# Senate Bill No. 848

## CHAPTER 724

An act to add Section 12945.6 to the Government Code, relating to employment.

[Approved by Governor October 10, 2023. Filed with Secretary of State October 10, 2023.]

## LEGISLATIVE COUNSEL'S DIGEST

SB 848, Rubio. Employment: leave for reproductive loss.

Existing law, the California Fair Employment and Housing Act, makes it an unlawful employment practice for an employer to refuse to grant a request by any employee to take up to 5 days of bereavement leave upon the death of a family member.

This bill would additionally make it an unlawful employment practice for an employer to refuse to grant a request by an eligible employee to take up to 5 days of reproductive loss leave following a reproductive loss event, as defined. The bill would require that leave be taken within 3 months of the event, except as described, and pursuant to any existing leave policy of the employer. The bill would provide that if an employee experiences more than one reproductive loss event within a 12-month period, the employer is not obligated to grant a total amount of reproductive loss leave time in excess of 10 days within a 12-month period. Under the bill, in the absence of an existing policy, the reproductive loss leave may be unpaid. However, the bill would authorize an employee to use certain other leave balances otherwise available to the employee, including accrued and available paid sick leave. The bill would make leave under these provisions a separate and distinct right from any right under the California Fair Employment and Housing Act.

The bill would make it an unlawful employment practice for an employer to retaliate against an individual, as described, because of the individual’s exercise of the right to reproductive loss leave or the individual’s giving of information or testimony as to reproductive loss leave, as described. The bill would require the employer to maintain employee confidentiality relating to reproductive loss leave, as specified.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.
---
# The people of the State of California do enact as follows:

## SECTION 1

Section 12945.6 is added to the Government Code, to read:

### 12945.6

(a) For purposes of this section, the following definitions apply:

1. (A) "Assisted reproduction" means a method of achieving a pregnancy through artificial insemination or an embryo transfer and includes gamete and embryo donation.
   (B) "Assisted reproduction" does not include any pregnancy achieved through sexual intercourse.

2. "Employee" means a person employed by the employer for at least 30 days prior to the commencement of the leave.

3. "Employer" means either of the following:
   (A) A person who employs five or more persons to perform services for a wage or salary.
   (B) The state and any political or civil subdivision of the state, including, but not limited to, cities and counties.

4. "Failed adoption" means the dissolution or breach of an adoption agreement with the birth mother or legal guardian, or an adoption that is not finalized because it is contested by another party. This event applies to a person who would have been a parent of the adoptee if the adoption had been completed.

5. "Failed surrogacy" means the dissolution or breach of a surrogacy agreement, or a failed embryo transfer to the surrogate. This event applies to a person who would have been a parent of a child born as a result of the surrogacy.

6. "Miscarriage" means a miscarriage by a person, by the person's spouse or domestic partner, or by another individual if the person would have been a parent of a child born as a result of the pregnancy.

7. "Reproductive loss event" means the day or, for a multiple-day event, the final day of a failed adoption, failed surrogacy, miscarriage, stillbirth, or an unsuccessful assisted reproduction.

8. "Reproductive loss leave" means the leave provided by subdivision (b).

9. "Stillbirth" means a stillbirth resulting from a person's pregnancy, the pregnancy of a person's current spouse or domestic partner, or another individual, if the person would have been a parent of a child born as a result of the pregnancy that ended in stillbirth.

10. "Unsuccessful assisted reproduction" means an unsuccessful round of intrauterine insemination or of an assisted reproductive technology procedure. This event applies to a person, the person's current spouse or domestic partner, or another individual, if the person would have been a parent of a child born as a result of the pregnancy.

(b) (1) It shall be an unlawful employment practice for an employer to refuse to grant a request by any employee to take up to five days of reproductive loss leave following a reproductive loss event. If an employee experiences more than one reproductive loss event within a 12-month period,
---
# Ch. 724

an employer shall not be obligated to grant a total amount of reproductive loss leave in excess of 20 days within a 12-month period.

(2) The employer shall allow the days an employee takes for reproductive loss leave to be nonconsecutive.

(3) (A) Except as provided in subparagraph (B), reproductive loss leave shall be completed within three months of the event entitling the employee to that leave under paragraph (1).

(B) Notwithstanding subparagraph (A), if, prior to or immediately following a reproductive loss event, an employee is on or chooses to go on leave from work pursuant to Section 12945, 12945.2, or any other leave entitlement under state or federal law, the employee shall complete their reproductive loss leave within three months of the end date of the other leave.

(4) (A) Reproductive loss leave shall be taken pursuant to any existing applicable leave policy of the employer.

(B) If there is no existing applicable leave policy, reproductive loss leave may be unpaid, except that an employee may use vacation, personal leave, accrued and available sick leave, or compensatory time off that is otherwise available to the employee.

(c) It shall be an unlawful employment practice for an employer to retaliate against an individual, including, but not limited to, refusing to hire, discharging, demoting, fining, suspending, expelling, or discriminating against, an individual because of either of the following:

(1) An individual’s exercise of the right to reproductive loss leave.

(2) An individual’s giving information or testimony as to their own reproductive loss leave, or another person’s reproductive loss leave, in an inquiry or proceeding related to rights guaranteed under this section.

(d) It shall be an unlawful employment practice for an employer to interfere with, restrain, or deny the exercise of, or the attempt to exercise, any right provided under this section.

(e) The employer shall maintain the confidentiality of any employee requesting leave under this section. Any information provided to the employer pursuant to this section shall be maintained as confidential and shall not be disclosed except to internal personnel or counsel, as necessary, or as required by law.

(f) An employee’s right to reproductive loss leave shall be construed as a separate and distinct right from any right under this part.

## SEC. 2.

The Legislature finds and declares that Section 1 of this act, which adds Section 12945.6 to the Government Code, imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:

The confidentiality provisions set forth in Section 1 further the need to protect the privacy rights of employees regarding a reproductive loss, and to protect the enforcement process related to violations of these provisions.
---
# Ch. 724

These limitations are needed in order to strike the proper balance between the privacy interests of the employee and the employee’s family, and the public’s right to access.

---

O

94


# SENATE BILL No. 893

**Introduced by Senator Padilla**

January 3, 2024

---

An act to add Chapter 5.1 (commencing with Section 11530) to Part 1 of Division 3 of Title 2 of the Government Code, relating to artificial intelligence.

---

## LEGISLATIVE COUNSEL’S DIGEST

**SB 893, as introduced, Padilla. California Artificial Intelligence Research Hub.**

Existing law requires the Secretary of Government Operations to develop a coordinated plan to, among other things, investigate the feasibility of, and obstacles to, developing standards and technologies for state departments to determine digital content provenance. For the purpose of informing that coordinated plan, existing law requires the secretary to evaluate, among other things, the impact of the proliferation of deepfakes, defined to mean audio or visual content that has been generated or manipulated by artificial intelligence that would falsely appear to be authentic or truthful and that features depictions of people appearing to say or do things they did not say or do without their consent, on state government, California-based businesses, and residents of the state.

This bill would require the Government Operations Agency, the Governor’s Office of Business and Economic Development, and the Department of Technology to collaborate to establish the California Artificial Intelligence Research Hub (hub) in the Government Operations Agency. The bill would require the hub to serve as a centralized entity to facilitate collaboration between government agencies, academic institutions, and private sector partners to advance artificial intelligence research and development that seeks to harness the technology’s full potential.

---

99
---

potential for public benefit while safeguarding privacy, advancing security, and addressing risks and potential harms to society, as prescribed.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1. This act shall be known as the California Artificial Intelligence Research Hub Act.

SEC. 2. Chapter 5.1 (commencing with Section 11530) is added to Part 1 of Division 3 of Title 2 of the Government Code, to read:

# Chapter 5.1. California Artificial Intelligence Research Hub

11530. (a) As used in this section, “the hub” means the California Artificial Intelligence Research Hub.

(b) The Government Operations Agency, the Governor’s Office of Business and Economic Development, and the Department of Technology shall collaborate to establish the California Artificial Intelligence Research Hub in the Government Operations Agency.

(c) The hub shall serve as a centralized entity to facilitate collaboration between government agencies, academic institutions, and private sector partners to advance artificial intelligence research and development that seeks to harness the technology’s full potential for public benefit while safeguarding privacy, advancing security, and addressing risks and potential harms to society.

(d) The Government Operations Agency, the Governor’s Office of Business and Economic Development, and the Department of Technology shall consult with academic institutions within the state in establishing the hub.

(e) The hub shall do all of the following:
1. (A) Increase lawful access to government data while protecting privacy and safeguarding access to data by developing a streamlined process for researchers to access data collected by state agencies.
   (B) In complying with subparagraph (A), the hub shall create a process for eligibility that prioritizes security by limiting who can access the data and for what purpose.

---
```
(2) Support the access to, and development of, artificial
intelligence computing capacity and technology by building out
public computing infrastructure, facilitating access to existing
commercial computing infrastructure, or finding ways to reduce
costs and other economic barriers research institutions may face
in accessing computing infrastructure.
(3) Spur innovation in artificial intelligence applications for the
benefit of the public.
(4) Ensure the development of trustworthy artificial intelligence
technologies with a focus on transparency, fairness, and
accountability.
(5) Provide researchers with increased access to data and
computing resources, education, and training opportunities in
furtherance of applications of artificial intelligence for benefit to
the people of California.

O
```


# SENATE BILL No. 896

**Introduced by Senator Dodd**

January 3, 2024

---

An act to add Chapter 5.9 (commencing with Section 11549.63) to Part 1 of Division 3 of Title 2 of the Government Code, relating to artificial intelligence.

---

## LEGISLATIVE COUNSEL’S DIGEST

**SB 896**, as introduced, Dodd. Artificial Intelligence Accountability Act.

Existing law requires the Secretary of Government Operations to develop a coordinated plan to, among other things, investigate the feasibility of, and obstacles to, developing standards and technologies for state departments to determine digital content provenance. For the purpose of informing that coordinated plan, existing law requires the secretary to evaluate, among other things, the impact of the proliferation of deepfakes, defined to mean audio or visual content that has been generated or manipulated by artificial intelligence that would falsely appear to be authentic or truthful and that features depictions of people appearing to say or do things they did not say or do without their consent, on state government, California-based businesses, and residents of the state.

This bill, the Artificial Intelligence Accountability Act, would, among other things, require the Government Operations Agency, the Department of Technology, and the Office of Data and Innovation to produce a State of California Benefits and Risk of Generative Artificial Intelligence Report that includes certain items, including an examination of the most significant, potentially beneficial uses for deployment of generative artificial intelligence tools by the state, and would require those entities to update the report, as prescribed. The bill would require,
---
# SB 896

as often as is deemed appropriate by the Director of Emergency Services, the California Cybersecurity Integration Center, and the State Threat Assessment Center, those entities to perform a joint risk analysis of potential threats posed by the use of generative artificial intelligence to California’s critical energy infrastructure, including those that could lead to mass casualty events and environmental emergencies.

This bill would also require a state agency or department that utilizes generative artificial intelligence to directly communicate with a person, either through an online interface or telephonically, to clearly and in a conspicuous manner identify to that person that the person’s interaction with the state agency or department is being communicated through artificial intelligence.

This bill would also require an automated decisionmaking system, as defined, utilized by a state agency or department to be evaluated for risk potential before adoption, as specified.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.

The people of the State of California do enact as follows:

## SECTION 1.
This act shall be known as the Artificial Intelligence Accountability Act.

## SEC. 2.
Chapter 5.9 (commencing with Section 11549.63) is added to Part 1 of Division 3 of Title 2 of the Government Code, to read:

### Chapter 5.9. Artificial Intelligence Tools

#### 11549.63.
The Legislature finds and declares all of the following:
(a) The Legislature recognizes the tremendous potential of artificial intelligence (AI) to improve the lives of its citizens and the functioning of government. However, the Legislature also recognizes that the use of AI must be guided by principles of fairness, transparency, privacy, and accountability to ensure that the rights and opportunities of all Californians are protected in the age of artificial intelligence.
(b) The Legislature further recognizes that generative artificial intelligence (GenAI) enables significant, beneficial uses through its unique capabilities, but GenAI raises novel risks compared to
---

conventional AI across critical areas, including democratic and legal processes, biases and equity, public health and safety, and the economy, and requires measures to address insufficiently guarded governmental systems and unintended or emergent harmful effects from this technology. Additionally, because humans have explicit and implicit biases built into our society, GenAI has the capacity to amplify these biases as it learns from input data. Therefore, it is imperative to consider the implications on Californians of, among other categories, different regions, income, races, ethnicities, gender, ages, religions, abilities, and sexual orientation for all GenAI inputs, outputs, and products for both prioritizing implementations that may promote equity and guarding against bias and other negative impacts.

