREATE AN ACCOUNT
13 WITH THE BUSINESS IN ORDER TO MAKE A VERIFIABLE CONSUMER REQUEST.
14 (G) A BUSINESS MAY NOT:
15 (1) RETAIN
PERSONAL INFO