(c) No individual or group should be discriminated against on the basis of race, gender, age, religion, sexual orientation, or any other protected characteristic in the design, development, deployment, or use of AI systems. The unprecedented speed of innovation and deployment of GenAI technologies necessitates proactive guardrails to protect against potential risks or malicious uses, including, but not limited to, bioterrorism, cyberattacks, disinformation, deception, violation of privacy, and discrimination or bias.

(d) The Legislature affirms the importance of transparency in the use of AI systems. The public has the right to know when they are interacting with AI being used by the state and to have a clear and conspicuous identification of that interaction.

(e) The Legislature recognizes that the use of AI systems must be consistent with the protection of privacy and civil liberties and must be guided by a commitment to equity and social justice. It is the intent of the Legislature in enacting this legislation that all AI systems be designed and deployed in a manner that is consistent with state and federal laws and regulations regarding privacy and civil liberties and minimizes bias and promotes equitable outcomes for all Californians.

(f) This act, in addition to the 2022 White House Blueprint for an AI Bill of Rights, executive guidance from the governor, statutory or regulatory requirements, and evolving best practices should guide the decisionmaking of state agencies, departments, and subdivisions in the review, adoption, management, governance, and regulations of automated decisionmaking technologies. Further,

---
# SB 896

1. State leadership on adopting these standards and best practices should encourage the private sector to adopt these practices and safeguards.
2. (g) Public colleges and universities should collaborate with the private sector and relevant state agencies to train students to meet the AI workforce development needs of the state, including providing instruction on AI and related ethical, privacy, and security considerations while advancing research on best practices.
3. Further, there is the need for the state to recruit, retain, and train AI professionals in certain state jobs, and agencies should collaborate to facilitate a pipeline and infrastructure to accomplish that goal, including adopting appropriate job classifications and incentive programs.
4. (h) State agencies, departments, and boards should utilize their full range of authority to protect consumers, patients, passengers, and students from fraud, discrimination, and threats to privacy and to address other risks that may arise from the use of GenAI, including risks to financial stability. State agencies, departments, and boards should consider rulemaking and emphasize or clarify if existing regulations and guidance apply to GenAI or other automated decisionmaking systems. They should also clarify any responsibility of regulated entities to conduct due diligence with respect to third-party AI services they use and emphasize or clarify requirements and expectations related to the transparency of AI models and regulated entities' ability to explain their use of AI models.
5. (i) The California Privacy Protection Agency should utilize its existing authority to promulgate automated decisionmaking technology regulations.

## 11549.64. As used in this chapter:
(a) (1) “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons.
(2) “Automated decision system” does not mean a spam email filter, firewall, antivirus software, identity and access management tool, calculator, database, dataset, or other compilation of data.
---
# SB 896

(b) “Generative artificial intelligence” means the class of artificial intelligence models that emulate the structure and characteristics of input data in order to generate derived synthetic content, including images, videos, audio, text, and other digital content.

(c) “High-risk automated decision system” means an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice.

(d) “Person” means a natural person.

(e) “Report” means the State of California Benefits and Risk of Generative Artificial Intelligence Report required by Section 11549.65.

11549.65. (a) (1) The Government Operations Agency, the Department of Technology, and the Office of Data and Innovation shall produce a State of California Benefits and Risk of Generative Artificial Intelligence Report that includes all of the following:
  (A) An examination of the most significant, potentially beneficial uses for deployment of generative artificial intelligence tools by the state.
  (B) An explanation of the potential risks of the uses described in subparagraph (A) to individuals, communities, and government workers with a focus on high-risk uses, including the use of generative artificial intelligence to make a consequential decision affecting access to essential goods and services.
  (C) An explanation of risks from bad actors and insufficiently guarded governmental systems, unintended or emergent effects, and potential risks toward democratic and legal processes, public health and safety, and the economy.

(2) The Government Operations Agency, the Department of Technology, and the Office of Data and Innovation shall update the report, as needed, to respond to significant developments and shall, as appropriate, consult with academia, industry experts, and organizations that represent state government employees.

(b) (1) (A) As often as is deemed appropriate by the Director of Emergency Services, the California Cybersecurity Integration Center, and the State Threat Assessment Center, those entities shall perform a joint risk analysis of potential threats posed by the
---
```
use of generative artificial intelligence to California’s critical energy infrastructure, including those that could lead to mass casualty events and environmental emergencies.

(B) The entities described in subparagraph (A) shall develop, in consultation with appropriate external experts from academia and industry, a strategy to assess similar potential threats to other critical infrastructure.

(2) The analysis required by paragraph (1) shall be provided to the Governor, and, if appropriate, public recommendations shall be made reflecting changes to artificial intelligence technology, its applications, and risk management, including further private actions, administrative actions, and collaboration with the Legislature to guard against potential threats and vulnerabilities.

(c) (1) (A) The Government Operations Agency, the Department of General Services, the Department of Technology, and the California Cybersecurity Integration Center shall develop, maintain, and periodically evaluate and revise general guidelines for public sector procurement, uses, and required trainings for the use of generative artificial intelligence, including for high-risk scenarios, and including for consequential decisions affecting access to essential goods and services.

(B) The guidelines required by this paragraph shall build on guidance from the White House publication titled Blueprint for an AI Bill of Rights and the National Institute of Standards and Technology’s AI Risk Management Framework and shall address safety, algorithmic discrimination, data privacy, and notice of when materials are generated by generative artificial intelligence.

(C) The Government Operations Agency shall engage and consult with organizations that represent state government employees and industry experts, including, but not limited to, trust and safety experts, academic researchers, and research institutions in developing the guidelines required by this paragraph.

(2) For purposes of the periodic evaluation and revision required by paragraph (1), the Government Operations Agency, the Department of General Services, the Department of Technology, and the California Cybersecurity Integration Center shall periodically evaluate any need to revise the guidelines and establish a consultative process by which to do so with academia, industry experts, and organizations that represent state government employees.
```
---

1  (d) (1) (A) The Government Operations Agency, the
2  Department of Technology, and the Office of Data and Innovation
3  shall develop, maintain, and periodically evaluate and revise
4  guidelines for state agencies and departments to analyze the impact
5  that adopting a generative artificial intelligence tool may have on
6  vulnerable communities, including criteria to evaluate equitable
7  outcomes in deployment and implementation of high-risk uses.
8  (B) The guidelines required by this paragraph shall inform
9  whether and how a state agency or department deploys a particular
10 generative artificial intelligence tool.
11 (C) The Government Operations Agency shall engage and
12 consult with organizations that represent state government
13 employees and industry experts, including, but not limited to, trust
14 and safety experts, academic researchers, and research institutions
15 in developing the guidelines required by this paragraph.
16 (2) For purposes of the periodic evaluation and revision required
17 by paragraph (1), the Government Operations Agency, the
18 Department of General Services, the Department of Technology,
19 and the California Cybersecurity Integration Center shall
20 periodically evaluate any need to revise the guidelines and establish
21 a consultative process by which to do so with academia, industry
22 experts, and organizations that represent state government
23 employees.
24 (e) The Government Operations Agency, the Department of
25 General Services, and the Department of Technology shall update,
26 as needed, the state’s project approval, procurement, and contract
27 terms to incorporate analysis and feedback obtained pursuant to
28 subdivisions (c) and (d).
29 (f) (1) To assist the Government Operations Agency and the
30 Department of Technology in their efforts to perform any periodic
31 review and update under this section, all state agencies and
32 departments shall, as requested by the Government Operations
33 Agency or the Department of Technology, conduct and submit an
34 inventory of all current high-risk uses of generative artificial
35 intelligence within the agency or department to the Department of
36 Technology, which shall administer the inventory.
37 (2) A state agency or department shall appoint a senior level
38 management personnel who will be responsible for maintaining,
39 conducting, and reporting the results of the inventory described
40 by paragraph (1) to the Department of Technology within 60 days

---
```
of issuance of a request for an inventory pursuant to paragraph (1).

(g) Any state agency or department shall consider procurement and enterprise use opportunities in which generative artificial intelligence can improve the efficiency, effectiveness, accessibility, and equity of government operations consistent with the Government Operations Agency, the Department of General Services, and the Department of Technology’s guidelines for public sector generative artificial intelligence procurement.

(h) (1) The Department of Technology shall establish and maintain the infrastructure to conduct pilot projects of generative artificial intelligence projects, including Department of Technology-approved environments to test those pilot projects.

(2) An environment created pursuant to this subdivision shall be available to any state agency or department to help evaluate generative artificial intelligence tools and services, to further safe, ethical, and responsible implementations, and to inform decisions to use generative artificial intelligence consistent with state guidelines.

(i) (1) By July 1, ____, any state agency or department shall consider pilot projects of generative artificial intelligence applications, in consultation with organizations that represent state government employees and appropriate experts from academia and industry.

(2) A pilot project described by paragraph (1) shall measure both of the following:
(A) How generative artificial intelligence can improve Californians’ experience with, and access to, government services.
(B) How generative artificial intelligence can support state employees in the performance of their duties in addition to any domain-specific impacts to be measured by the state agency or department.

(j) The Government Operations Agency, the Department of General Services, the Department of Technology, the Office of Data and Innovation, and the California Cybersecurity Integration Center shall engage with the Legislature and relevant stakeholders, including historically vulnerable and marginalized communities and organizations that represent state government employees, in the development and revision of any guidelines, criteria, reports, or training pursuant to this section.
```
---
# SB 896

(k) A state agency or department shall support the state government workforce and prepare for the next generation of skills needed to thrive in the generative artificial intelligence economy by complying with both of the following:

1. (1) The Government Operations Agency, the Department of Technology, and any other agencies deemed necessary shall make available trainings for state government worker use of state-approved generative artificial intelligence tools to achieve equitable outcomes and to identify and mitigate potential output inaccuracies, fabricated text, hallucinations, and biases of generative artificial intelligence, while enforcing public privacy and applicable state laws and policies. If appropriate, the Department of Technology and any other agency or department deemed necessary shall collaborate with organizations that represent state government employees and industry experts on developing and providing training.
2. (2) The Government Operations Agency, in consultation with appropriate state agencies and organizations that represent state government employees, shall establish criteria to evaluate the impact of generative artificial intelligence on the state government workforce and provide guidelines on how state agencies and departments can support state government employees to use these tools effectively and respond to these technological advancements.
   - (i) Legal counsel for any state agency or department shall consider any potential impact of generative artificial intelligence on regulatory issues under the respective agency’s or department’s authority and recommend necessary updates, if appropriate, as a result of this evolving technology.

11549.66. (a) A state agency or department that utilizes generative artificial intelligence to directly communicate with a person, either through an online interface or telephonically, shall clearly and in a conspicuous manner identify to that person that the person’s interaction with the state agency or department is being communicated through artificial intelligence.

(b) A state agency or department that utilizes generative artificial intelligence to directly communicate with a person shall provide on the state agency’s or department’s internet website clear instructions, or a link to a web page with clear instructions, informing the person how to directly communicate with a person from the state agency or department.
---
# SB 896

11549.67. (a) (1) An automated decisionmaking system utilized by a state agency or department shall be evaluated for risk potential before adoption.

(2) A highrisk automated decision system shall receive appropriate consultation, testing, risk identification, and mitigation consistent with this chapter and shall not be adopted or utilized without prior approval of the director of a state agency or department or that person’s designee before being adopted and utilized by a state agency or department.

(b) A highrisk automated decision system that is utilized by a state agency or department shall receive ongoing monitoring and clear organizational oversight.


# Senate Concurrent Resolution No. 17

## RESOLUTION CHAPTER 135

Senate Concurrent Resolution No. 17—Relative to artificial intelligence.

[Filed with Secretary of State August 23, 2023.]

## LEGISLATIVE COUNSEL’S DIGEST

SCR 17, Dodd. Artificial intelligence.
This measure would affirm the California Legislature’s commitment to President Biden’s vision for a safe AI and the principles outlined in the “Blueprint for an AI Bill of Rights” and would express the Legislature’s commitment to examining and implementing those principles in its legislation and policies related to the use and deployment of automated systems.

**WHEREAS**, The use of technology, data, and automated systems poses significant challenges to democracy and the rights of the public, as evidenced by incidents of unsafe, ineffective, or biased systems in health care, discriminatory algorithms in hiring and credit decisions, and unchecked data collection that threatens privacy and opportunities; and
**WHEREAS**, Automated systems also have the potential to bring about extraordinary benefits, including increasing efficiency in agriculture and revolutionizing industries through data analysis; and
**WHEREAS**, President Joseph R. Biden has affirmed civil rights and democratic values as a cornerstone of his administration and has ordered the federal government to work toward rooting out inequity and advancing civil rights, equal opportunity, and racial justice; and
**WHEREAS**, The White House Office of Science and Technology Policy has developed the “Blueprint for an AI Bill of Rights,” a set of five principles to guide the design, use, and deployment of automated systems in a manner that protects the rights of the public while leveraging the benefits of AI; now, therefore, be it
**Resolved by the Senate of the State of California, the Assembly thereof concurring**, That the California Legislature affirms its commitment to President Biden’s vision for safe AI and the principles outlined in the “Blueprint for an AI Bill of Rights,” including: Safe and Effective Systems, Algorithmic Discrimination Protections, Data Privacy, Notice and Explanation, and Human Alternatives, Consideration, and Fallback; and be it further
**Resolved**, That the California Legislature commits to examining and implementing these principles in its legislation and policies related to the use and deployment of automated systems in the State of California; and be it further
---
# Res. Ch. 135

Resolved, That the Secretary of the Senate transmit copies of this resolution to the author for appropriate distribution.

---

O

97


# Chapter 455

(Senate Bill 541)

AN ACT concerning

# Maryland Online Data Privacy Act of 2024

FOR the purpose of regulating the manner in which a controller or a processor in possession of a consumer’s personal data may process the consumer’s personal data; authorizing a consumer to exercise certain rights in regards to the consumer’s personal data; requiring a controller of personal data to establish a method for a consumer to exercise certain rights in regards to the consumer’s personal data; requiring a controller to comply with a request by a consumer to exercise a certain right in a certain manner, except under certain circumstances; authorizing a consumer to designate an authorized agent to act on the consumer’s behalf to opt out of the processing of the consumer’s personal data; requiring a controller to provide a consumer with a certain privacy notice; requiring a controller that uses a processor to process the personal data of consumers to enter into a contract with the processor that governs the processor’s data processing procedures; requiring a controller to conduct and document a data protection assessment for consumer data processing activities that present a heightened risk of harm to a consumer; making a violation of this Act an unfair, abusive, or deceptive trade practice that is subject to enforcement and penalties under the Maryland Consumer Protection Act; and generally relating to online data privacy.

BY repealing and reenacting, with amendments,
Article – Commercial Law
Section 13–301(14)(xl)
Annotated Code of Maryland
(2013 Replacement Volume and 2023 Supplement)

BY repealing and reenacting, without amendments,
Article – Commercial Law
Section 13–301(14)(xli)
Annotated Code of Maryland
(2013 Replacement Volume and 2023 Supplement)

BY adding to
Article – Commercial Law
Section 13–301(14)(xlii); and 14–4601 through 14–4613 14–4614 to be under the new subtitle “Subtitle 46. Online Data Privacy Act”
Annotated Code of Maryland
(2013 Replacement Volume and 2023 Supplement)

SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, That the Laws of Maryland read as follows:
---
# Article – Commercial Law

## 13–301.

Unfair, abusive, or deceptive trade practices include any:

(14) Violation of a provision of:

   (xl) Title 14, Subtitle 13 of the Public Safety Article; [or]

   (xli) Title 14, Subtitle 45 of this article; or

   (XLII) TITLE 14, SUBTITLE 46 OF THIS ARTICLE; OR

   SUBTITLE 46. ONLINE DATA PRIVACY ACT.

## 14–4601.

(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS INDICATED.

(B) “AFFILIATE” MEANS A PERSON THAT, DIRECTLY OR INDIRECTLY THROUGH ONE OR MORE INTERMEDIARIES, CONTROLS, IS CONTROLLED BY, OR IS UNDER COMMON CONTROL WITH ANOTHER PERSON, SUCH THAT THE PERSON:

   ~(1) SHARES COMMON BRANDING WITH ANOTHER PERSON; OR~

   ~(2) CONTROLS, IS CONTROLLED BY, OR IS UNDER COMMON CONTROL WITH ANOTHER PERSON.~

   (1) OWNS OR HAS THE POWER TO VOTE MORE THAN 50% OF THE OUTSTANDING SHARES OF ANY VOTING CLASS OF THE OTHER PERSON’S SECURITIES;

   (2) HAS THE POWER TO ELECT OR INFLUENCE THE ELECTION OF A MAJORITY OF THE DIRECTORS, MEMBERS, OR MANAGERS OF THE OTHER PERSON;

   (3) HAS THE POWER TO DIRECT THE MANAGEMENT OF THE OTHER PERSON; OR

   (4) IS SUBJECT TO THE OTHER PERSON’S EXERCISE OF THE POWERS DESCRIBED IN ITEM (1), (2), OR (3) OF THIS SUBSECTION.
---
# WES MOORE, Governor Ch. 455

(C) "AUTHENTICATE" MEANS TO USE REASONABLE MEANS TO DETERMINE THAT A REQUEST TO EXERCISE A CONSUMER RIGHT IN ACCORDANCE WITH § 14–4605 OF THIS SUBTITLE IS BEING MADE BY, OR ON BEHALF OF, A CONSUMER WHO IS ENTITLED TO EXERCISE THE CONSUMER RIGHT WITH RESPECT TO THE PERSONAL DATA AT ISSUE.

(D) (1) "BIOMETRIC DATA" MEANS DATA GENERATED BY AUTOMATIC MEASUREMENTS OF THE BIOLOGICAL CHARACTERISTICS OF A CONSUMER THAT CAN BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY.

(2) "BIOMETRIC DATA" INCLUDES:

   (I) A FINGERPRINT;

   (II) A VOICE PRINT;

   (III) AN EYE RETINA OR IRIS IMAGE; AND

   (IV) ANY OTHER UNIQUE BIOLOGICAL CHARACTERISTICS THAT CAN BE USED TO UNIQUELY AUTHENTICATE A CONSUMER’S IDENTITY.

(3) "BIOMETRIC DATA" DOES NOT INCLUDE:

   (I) A DIGITAL OR PHYSICAL PHOTOGRAPH;

   (II) AN AUDIO OR VIDEO RECORDING; OR

   (III) ANY DATA GENERATED FROM A DIGITAL OR PHYSICAL PHOTOGRAPH OR AN AUDIO OR VIDEO RECORDING, UNLESS THE DATA IS GENERATED TO IDENTIFY A SPECIFIC CONSUMER.

(E) "BUSINESS ASSOCIATE" HAS THE MEANING STATED IN HIPAA.

(F) "CHILD" HAS THE MEANING STATED IN COPPA.

(G) (1) "CONSENT" MEANS A CLEAR AFFIRMATIVE ACT SIGNIFYING A CONSUMER’S FREELY GIVEN, SPECIFIC, INFORMED, AND UNAMBIGUOUS AGREEMENT TO ALLOW THE PROCESSING OF PERSONAL DATA RELATING TO THE CONSUMER FOR A PARTICULAR PURPOSE.

(2) "CONSENT" INCLUDES:

   (I) A WRITTEN STATEMENT;

---

- 3 -
---
# 2024 LAWS OF MARYLAND

(II) A WRITTEN STATEMENT BY ELECTRONIC MEANS; OR

(III) ANY OTHER UNAMBIGUOUS AFFIRMATIVE ACTION.

(3) "CONSENT" DOES NOT INCLUDE:

(I) ACCEPTANCE OF A GENERAL OR BROAD TERMS OF USE OR SIMILAR DOCUMENT THAT CONTAINS DESCRIPTIONS OF PERSONAL DATA PROCESSING ALONG WITH OTHER UNRELATED INFORMATION;

(II) HOVERING OVER, MUTING, PAUSING, OR CLOSING A PIECE OF CONTENT; OR

(III) AGREEMENT OBTAINED THROUGH THE USE OF DARK PATTERNS.

(H) (1) "CONSUMER" MEANS AN INDIVIDUAL WHO IS A RESIDENT OF THE STATE.

(2) "CONSUMER" DOES NOT INCLUDE:

(I) AN INDIVIDUAL ACTING IN A COMMERCIAL OR EMPLOYMENT CONTEXT; OR

(II) AN INDIVIDUAL ACTING AS AN EMPLOYEE, AN OWNER, A DIRECTOR, AN OFFICER, OR A CONTRACTOR OF A COMPANY, A PARTNERSHIP, A SOLE PROPRIETORSHIP, A NONPROFIT ORGANIZATION, OR A GOVERNMENTAL UNIT WHOSE COMMUNICATIONS OR TRANSACTIONS WITH A CONTROLLER OCCUR ONLY WITHIN THE CONTEXT OF THE INDIVIDUAL'S ROLE WITH THE COMPANY, PARTNERSHIP, SOLE PROPRIETORSHIP, NONPROFIT ORGANIZATION, OR GOVERNMENTAL UNIT.

(I) (1) "CONSUMER HEALTH DATA" MEANS PERSONAL DATA THAT A CONTROLLER USES TO IDENTIFY A CONSUMER'S PHYSICAL OR MENTAL HEALTH STATUS.

(2) "CONSUMER HEALTH DATA" INCLUDES DATA RELATED TO:

(I) GENDER–AFFIRMING CARE TREATMENT; OR

(II) REPRODUCTIVE OR SEXUAL HEALTH CARE.

(J) "CONTROL" MEANS:
---
# WES MOORE, Governor Ch. 455

1. OWNERSHIP OF OR THE POWER TO VOTE MORE THAN 50% OF THE OUTSTANDING SHARES OF ANY CLASS OF VOTING SECURITY OF A BUSINESS;

2. ANY MANNER OF CONTROL OVER THE ELECTION OF A MAJORITY OF THE DIRECTORS OF A BUSINESS, OR INDIVIDUALS EXERCISING SIMILAR FUNCTIONS; OR

3. THE POWER TO EXERCISE A CONTROLLING INFLUENCE OVER THE MANAGEMENT OF A BUSINESS.

(K) “CONTROLLER” MEANS A PERSON THAT, ALONE OR JOINTLY WITH OTHERS, DETERMINES THE PURPOSE AND MEANS OF PROCESSING PERSONAL DATA.

(L) (1) “COPPA” MEANS THE FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT OF 1998 AND THE REGULATIONS, RULES, GUIDANCE, AND EXEMPTIONS ADOPTED UNDER THE ACT, AND AS THE ACT AND THE REGULATIONS, RULES, GUIDANCE, AND EXEMPTIONS MAY BE AMENDED.

(2) “COPPA” INCLUDES REGULATIONS ADOPTED UNDER THE FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT OF 1998.

(M) “COVERED ENTITY” HAS THE MEANING STATED IN HIPAA.

(N) (1) “DARK PATTERN” MEANS A USER INTERFACE DESIGNED OR MANIPULATED WITH THE SUBSTANTIAL EFFECT OF SUBVERTING USER AUTONOMY, DECISION MAKING, OR CHOICE.

(2) “DARK PATTERN” INCLUDES ANY PRACTICE THE FEDERAL TRADE COMMISSION REFERS TO AS A “DARK PATTERN”.

(O) “DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING THE CONSUMER” MEANS DECISIONS THAT RESULT IN THE PROVISION OR DENIAL OF:

1. FINANCIAL OR LENDING SERVICES;

2. HOUSING;

3. INSURANCE;

4. EDUCATION ENROLLMENT OR OPPORTUNITY;

5. CRIMINAL JUSTICE;

- 5 -
---
# 2024 LAWS OF MARYLAND

(6) (5) EMPLOYMENT OPPORTUNITIES;

(7) (6) HEALTH CARE SERVICES; OR

(8) (7) ACCESS TO ESSENTIAL GOODS OR SERVICES.

(P) “DE–IDENTIFIED DATA”

~~MEANS DATA THAT CANNOT REASONABLY BE USED TO INFER INFORMATION ABOUT OR OTHERWISE BE LINKED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER, OR A DEVICE THAT MAY BE LINKED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER, IF THE CONTROLLER THAT POSSESSES THAT INFORMATION~~

(1) TAKES REASONABLE MEASURES TO ENSURE THAT THE INFORMATION CANNOT BE LINKED WITH A CONSUMER;

(2) COMMITS IN PUBLICLY AVAILABLE TERMS AND CONDITIONS OR IN A PUBLICLY AVAILABLE PRIVACY POLICY TO MAINTAIN AND USE THE INFORMATION IN DE–IDENTIFIED FORM; AND

(3) CONTRACTUALLY OBLIGES ANY RECIPIENTS OF THE INFORMATION TO COMPLY WITH ALL PROVISIONS OF THIS SUBSECTION HAS THE MEANING STATED IN § 14–4401 OF THIS TITLE.

(Q) “GENDER–AFFIRMING TREATMENT” HAS THE MEANING STATED IN § 15–151(A) OF THE HEALTH – GENERAL ARTICLE.

(Q) (R) (1) “GENETIC DATA”

~~MEANS DATA IN ANY FORMAT THAT CONCERNS THE GENETIC CHARACTERISTICS OF A CONSUMER.~~

(2) “GENETIC DATA” INCLUDES:

(I) RAW SEQUENCE DATA THAT RESULTS FROM SEQUENCING OF A CONSUMER’S COMPLETE EXTRACTED DNA OR A PORTION OF THE CONSUMER’S COMPLETE EXTRACTED DNA;

(II) GENOTYPIC AND PHENOTYPIC INFORMATION THAT RESULTS FROM ANALYZING RAW SEQUENCE DATA;

(III) INFORMATION EXTRAPOLATED, DERIVED, OR INFERRED FROM THE ANALYSIS OF RAW SEQUENCE DATA; AND

---

---
# WES MOORE, Governor Ch. 455

~~(IV) SELF-REPORTED HEALTH INFORMATION SUBMITTED TO A DIRECT-TO-CONSUMER GENETIC TESTING COMPANY BY A CONSUMER REGARDING THE CONSUMER'S HEALTH CONDITIONS~~

~~1. THAT IS USED FOR SCIENTIFIC RESEARCH OR PRODUCT DEVELOPMENT; AND~~

~~2. ANALYZED IN CONNECTION WITH THE CONSUMER'S RAW SEQUENCE DATA HAS THE MEANING STATED IN § 14-4401 OF THIS TITLE.~~

**(R) (S) (1) "Geofence" means technology that establishes a virtual geographical boundary.**

(2) "Geofence" includes boundaries that are established or monitored through the use of:

(I) Global positioning technology;

(II) Cell tower connectivity;

(III) Cellular data;

(IV) Radio frequency identification;

(V) Wireless fidelity technology; or

(VI) Any other form of location determination technology.

**(S) (T) "HIPAA" means the federal Health Insurance Portability and Accountability Act of 1996.**

**(T) (U) "Identified or identifiable consumer" means a consumer who can readily be identified, either directly or indirectly.**

**(U) (V) "Mental health facility" means a health care facility in which not less than 70% of health care services offered are mental health services.**

**(V) (W) (1) "Personal data" means any information that is linked or can be reasonably linked to an identified or identifiable consumer.**

(2) "Personal data" does not include:

- 7 -
---
# 2024 LAWS OF MARYLAND

(I) DE-IDENTIFIED DATA; OR

(II) PUBLICLY AVAILABLE INFORMATION.

(WW) (XX) (1) "PRECISE GEOLOCATION DATA" MEANS INFORMATION DERIVED FROM TECHNOLOGY THAT CAN PRECISELY AND ACCURATELY IDENTIFY THE SPECIFIC LOCATION OF A CONSUMER WITHIN A RADIUS OF 1,750 FEET.

(2) "PRECISE GEOLOCATION DATA" INCLUDES GLOBAL POSITIONING SYSTEM LEVEL LATITUDE AND LONGITUDE COORDINATES OR OTHER SIMILAR MECHANISMS.

(3) "PRECISE GEOLOCATION DATA" DOES NOT INCLUDE:

(I) THE CONTENT OF COMMUNICATIONS DATA;

(II) DATA GENERATED BY OR CONNECTED TO AN ADVANCED UTILITY METERING INFRASTRUCTURE SYSTEM; OR

(III) DATA GENERATED BY EQUIPMENT USED BY A UTILITY COMPANY.

(XX) (YY) (1) "PROCESS" MEANS AN OPERATION OR SET OF OPERATIONS PERFORMED BY MANUAL OR AUTOMATED MEANS ON PERSONAL DATA.

(2) "PROCESS" INCLUDES COLLECTING, USING, STORING, DISCLOSING, ANALYZING, DELETING, OR MODIFYING PERSONAL DATA.

(YY) (ZZ) "PROCESSOR" MEANS A PERSON THAT PROCESSES PERSONAL DATA ON BEHALF OF A CONTROLLER.

(ZZ) (AA) "PROFILING" MEANS ANY FORM OF AUTOMATED PROCESSING PERFORMED ON PERSONAL DATA TO EVALUATE, ANALYZE, OR PREDICT PERSONAL ASPECTS RELATED TO AN IDENTIFIED OR IDENTIFIABLE CONSUMER'S ECONOMIC SITUATION, HEALTH, DEMOGRAPHIC CHARACTERISTICS, PERSONAL PREFERENCES, INTERESTS, RELIABILITY, BEHAVIOR, LOCATION, OR MOVEMENTS.

(AA) (BB) "PROTECTED HEALTH INFORMATION" HAS THE MEANING STATED IN HIPAA.

(BB) (CC) (1) "PUBLICLY AVAILABLE INFORMATION" MEANS INFORMATION THAT A PERSON:

- 8 -
---
# WES MOORE, Governor Ch. 455

1. **LAWFULLY OBTAINS FROM A RECORD OF A GOVERNMENTAL ENTITY;**

2. **REASONABLY BELIEVES A CONSUMER OR WIDELY DISTRIBUTED MEDIA HAVE LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC; OR**

3. **IF THE CONSUMER HAS NOT RESTRICTED THE INFORMATION TO A SPECIFIC AUDIENCE, OBTAINS FROM A PERSON TO WHOM THE CONSUMER DISCLOSED THE INFORMATION.**

(2) “PUBLICLY AVAILABLE INFORMATION” DOES NOT INCLUDE BIOMETRIC DATA COLLECTED BY A BUSINESS ABOUT A CONSUMER WITHOUT THE CONSUMER’S KNOWLEDGE.

(DD) (1) “REPRODUCTIVE OR SEXUAL HEALTH CARE” MEANS CARE RELATED TO A HEALTH CARE–RELATED SERVICE OR PRODUCT RENDERED OR PROVIDED CONCERNING A CONSUMER’S REPRODUCTIVE SYSTEM OR SEXUAL WELL–BEING, INCLUDING:

(1) A SERVICE OR PRODUCT PROVIDED RELATED TO AN INDIVIDUAL HEALTH CONDITION, STATUS, DISEASE, DIAGNOSIS, TEST, OR TREATMENT;

(2) A SOCIAL, PSYCHOLOGICAL, BEHAVIORAL, OR MEDICAL INTERVENTION;

(3) A SURGERY OR PROCEDURE;

(4) THE PURCHASE OR USE OF A MEDICATION, INCLUDING A MEDICATION PURCHASED OR USED FOR THE PURPOSES OF AN ABORTION;

(5) A SERVICE OR PRODUCT RELATED TO A BODILY FUNCTION, VITAL SIGN, OR SYMPTOM;
---
# 2024 LAWS OF MARYLAND

(6) A MEASUREMENT OF A BODILY FUNCTION, VITAL SIGN, OR SYMPTOM; AND

(7) AN ABORTION, WHETHER SURGICAL OR MEDICAL, AND MEDICAL AND NONMEDICAL SERVICES, PRODUCTS, DIAGNOSTICS, COUNSELING, AND FOLLOW-UP SERVICES FOR AN ABORTION.

(EE) “REPRODUCTIVE OR SEXUAL HEALTH CARE FACILITY” MEANS A HEALTH CARE FACILITY WHERE NOT LESS THAN 70% OF SERVICES OFFERED ARE REPRODUCTIVE OR SEXUAL HEALTH CARE SERVICES.

(FF) (1) “SALE OF PERSONAL DATA” MEANS THE EXCHANGE OF PERSONAL DATA BY A CONTROLLER, A PROCESSOR, OR AN AFFILIATE OF A CONTROLLER OR PROCESSER TO A THIRD PARTY FOR MONETARY OR OTHER VALUABLE CONSIDERATION.

(2) “SALE OF PERSONAL DATA” DOES NOT INCLUDE:

   (I) THE DISCLOSURE OF PERSONAL DATA TO A PROCESSOR THAT PROCESSES PERSONAL DATA ON BEHALF OF A CONTROLLER IF LIMITED TO THE PURPOSES OF THE PROCESSING;

   (II) THE DISCLOSURE OF PERSONAL DATA TO A THIRD PARTY FOR PURPOSES OF PROVIDING A PRODUCT OR SERVICE AFFIRMATIVELY REQUESTED BY THE CONSUMER;

   (III) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO AN AFFILIATE OF THE CONTROLLER;

   (IV) THE DISCLOSURE OF PERSONAL DATA WHERE THE CONSUMER:

      1. DIRECTS THE CONTROLLER TO DISCLOSE THE PERSONAL DATA; OR

      2. INTENTIONALLY USES THE CONTROLLER TO INTERACT WITH A THIRD PARTY;
---
# WES MOORE, Governor Ch. 455

(V) THE DISCLOSURE OF PERSONAL DATA THAT THE CONSUMER:

1. INTENTIONALLY MADE AVAILABLE TO THE GENERAL PUBLIC THROUGH A CHANNEL OF MASS MEDIA; AND

2. DID NOT RESTRICT TO A SPECIFIC AUDIENCE; OR

(VI) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO A THIRD PARTY AS AN ASSET THAT IS PART OF AN ACTUAL OR PROPOSED MERGER, ACQUISITION, BANKRUPTCY, OR OTHER TRANSACTION WHERE THE THIRD PARTY ASSUMES CONTROL OF ALL OR PART OF THE CONTROLLER’S ASSETS.

(GG) “SENSITIVE DATA” MEANS PERSONAL DATA THAT INCLUDES:

(1) DATA REVEALING:
   (I) RACIAL OR ETHNIC ORIGIN;
   (II) RELIGIOUS BELIEFS;
   (III) CONSUMER HEALTH DATA;
   (IV) SEX LIFE;
   (V) SEXUAL ORIENTATION;
   (VI) STATUS AS TRANSGENDER OR NONBINARY;
   (VII) NATIONAL ORIGIN; OR
   (VIII) CITIZENSHIP OR IMMIGRATION STATUS;

(2) GENETIC DATA OR BIOMETRIC DATA;

(3) PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER KNOWS OR HAS REASON TO KNOW IS A CHILD; OR

(4) PRECISE GEOLOCATION DATA.

(HH) (1) “TARGETED ADVERTISING” MEANS DISPLAYING ADVERTISEMENTS TO A CONSUMER OR ON A DEVICE IDENTIFIED BY A UNIQUE IDENTIFIER, WHERE THE ADVERTISEMENT IS SELECTED BASED ON PERSONAL DATA OBTAINED OR INFERRED FROM THE CONSUMER’S ACTIVITIES OVER TIME AND
---
# 2024 LAWS OF MARYLAND

ACROSS NONAFFILIATED WEBSITES OR ONLINE APPLICATIONS THAT ARE UNAFFILIATED WITH EACH OTHER, IN ORDER TO PREDICT THE CONSUMER’S PREFERENCES OR INTERESTS.

(2) “TARGETED ADVERTISING” DOES NOT INCLUDE:

   (I) ADVERTISEMENTS BASED ON THE CONTEXT OF A CONSUMER’S CURRENT SEARCH QUERY, VISIT TO A WEBSITE, OR ONLINE APPLICATION;

   (II) ADVERTISEMENTS BASED ON A CONSUMER’S ACTIVITIES WITHIN A CONTROLLER’S WEBSITES OR ONLINE APPLICATIONS;

   (III) ADVERTISEMENTS DIRECTED TO A CONSUMER IN RESPONSE TO THE CONSUMER’S REQUEST FOR INFORMATION OR FEEDBACK; OR

   (IV) PROCESSING PERSONAL DATA SOLELY TO MEASURE OR REPORT ADVERTISING FREQUENCY, PERFORMANCE, OR REACH.

(II) “THIRD PARTY” MEANS A PERSON OTHER THAN THE RELEVANT CONSUMER, CONTROLLER, PROCESSOR, OR AFFILIATE OF THE CONTROLLER OR PROCESSOR OF RELEVANT PERSONAL DATA.

(II) “TRADE SECRET” MEANS INFORMATION THAT:

   (I) DERIVES INDEPENDENT ECONOMIC VALUE, ACTUAL OR POTENTIAL, FROM NOT BEING GENERALLY KNOWN TO, AND NOT BEING READILY ASCERTAINABLE BY PROPER MEANS BY, OTHER PERSONS WHO COULD OBTAIN ECONOMIC VALUE FROM THE INFORMATION’S DISCLOSURE OR USE; AND

   (II) IS THE SUBJECT OF EFFORTS THAT ARE REASONABLE UNDER THE CIRCUMSTANCES TO MAINTAIN THE SECRECY OF THE INFORMATION.

(2) “TRADE SECRET” INCLUDES A FORMULA, PATTERN, COMPILATION, PROGRAM, DEVICE, METHOD, TECHNIQUE, OR PROCESS HAS THE MEANING STATED IN § 11–1201 OF THIS ARTICLE.

14–4602.

THIS SUBTITLE APPLIES TO A PERSON THAT:

   (I) CONDUCTS BUSINESS IN THE STATE; OR
---
# WES MOORE, Governor Ch. 455

1. **CONDUCTS BUSINESS IN THE STATE OR PROVIDES PRODUCTS OR SERVICES THAT ARE TARGETED TO RESIDENTS OF THE STATE, AND THAT DURING THE PRECEDING CALENDAR YEAR DID ANY OF THE FOLLOWING:**

   (1) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION; OR

   (2) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA.

## 14-4603.

(A) THIS SUBTITLE DOES NOT APPLY TO:

   (1) A REGULATORY, ADMINISTRATIVE, ADVISORY, EXECUTIVE, APPOINTIVE, LEGISLATIVE, OR JUDICIAL BODY OR INSTRUMENTALITY OF THE STATE, INCLUDING A BOARD, BUREAU, COMMISSION, OR UNIT OF THE STATE OR A POLITICAL SUBDIVISION OF THE STATE;

   (2) A NATIONAL SECURITIES ASSOCIATION THAT IS REGISTERED UNDER § 15 OF THE FEDERAL SECURITIES EXCHANGE ACT OF 1934 OR A REGISTERED FUTURES ASSOCIATION DESIGNATED IN ACCORDANCE WITH § 17 OF THE FEDERAL COMMODITY EXCHANGE ACT;

   (3) A FINANCIAL INSTITUTION OR AN AFFILIATE OF A FINANCIAL INSTITUTION, OR DATA THAT IS SUBJECT TO TITLE V OF THE FEDERAL GRAMM–LEACH–BLILEY ACT AND REGULATIONS ADOPTED UNDER THAT ACT; OR

   (4) A NONPROFIT CONTROLLER THAT PROCESSES OR SHARES PERSONAL DATA SOLELY FOR THE PURPOSES OF ASSISTING:

      (I) LAW ENFORCEMENT AGENCIES IN INVESTIGATING CRIMINAL OR FRAUDULENT ACTS RELATING TO INSURANCE; OR

      (II) FIRST RESPONDERS IN RESPONDING TO CATASTROPHIC EVENTS.
---
# 2024 LAWS OF MARYLAND

**(B) THE FOLLOWING INFORMATION AND DATA ARE EXEMPT FROM THIS SUBTITLE:**

1. **PROTECTED HEALTH INFORMATION UNDER HIPAA;**

2. **PATIENT-IDENTIFYING INFORMATION FOR PURPOSES OF 42 U.S.C. § 290dd–2;**

3. **IDENTIFIABLE PRIVATE INFORMATION THAT IS USED FOR PURPOSES OF THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS IN ACCORDANCE WITH 45 C.F.R. § 46;**

4. **IDENTIFIABLE PRIVATE INFORMATION TO THE EXTENT THAT IT IS COLLECTED AND USED AS PART OF HUMAN SUBJECTS RESEARCH IN ACCORDANCE WITH THE ICH 36 GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY THE INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICAL REQUIREMENTS FOR PHARMACEUTICALS FOR HUMAN USE OR THE PROTECTION OF HUMAN SUBJECTS UNDER 21 C.F.R. §§ 50 AND 56;**

5. **PATIENT SAFETY WORK PRODUCT THAT IS CREATED AND USED FOR PURPOSES OF PATIENT SAFETY IMPROVEMENT IN ACCORDANCE WITH 42 C.F.R. § 3, ESTABLISHED IN ACCORDANCE WITH 42 U.S.C. §§ 299b–21 THROUGH 299b–26;**

6. **(I) INFORMATION TO THE EXTENT IT IS USED FOR PUBLIC HEALTH, COMMUNITY HEALTH, OR POPULATION HEALTH ACTIVITIES AND PURPOSES, AS AUTHORIZED BY HIPAA, WHEN PROVIDED BY OR TO A COVERED ENTITY OR WHEN PROVIDED BY OR TO A BUSINESS ASSOCIATE IN ACCORDANCE WITH THE BUSINESS ASSOCIATE AGREEMENT WITH A COVERED ENTITY;**

   **(II) INFORMATION THAT IS A MEDICAL RECORD UNDER § 4–301 OF THE HEALTH – GENERAL ARTICLE IF:**

   1. **THE INFORMATION IS HELD BY AN ENTITY THAT IS A COVERED ENTITY OR BUSINESS ASSOCIATE UNDER HIPAA BECAUSE IT COLLECTS, USES, OR DISCLOSES PROTECTED HEALTH INFORMATION; AND**

   2. **THE ENTITY APPLIES THE SAME STANDARDS FOR THE COLLECTION, USE, AND DISCLOSURE OF THE INFORMATION AS REQUIRED FOR PROTECTED HEALTH INFORMATION UNDER HIPAA AND MEDICAL RECORDS UNDER § 4–301 OF THE HEALTH – GENERAL ARTICLE, INCLUDING SPECIFIC STANDARDS REGARDING LEGALLY PROTECTED HEALTH CARE; AND**
---
# WES MOORE, Governor Ch. 455

### (III) INFORMATION THAT IS DE–IDENTIFIED IN ACCORDANCE WITH THE REQUIREMENTS FOR DE–IDENTIFICATION SET FORTH IN 45 C.F.R. 164.514 THAT IS DERIVED FROM INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION AS DESCRIBED IN HIPAA OR PERSONAL INFORMATION CONSISTENT WITH THE HUMAN SUBJECT PROTECTION REQUIREMENTS OF THE U.S. FOOD AND DRUG ADMINISTRATION;

(7) THE COLLECTION, MAINTENANCE, DISCLOSURE, SALE, COMMUNICATION, OR USE OF PERSONAL INFORMATION BEARING ON A CONSUMER’S CREDITWORTHINESS, CREDIT STANDING, CREDIT CAPACITY, CHARACTER, GENERAL REPUTATION, PERSONAL CHARACTERISTICS, OR MODE OF LIVING BY A CONSUMER REPORTING AGENCY, FURNISHER, OR USER THAT PROVIDES INFORMATION FOR USE IN A CONSUMER REPORT, AND BY A USER OF A CONSUMER REPORT, BUT ONLY TO THE EXTENT THAT THE ACTIVITY IS REGULATED BY AND AUTHORIZED UNDER THE FEDERAL FAIR CREDIT REPORTING ACT;

(8) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED IN COMPLIANCE WITH THE FEDERAL DRIVER’S PRIVACY PROTECTION ACT OF 1994;

(9) PERSONAL DATA REGULATED BY THE FEDERAL FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT;

(10) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED IN COMPLIANCE WITH THE FEDERAL FARM CREDIT ACT;

(11) DATA PROCESSED OR MAINTAINED:

   (I) IN THE COURSE OF AN INDIVIDUAL APPLYING TO, EMPLOYED BY, OR ACTING AS AN AGENT OR INDEPENDENT CONTRACTOR OF A CONTROLLER, PROCESSOR, OR THIRD PARTY, TO THE EXTENT THAT THE DATA IS COLLECTED AND USED WITHIN THE CONTEXT OF THE ROLE;

   (II) AS THE EMERGENCY CONTACT INFORMATION OF A CONSUMER IF THE DATA IS USED FOR EMERGENCY CONTACT PURPOSES; OR

   (III) THAT IS:

      1. NECESSARY TO RETAIN TO ADMINISTER BENEFITS FOR ANOTHER INDIVIDUAL RELATING TO THE CONSUMER WHO IS THE SUBJECT OF THE INFORMATION UNDER ITEM (I) OF THIS ITEM; AND

      2. USED FOR THE PURPOSES OF ADMINISTERING THE BENEFITS;

- 15 -
---
# 2024 LAWS OF MARYLAND

(12) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED IN RELATION TO PRICE, ROUTE, OR SERVICE BY AN AIR CARRIER SUBJECT TO THE FEDERAL AIRLINE DEREGULATION ACT TO THE EXTENT THIS SUBTITLE IS PREEMPTED BY THE FEDERAL AIRLINE DEREGULATION ACT; AND

(13) PERSONAL DATA BY OR ON BEHALF OF A PERSON REGULATED UNDER THE INSURANCE ARTICLE OR AN AFFILIATE OF SUCH A PERSON, IN FURTHERANCE OF THE BUSINESS OF INSURANCE.

(C) CONTROLLERS AND PROCESSORS THAT COMPLY WITH THE VERIFIABLE PARENTAL CONSENT REQUIREMENTS OF COPPA SHALL BE CONSIDERED COMPLIANT WITH AN OBLIGATION TO OBTAIN PARENTAL CONSENT IN ACCORDANCE WITH THIS SUBTITLE WITH RESPECT TO A CONSUMER WHO IS A CHILD.

## 14-4604.

A PERSON MAY NOT:

(1) PROVIDE AN EMPLOYEE OR A CONTRACTOR ACCESS TO CONSUMER HEALTH DATA UNLESS THE:

   (I) THE EMPLOYEE OR CONTRACTOR IS SUBJECT TO A CONTRACTUAL OR STATUTORY DUTY OF CONFIDENTIALITY; OR

   (II) CONFIDENTIALITY IS REQUIRED AS A CONDITION OF EMPLOYMENT OF THE EMPLOYEE;

(2) PROVIDE A PROCESSOR ACCESS TO CONSUMER HEALTH DATA UNLESS THE PERSON PROVIDING ACCESS TO THE CONSUMER HEALTH DATA AND THE PROCESSOR COMPLY WITH § 14-4608 OF THIS SUBTITLE; OR

(3) USE A GEOFENCE:

   (I) TO IDENTIFY, TRACK, COLLECT DATA FROM, OR SEND A NOTIFICATION TO A CONSUMER REGARDING THE CONSUMER'S CONSUMER HEALTH DATA; AND

   (II) WITHIN 1,750 FEET OF A MENTAL HEALTH FACILITY OR REPRODUCTIVE OR SEXUAL HEALTH FACILITY; OR
---
# 14-4605.

(A) NOTHING IN THIS SECTION MAY BE CONSTRUED TO REQUIRE A CONTROLLER TO REVEAL A TRADE SECRET.

(B) A CONSUMER SHALL HAVE THE RIGHT TO:

1. CONFIRM WHETHER A CONTROLLER IS PROCESSING THE CONSUMER’S PERSONAL DATA.

2. IF A CONTROLLER IS PROCESSING A CONSUMER’S PERSONAL DATA, ACCESS THE CONSUMER’S PERSONAL DATA.

3. CONSIDERING THE NATURE OF THE CONSUMER’S PERSONAL DATA AND THE PURPOSES OF THE PROCESSING OF THE PERSONAL DATA, CORRECT INACCURACIES IN THE CONSUMER’S PERSONAL DATA.

4. REQUIRE A CONTROLLER TO DELETE PERSONAL DATA PROVIDED BY, OR OBTAINED ABOUT, THE CONSUMER.

5. IF THE PROCESSING OF PERSONAL DATA IS DONE BY AUTOMATIC MEANS, OBTAIN A COPY OF THE CONSUMER’S PERSONAL DATA PROCESSED BY THE CONTROLLER IN A PORTABLE AND, TO THE EXTENT TECHNICALLY FEASIBLE, READILY USABLE FORMAT THAT ALLOWS THE CONSUMER TO EASILY TRANSMIT THE DATA TO ANOTHER CONTROLLER WITHOUT HINDRANCE.

6. OBTAIN A LIST OF THE CATEGORIES OF THIRD PARTIES TO WHICH THE CONTROLLER HAS DISCLOSED THE CONSUMER’S PERSONAL DATA OR A LIST OF THE CATEGORIES OF THIRD PARTIES TO WHICH THE CONTROLLER HAS DISCLOSED ANY CONSUMER’S PERSONAL DATA IF THE CONTROLLER DOES NOT MAINTAIN THIS INFORMATION IN A FORMAT SPECIFIC TO THE CONSUMER.
---
# 2024 LAWS OF MARYLAND

## Ch. 455

(7) OPT OUT OF THE PROCESSING OF PERSONAL DATA FOR PURPOSES OF:

   (I) TARGETED ADVERTISING;

   (II) THE SALE OF PERSONAL DATA; OR

   (III) PROFILING IN FURTHERANCE OF SOLELY AUTOMATED DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING THE CONSUMER.

(c) (1) A CONTROLLER SHALL ESTABLISH A SECURE AND RELIABLE METHOD FOR A CONSUMER TO EXERCISE A CONSUMER RIGHT UNDER THIS SECTION.

   (2) A CONSUMER MAY EXERCISE A CONSUMER RIGHT UNDER THIS SECTION BY THE METHOD ESTABLISHED BY THE CONTROLLER UNDER PARAGRAPH (1) OF THIS SUBSECTION.

(d) (1) A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT IN ACCORDANCE WITH § 14–4606 OF THIS SUBTITLE TO OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA UNDER SUBSECTION (B)(7) OF THIS SECTION ON BEHALF OF A CONSUMER.

   (2) A PARENT OR LEGAL GUARDIAN OF A CHILD MAY EXERCISE A CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE CHILD’S BEHALF REGARDING THE PROCESSING OF PERSONAL DATA.

   (3) A GUARDIAN OR CONSERVATOR OF A CONSUMER SUBJECT TO A GUARDIANSHIP, CONSERVATORSHIP, OR OTHER PROTECTIVE ARRANGEMENT MAY EXERCISE A CONSUMER RIGHT LISTED IN SUBSECTION (B) OF THIS SECTION ON THE CONSUMER’S BEHALF REGARDING THE PROCESSING OF PERSONAL DATA.

(e) (1) EXCEPT AS OTHERWISE PROVIDED IN THIS SUBTITLE, A CONTROLLER SHALL COMPLY WITH A REQUEST BY A CONSUMER TO EXERCISE A CONSUMER RIGHT LISTED IN THIS SECTION.

   (2) (I) A CONTROLLER SHALL RESPOND TO A CONSUMER REQUEST NOT LATER THAN 45 DAYS AFTER THE CONTROLLER RECEIVES THE CONSUMER REQUEST.

      (II) A CONTROLLER MAY EXTEND THE COMPLETION PERIOD BY AN ADDITIONAL 45 DAYS IF:

– 18 –
---
# WES MOORE, Governor Ch. 455

1. IT IS REASONABLY NECESSARY TO COMPLETE THE REQUEST BASED ON THE COMPLEXITY AND NUMBER OF THE CONSUMER'S REQUESTS; AND

2. THE CONTROLLER INFORMS THE CONSUMER OF THE EXTENSION AND THE REASON FOR THE EXTENSION WITHIN THE INITIAL 45-DAY RESPONSE PERIOD.

(3) IF A CONTROLLER DECLINES TO ACT REGARDING A CONSUMER'S REQUEST, THE CONTROLLER SHALL:

   (I) INFORM THE CONSUMER WITHOUT UNDUE DELAY, BUT NOT LATER THAN 45 DAYS AFTER RECEIVING THE REQUEST, OF THE JUSTIFICATION FOR DECLINING TO ACT; AND

   (II) PROVIDE INSTRUCTIONS FOR HOW TO APPEAL THE DECISION.

(4) (I) A CONTROLLER SHALL PROVIDE INFORMATION TO A CONSUMER IN RESPONSE TO A CONSUMER'S REQUEST TO EXERCISE RIGHTS UNDER THIS SUBTITLE FREE OF CHARGE ONCE DURING ANY 12-MONTH PERIOD.

   (II) IF REQUESTS FROM A CONSUMER ARE MANIFESTLY UNFOUNDED, EXCESSIVE, TECHNICALLY INFEASIBLE, OR REPETITIVE, A CONTROLLER MAY:

      1. CHARGE THE CONSUMER A REASONABLE FEE TO COVER THE ADMINISTRATIVE COSTS OF COMPLYING WITH THE REQUEST; OR

      2. DECLINE TO ACT ON THE REQUEST.

   (III) THE CONTROLLER HAS THE BURDEN OF DEMONSTRATING THE MANIFESTLY UNFOUNDED, EXCESSIVE, TECHNICALLY INFEASIBLE, OR REPETITIVE NATURE OF THE REQUEST.

(5) IF A CONTROLLER IS UNABLE TO AUTHENTICATE A REQUEST TO EXERCISE A CONSUMER RIGHT AFFORDED UNDER SUBSECTION (B)(1) THROUGH (5) OF THIS SECTION USING COMMERCIALLY REASONABLE EFFORTS, THE CONTROLLER:

- 19 -
---
# 2024 LAWS OF MARYLAND

(I) MAY NOT BE REQUIRED TO COMPLY WITH A REQUEST TO INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION; AND

(II) SHALL PROVIDE NOTICE TO THE CONSUMER THAT THE CONTROLLER IS UNABLE TO AUTHENTICATE THE REQUEST TO EXERCISE THE RIGHT UNTIL THE CONSUMER PROVIDES ADDITIONAL INFORMATION REASONABLY NECESSARY TO AUTHENTICATE THE CONSUMER AND THE CONSUMER'S REQUEST TO EXERCISE THE CONSUMER'S RIGHTS.

(6) A CONTROLLER MAY NOT BE REQUIRED TO AUTHENTICATE AN OPT-OUT REQUEST.

(7) A CONTROLLER THAT HAS OBTAINED PERSONAL DATA ABOUT A CONSUMER FROM A SOURCE OTHER THAN THE CONSUMER SHALL BE CONSIDERED COMPLIANT WITH THE CONSUMER'S REQUEST TO DELETE THE CONSUMER'S DATA IN ACCORDANCE WITH SUBSECTION (B)(4) OF THIS SECTION BY RETAINING A RECORD OF THE DELETION REQUEST AND THE MINIMUM DATA NECESSARY FOR THE PURPOSE OF ENSURING THAT THE CONSUMER'S PERSONAL DATA:

(I) REMAINS DELETED FROM THE CONTROLLER'S RECORDS; AND

(II) IS NOT BEING USED FOR ANY OTHER PURPOSE.

(f) (1) A CONTROLLER SHALL ESTABLISH A PROCESS FOR A CONSUMER TO APPEAL THE CONTROLLER'S REFUSAL TO ACT ON A CONSUMER RIGHTS REQUEST WITHIN A REASONABLE PERIOD AFTER THE CONSUMER RECEIVES THE DECISION.

(2) THE APPEAL PROCESS SHALL BE:

(I) CONSPICUOUSLY AVAILABLE; AND

(II) SIMILAR TO THE PROCESS FOR SUBMITTING REQUESTS TO INITIATE AN ACTION IN ACCORDANCE WITH THIS SECTION.

(3) NOT LATER THAN 60 DAYS AFTER RECEIVING AN APPEAL, A CONTROLLER SHALL INFORM THE CONSUMER IN WRITING OF ANY ACTION TAKEN OR NOT TAKEN IN RESPONSE TO THE APPEAL, INCLUDING A WRITTEN EXPLANATION OF THE REASONS FOR THE DECISIONS.

(4) IF A CONTROLLER DENIES AN APPEAL, THE CONTROLLER SHALL PROVIDE THE CONSUMER WITH AN ONLINE MECHANISM, IF AVAILABLE, THROUGH WHICH THE CONSUMER MAY CONTACT THE DIVISION TO SUBMIT A COMPLAINT.
---
# 14–4606.

(A) (1) A CONSUMER MAY DESIGNATE AN INDIVIDUAL TO SERVE AS THE CONSUMER’S AUTHORIZED AGENT AND ACT ON THE CONSUMER’S BEHALF TO OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR ONE OR MORE OF THE PURPOSES SPECIFIED IN § 14–4605(B)(7) OF THIS SUBTITLE.

(2) A CONSUMER MAY DESIGNATE AN AUTHORIZED AGENT BY AN INTERNET LINK OR A BROWSER SETTING, BROWSER EXTENSION, GLOBAL DEVICE SETTING, OR OTHER SIMILAR TECHNOLOGY, INDICATING A CONSUMER’S INTENT TO OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA.

(B) A CONTROLLER SHALL COMPLY WITH AN OPT–OUT REQUEST RECEIVED FROM AN AUTHORIZED AGENT IF, USING COMMERCIALLY REASONABLE EFFORTS, THE CONTROLLER IS ABLE TO AUTHENTICATE:

(1) THE IDENTITY OF THE CONSUMER; AND

(2) THE AUTHORIZED AGENT’S AUTHORITY TO ACT ON THE CONSUMER’S BEHALF.

# 14–4607.

(A) A CONTROLLER MAY NOT:

~~(1) COLLECT PERSONAL DATA FOR THE SOLE PURPOSE OF CONTENT PERSONALIZATION OR MARKETING WITHOUT THE CONSENT OF THE CONSUMER WHOSE PERSONAL DATA IS COLLECTED;~~

(2) (1) EXCEPT WHERE THE COLLECTION OR PROCESSING IS STRICTLY NECESSARY TO PROVIDE OR MAINTAIN A SPECIFIC PRODUCT OR SERVICE REQUESTED BY THE CONSUMER TO WHOM THE PERSONAL DATA PERTAINS ~~AND UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT~~, COLLECT, PROCESS, OR SHARE SENSITIVE DATA CONCERNING A CONSUMER;

(3) (2) SELL SENSITIVE DATA;

(4) (3) PROCESS PERSONAL DATA IN VIOLATION OF STATE OR FEDERAL LAWS THAT PROHIBIT UNLAWFUL DISCRIMINATION;

(5) (4) PROCESS THE PERSONAL DATA OF A CONSUMER FOR THE PURPOSES OF TARGETED ADVERTISING IF THE CONTROLLER KNEW OR SHOULD
---
# 2024 LAWS OF MARYLAND

HAVE KNOWN THAT THE CONSUMER IS UNDER THE AGE OF 18 YEARS;

(6) (5) SELL THE PERSONAL DATA OF A CONSUMER IF THE CONTROLLER KNEW OR SHOULD HAVE KNOWN THAT THE CONSUMER IS UNDER THE AGE OF 18 YEARS;

(7) (6) DISCRIMINATE AGAINST A CONSUMER FOR EXERCISING A CONSUMER RIGHT CONTAINED IN THIS SUBTITLE, INCLUDING DENYING GOODS OR SERVICES, CHARGING DIFFERENT PRICES OR RATES FOR GOODS OR SERVICES, OR PROVIDING A DIFFERENT LEVEL OF QUALITY OF GOODS OR SERVICES TO THE CONSUMER;

(8) (7) COLLECT, PROCESS, OR TRANSFER PERSONAL DATA OR PUBLICLY AVAILABLE DATA IN A MANNER THAT UNLAWFULLY DISCRIMINATES IN OR OTHERWISE UNLAWFULLY MAKES UNAVAILABLE THE EQUAL ENJOYMENT OF GOODS OR SERVICES ON THE BASIS OF RACE, COLOR, RELIGION, NATIONAL ORIGIN, SEX, SEXUAL ORIENTATION, GENDER IDENTITY, OR DISABILITY, UNLESS THE COLLECTION, PROCESSING, OR TRANSFER OF PERSONAL DATA IS FOR:

(I) THE CONTROLLER’S SELF-TESTING TO PREVENT OR MITIGATE UNLAWFUL DISCRIMINATION;

(II) THE CONTROLLER’S DIVERSIFYING OF AN APPLICANT, PARTICIPANT, OR CUSTOMER POOL; OR

(III) A PRIVATE CLUB OR GROUP NOT OPEN TO THE PUBLIC, AS DESCRIBED IN § 201(E) OF THE CIVIL RIGHTS ACT OF 1964; OR

(9) (8) UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT, PROCESS PERSONAL DATA FOR A PURPOSE THAT IS NEITHER REASONABLY NECESSARY TO, NOR COMPATIBLE WITH, THE DISCLOSED PURPOSES FOR WHICH THE PERSONAL DATA IS PROCESSED, AS DISCLOSED TO THE CONSUMER.

(B) (1) A CONTROLLER SHALL:

(I) LIMIT THE COLLECTION OF PERSONAL DATA TO WHAT IS REASONABLY NECESSARY AND PROPORTIONATE TO PROVIDE OR MAINTAIN A SPECIFIC PRODUCT OR SERVICE REQUESTED BY THE CONSUMER TO WHOM THE DATA PERTAINS;

(II) ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO
---
# WES MOORE, Governor Ch. 455

PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL DATA APPROPRIATE TO THE VOLUME AND NATURE OF THE PERSONAL DATA AT ISSUE; AND

(III) PROVIDE AN EFFECTIVE MECHANISM FOR A CONSUMER TO REVOKE THE CONSUMER’S CONSENT UNDER THIS SECTION THAT IS AT LEAST AS EASY AS THE MECHANISM BY WHICH THE CONSUMER PROVIDED THE CONSUMER’S CONSENT.

(2) IF A CONSUMER REVOKES CONSENT UNDER THIS SECTION, THE CONTROLLER SHALL STOP PROCESSING THE CONSUMER’S PERSONAL DATA AS SOON AS PRACTICABLE, BUT NOT LATER THAN 30 DAYS AFTER RECEIVING THE REQUEST.

(C) NOTHING IN SUBSECTION (A) OR (B) OF THIS SECTION MAY BE CONSTRUED TO:

(1) REQUIRE A CONTROLLER TO PROVIDE A PRODUCT OR SERVICE THAT REQUIRES THE PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER DOES NOT COLLECT OR MAINTAIN; OR

(2) PROHIBIT A CONTROLLER FROM OFFERING A DIFFERENT PRICE, RATE, LEVEL, QUALITY, OR SELECTION OF GOODS OR SERVICES TO A CONSUMER, INCLUDING OFFERING GOODS OR SERVICES FOR NO FEE, IF THE OFFERING IS IN CONNECTION WITH A CONSUMER’S VOLUNTARY PARTICIPATION IN A BONA FIDE LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNTS, OR CLUB CARD PROGRAM, **PROVIDED THAT THE SELLING OF PERSONAL DATA IS NOT A CONDITION OF PARTICIPATION IN THE PROGRAM.**

(D) A CONTROLLER SHALL PROVIDE A CONSUMER WITH A REASONABLY ACCESSIBLE, CLEAR, AND MEANINGFUL PRIVACY NOTICE THAT INCLUDES:

(1) THE CATEGORIES OF PERSONAL DATA PROCESSED BY THE CONTROLLER, INCLUDING SENSITIVE DATA;

(2) THE CONTROLLER’S PURPOSE FOR PROCESSING PERSONAL DATA;

(3) HOW A CONSUMER MAY EXERCISE THE CONSUMER’S RIGHTS UNDER THIS SUBTITLE, INCLUDING HOW A CONSUMER MAY APPEAL A CONTROLLER’S DECISION REGARDING THE CONSUMER’S REQUEST OR MAY REVOKE CONSENT;

(4) THE CATEGORIES OF THIRD PARTIES WITH WHICH THE CONTROLLER SHARES PERSONAL DATA WITH A LEVEL OF DETAIL THAT ENABLES A
---
# 2024 LAWS OF MARYLAND

CONSUMER TO UNDERSTAND ~~WHAT TYPE OF ENTITY EACH THIRD PARTY IS AND, TO THE EXTENT POSSIBLE, HOW EACH THIRD PARTY MAY PROCESS THE PERSONAL DATA~~ THE TYPE OF, BUSINESS MODEL OF, OR PROCESSING CONDUCTED BY EACH THIRD PARTY;

(5) THE CATEGORIES OF PERSONAL DATA, INCLUDING SENSITIVE DATA, THAT THE CONTROLLER SHARES WITH THIRD PARTIES; AND

(6) AN ACTIVE E-MAIL ADDRESS OR OTHER ONLINE MECHANISM THAT A CONSUMER MAY USE TO CONTACT THE CONTROLLER.

(e) (1) IF A CONTROLLER SELLS PERSONAL DATA TO THIRD PARTIES OR PROCESSES PERSONAL DATA FOR TARGETED ADVERTISING OR FOR THE PURPOSES OF PROFILING THE CONSUMER IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS, THE CONTROLLER SHALL CLEARLY AND CONSPICUOUSLY DISCLOSE THE SALE OR PROCESSING, AS WELL AS THE MANNER IN WHICH A CONSUMER MAY EXERCISE THE RIGHT TO OPT OUT OF THE SALE OR PROCESSING.

(2) THE DISCLOSURE REQUIRED UNDER PARAGRAPH (1) OF THIS SUBSECTION SHALL BE PROMINENTLY DISPLAYED, AND USE CLEAR, EASY TO UNDERSTAND, AND UNAMBIGUOUS LANGUAGE, TO STATE WHETHER THE CONSUMER’S INFORMATION WILL BE SOLD OR SHARED WITH A THIRD PARTY.

(f) (1) THE PRIVACY NOTICE UNDER SUBSECTION (D) OF THIS SECTION SHALL ESTABLISH ONE OR MORE SECURE AND RELIABLE METHODS FOR A CONSUMER TO SUBMIT A REQUEST TO EXERCISE A CONSUMER RIGHT IN ACCORDANCE WITH THIS SUBTITLE THAT TAKE INTO ACCOUNT:

   (I) THE WAYS IN WHICH CONSUMERS NORMALLY INTERACT WITH THE CONTROLLER;

   (II) THE NEED FOR SECURE AND RELIABLE COMMUNICATION OF CONSUMER REQUESTS; AND

   (III) THE ABILITY OF THE CONTROLLER TO VERIFY THE IDENTITY OF A CONSUMER MAKING THE REQUEST.

(2) (I) A CONTROLLER MAY NOT REQUIRE A CONSUMER TO CREATE A NEW ACCOUNT IN ORDER TO EXERCISE A CONSUMER RIGHT.

   (II) A CONTROLLER MAY REQUIRE A CONSUMER TO USE AN EXISTING ACCOUNT TO EXERCISE A CONSUMER RIGHT.
---
# (3) A CONTROLLER MAY UTILIZE THE FOLLOWING METHODS TO SATISFY PARAGRAPH (1) OF THIS SUBSECTION:

(I) PROVIDING A CLEAR AND CONSPICUOUS LINK ON THE CONTROLLER’S WEBSITE TO A WEBPAGE THAT ALLOWS A CONSUMER, OR AN AUTHORIZED AGENT OF THE CONSUMER, TO OPT OUT OF THE TARGETED ADVERTISING OR THE SALE OF THE CONSUMER’S PERSONAL DATA; OR

(II) ON OR BEFORE OCTOBER 1, 2025, ALLOWING A CONSUMER TO OPT OUT OF ANY PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR THE PURPOSES OF TARGETED ADVERTISING, OR ANY SALE OF PERSONAL DATA, THROUGH AN OPT–OUT PREFERENCE SIGNAL SENT, WITH THE CONSUMER’S CONSENT, BY A PLATFORM, TECHNOLOGY, OR MECHANISM TO THE CONTROLLER INDICATING THE CONSUMER’S INTENT TO OPT OUT OF THE PROCESSING OR SALE.

# (4) A PLATFORM, TECHNOLOGY, OR MECHANISM USED IN ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION SHALL:

(I) BE CONSUMER–FRIENDLY AND EASY TO USE BY THE AVERAGE CONSUMER;

(II) USE CLEAR, EASY TO UNDERSTAND, AND UNAMBIGUOUS LANGUAGE;

(III) BE AS CONSISTENT AS POSSIBLE WITH ANY OTHER SIMILAR PLATFORM, TECHNOLOGY, OR MECHANISM REQUIRED BY ANY FEDERAL OR STATE LAW OR REGULATION;

(IV) ENABLE THE CONTROLLER TO REASONABLY DETERMINE WHETHER THE CONSUMER:

1. IS A RESIDENT OF THE STATE; AND

2. HAS MADE A LEGITIMATE REQUEST TO OPT OUT OF ANY SALE OF THE CONSUMER’S PERSONAL DATA OR TARGETED ADVERTISING; AND

(V) REQUIRE A CONSUMER TO MAKE AN AFFIRMATIVE, UNAMBIGUOUS, AND VOLUNTARY CHOICE IN ORDER TO OPT OUT OF ANY PROCESSING OF THE CONSUMER’S PERSONAL DATA.

# (5) A PLATFORM, TECHNOLOGY, OR MECHANISM USED IN ACCORDANCE WITH PARAGRAPH (3) OF THIS SUBSECTION MAY NOT:
---
# 2024 Laws of Maryland

(I) UNFAIRLY DISADVANTAGE ANOTHER CONTROLLER; OR

(II) USE A DEFAULT SETTING TO OPT A CONSUMER OUT OF ANY PROCESSING OF THE CONSUMER’S PERSONAL DATA.

(G) (1) IF A CONSUMER’S DECISION TO OPT OUT OF THE PROCESSING OF THE CONSUMER’S PERSONAL DATA FOR THE PURPOSES OF TARGETED ADVERTISING, OR THE SALE OF PERSONAL DATA THROUGH AN OPT-OUT PREFERENCE SIGNAL SENT IN ACCORDANCE WITH SUBSECTION (F)(3) OF THIS SECTION CONFLICTS WITH THE CONSUMER’S EXISTING CONTROLLER-SPECIFIC PRIVACY SETTING OR THE CONSUMER’S VOLUNTARY PARTICIPATION IN A CONTROLLER’S BONA FIDE LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNTS, OR CLUB CARD PROGRAM, THE CONTROLLER MAY NOTIFY THE CONSUMER OF A CONFLICT AND PROVIDE THE CHOICE TO CONFIRM CONTROLLER-SPECIFIC PRIVACY SETTINGS OR PARTICIPATION IN A PROGRAM LISTED IN THIS PARAGRAPH.

(2) A CONTROLLER THAT RECOGNIZES SIGNALS APPROVED BY OTHER STATES SHALL BE CONSIDERED IN COMPLIANCE WITH THIS SECTION.

## 14–4608.

(A) (1) IF A CONTROLLER USES A PROCESSOR TO PROCESS THE PERSONAL DATA OF CONSUMERS, THE CONTROLLER AND THE PROCESSOR SHALL ENTER INTO A CONTRACT THAT GOVERNS THE PROCESSOR’S DATA PROCESSING PROCEDURES WITH RESPECT TO PROCESSING PERFORMED ON BEHALF OF THE CONTROLLER.

(2) THE CONTRACT SHALL BE BINDING AND SHALL CLEARLY SET FORTH INSTRUCTIONS FOR:

(I) PROCESSING INSTRUCTIONS FOR PROCESSING DATA;

(II) THE NATURE AND PURPOSE OF PROCESSING;

(III) THE TYPE OF DATA SUBJECT TO PROCESSING;

(IV) THE DURATION OF PROCESSING; AND

(V) THE RIGHTS AND OBLIGATIONS OF BOTH PARTIES.

(3) THE CONTRACT SHALL REQUIRE THAT THE PROCESSOR:

---
# WES MOORE, Governor Ch. 455

(I) ENSURE THAT EACH PERSON PROCESSING PERSONAL DATA IS SUBJECT TO A DUTY OF CONFIDENTIALITY WITH RESPECT TO THE PERSONAL DATA;

(II) ESTABLISH, IMPLEMENT, AND MAINTAIN REASONABLE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL DATA SECURITY PRACTICES TO PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF PERSONAL DATA, CONSIDERING THE VOLUME AND NATURE OF THE PERSONAL DATA;

(III) STOP PROCESSING DATA ON REQUEST BY THE CONTROLLER MADE IN ACCORDANCE WITH A CONSUMER’S AUTHENTICATED REQUEST;

(IV) AT THE CONTROLLER’S DIRECTION, DELETE OR RETURN ALL PERSONAL DATA TO THE CONTROLLER AS REQUESTED AT THE END OF THE PROVISION OF SERVICE, UNLESS RETENTION OF THE PERSONAL DATA IS REQUIRED BY LAW;

(V) ON THE REASONABLE REQUEST OF THE CONTROLLER, MAKE AVAILABLE TO THE CONTROLLER ALL INFORMATION IN THE PROCESSOR’S POSSESSION NECESSARY TO DEMONSTRATE THE PROCESSOR’S COMPLIANCE WITH THE OBLIGATIONS IN THIS SUBTITLE;

(VI) AFTER PROVIDING THE CONTROLLER AN OPPORTUNITY TO OBJECT, ENGAGE A SUBCONTRACTOR TO ASSIST WITH PROCESSING PERSONAL DATA ON THE CONTROLLER’S BEHALF ONLY IN ACCORDANCE WITH A WRITTEN CONTRACT THAT REQUIRES THE SUBCONTRACTOR TO MEET THE PROCESSOR’S OBLIGATIONS REGARDING THE PERSONAL DATA UNDER THE PROCESSOR’S CONTRACT WITH THE CONTROLLER; AND

(VII) ALLOW AND COOPERATE WITH REASONABLE ASSESSMENTS BY THE CONTROLLER, THE CONTROLLER’S DESIGNATED ASSESSOR, OR A QUALIFIED AND INDEPENDENT ASSESSOR ARRANGED FOR BY THE PROCESSOR TO ASSESS THE PROCESSOR’S POLICIES AND TECHNICAL AND ORGANIZATIONAL MEASURES IN SUPPORT OF THE OBLIGATIONS UNDER THIS SUBTITLE.

(4) (I) ON REQUEST, THE PROCESSOR SHALL PROVIDE A REPORT OF AN ASSESSMENT REQUIRED BY PARAGRAPH (3)(V) OF THIS SUBSECTION TO THE CONTROLLER.

(II) AN ASSESSMENT CONDUCTED IN ACCORDANCE WITH PARAGRAPH (3)(V) OF THIS SUBSECTION SHALL BE CONDUCTED USING AN APPROPRIATE AND ACCEPTED CONTROL STANDARD OR FRAMEWORK AND ASSESSMENT PROCEDURE FOR THE ASSESSMENTS.

- 27 -
---
# 2024 LAWS OF MARYLAND

(B) (1) ~~IF A CONTROLLER USES A PROCESSOR TO PROCESS THE PERSONAL DATA OF CONSUMERS, THE CONTROLLER SHALL PROVIDE THE PROCESSOR WITH INSTRUCTIONS ON HOW TO PROCESS PERSONAL DATA.~~

(2) A PROCESSOR SHALL:

   (I) (1) ADHERE TO THE CONTRACT AND INSTRUCTIONS OF A CONTROLLER;

   (II) (2) ASSIST THE CONTROLLER IN MEETING THE CONTROLLER’S OBLIGATIONS UNDER THIS SUBTITLE, INCLUDING, ~~CONSIDERING THE NATURE OF PROCESSING AND THE INFORMATION AVAILABLE TO THE PROCESSOR:~~

      1. (I) BY APPROPRIATE TECHNICAL AND ORGANIZATIONAL MEASURES AS MUCH AS REASONABLY PRACTICABLE TO FULFILL THE CONTROLLER’S OBLIGATION TO RESPOND TO CONSUMER RIGHTS REQUESTS, CONSIDERING THE NATURE OF PROCESSING AND THE INFORMATION AVAILABLE TO THE PROCESSOR; AND

      2. (II) BY ASSISTING THE CONTROLLER IN MEETING THE CONTROLLER’S OBLIGATIONS IN RELATION TO THE SECURITY OF PROCESSING THE PERSONAL DATA AND IN RELATION TO THE NOTIFICATION OF A BREACH OF THE SECURITY OF A SYSTEM, AS DEFINED IN § 14–3504 OF THIS TITLE; AND

   (III) (3) PROVIDE NECESSARY INFORMATION TO ENABLE THE CONTROLLER TO CONDUCT AND DOCUMENT DATA PROTECTION ASSESSMENTS.

(C) NOTHING IN THIS SECTION MAY BE CONSTRUED TO RELIEVE A CONTROLLER OR A PROCESSOR FROM THE LIABILITIES IMPOSED ON THE CONTROLLER OR PROCESSOR BY VIRTUE OF THE CONTROLLER’S OR PROCESSOR’S ROLE IN THE PROCESSING RELATIONSHIP IN ACCORDANCE WITH THIS SECTION.

(D) (1) THE DETERMINATION OF WHETHER A PERSON IS ACTING AS A CONTROLLER OR A PROCESSOR WITH RESPECT TO A SPECIFIC PROCESSING OF DATA IS A FACT–BASED DETERMINATION THAT DEPENDS ON THE CONTEXT IN WHICH PERSONAL DATA IS BEING PROCESSED.

(2) A PERSON IS CONSIDERED TO BE A CONTROLLER IF THE PERSON:

   (I) IS NOT LIMITED IN THE PERSON’S PROCESSING OF SPECIFIC PERSONAL DATA IN ACCORDANCE WITH A CONTROLLER’S INSTRUCTIONS; OR
---
# WES MOORE, Governor Ch. 455

(II) FAILS TO ADHERE TO A CONTROLLER’S INSTRUCTIONS WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA.

(3) A PROCESSOR THAT CONTINUES TO ADHERE TO A CONTROLLER’S INSTRUCTIONS WITH RESPECT TO A SPECIFIC PROCESSING OF PERSONAL DATA REMAINS A PROCESSOR.

(4) IF A PROCESSOR OR THIRD PARTY BEGINS, ALONE OR JOINTLY WITH OTHERS, DETERMINING THE PURPOSES AND MEANS OF THE PROCESSING OF PERSONAL DATA, THE PROCESSOR:

   (I) IS A CONTROLLER WITH RESPECT TO THE PROCESSING; AND

   (II) MAY BE SUBJECT TO AN ENFORCEMENT ACTION UNDER THIS SUBTITLE.

(E) NOTHING IN THIS SECTION MAY BE CONSTRUED TO ALTER A CONTROLLER’S OBLIGATION TO LIMIT A PERSON’S PROCESSING OF PERSONAL DATA OR TO TAKE STEPS TO ENSURE THAT A PROCESSOR ADHERES TO THE CONTROLLER’S INSTRUCTIONS.

## 14–4609.

(A) IF A THIRD PARTY USES OR SHARES A CONSUMER’S INFORMATION IN A MANNER INCONSISTENT WITH PROMISES MADE TO THE CONSUMER AT THE TIME OF COLLECTION OF THE INFORMATION, THE THIRD PARTY SHALL PROVIDE AN AFFECTED CONSUMER WITH NOTICE OF THE NEW OR CHANGED PRACTICE BEFORE IMPLEMENTING THE NEW OR CHANGED PRACTICE.

(B) THE NOTICE PROVIDED UNDER SUBSECTION (A) OF THIS SECTION SHALL BE PROVIDED IN A MANNER AND AT A TIME REASONABLY CALCULATED TO ALLOW A CONSUMER TO EXERCISE THE RIGHTS PROVIDED UNDER THIS SUBTITLE.

## 14–4610.

(A) IN THIS SECTION, “PROCESSING ACTIVITIES THAT PRESENT A HEIGHTENED RISK OF HARM TO A CONSUMER” MEANS:

(1) THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF TARGETED ADVERTISING;

(2) THE SALE OF PERSONAL DATA;

(3) THE PROCESSING OF SENSITIVE DATA; AND
---
# 2024 LAWS OF MARYLAND

(4) The processing of personal data for the purposes of profiling, in which the profiling presents a reasonably foreseeable risk of:

   (I) Unfair, abusive, or deceptive treatment of a consumer;

   (II) Having an unlawful disparate impact on a consumer;

   (III) Financial, physical, or reputational injury to a consumer;

   (IV) A physical or other intrusion on the solitude or seclusion or the private affairs or concerns of a consumer in which the intrusion would be offensive to a reasonable person; or

   (V) Other substantial injury to a consumer.

(B) A controller shall conduct and document, on a regular basis, a data protection assessment for each of the controller’s processing activities that present a heightened risk of harm to a consumer, including an assessment for each algorithm that is used.

(C) (1) A data protection assessment conducted in accordance with this section shall identify and weigh the benefits that may flow directly and indirectly from the processing to the controller, the consumer, other interested parties, and the public against:

   (I) The potential risks to the rights of the consumer associated with the processing as mitigated by safeguards that may be employed by the controller to reduce these risks; and

   (II) The necessity and proportionality of processing in relation to the stated purpose of the processing.

(2) The controller shall factor into a data protection assessment:

   (I) The use of de-identified data;

   (II) The reasonable expectations of consumers;

– 30 –
---
# WES MOORE, Governor Ch. 455

(III) THE CONTEXT OF THE PROCESSING; AND

(IV) THE RELATIONSHIP BETWEEN THE CONTROLLER AND THE CONSUMER WHOSE PERSONAL DATA WILL BE PROCESSED.

(D) (1) THE DIVISION MAY REQUIRE THAT A CONTROLLER MAKE AVAILABLE TO THE DIVISION A DATA PROTECTION ASSESSMENT THAT IS RELEVANT TO AN INVESTIGATION CONDUCTED BY THE DIVISION.

(2) (I) THE DIVISION MAY EVALUATE A DATA PROTECTION ASSESSMENT FOR COMPLIANCE WITH THE RESPONSIBILITIES ESTABLISHED IN THIS SUBTITLE.

(II) A CONTROLLER’S DATA PROTECTION ASSESSMENT MAY BE USED IN AN ACTION TO ENFORCE THIS SUBTITLE.

(3) A DATA PROTECTION ASSESSMENT IS CONFIDENTIAL AND IS EXEMPT FROM DISCLOSURE UNDER THE FEDERAL FREEDOM OF INFORMATION ACT OR THE PUBLIC INFORMATION ACT.

(E) A SINGLE DATA PROTECTION ASSESSMENT MAY ADDRESS A COMPARABLE SET OF PROCESSING OPERATIONS THAT INCLUDE SIMILAR ACTIVITIES.

(F) IF A CONTROLLER CONDUCTS A DATA PROTECTION ASSESSMENT FOR THE PURPOSE OF COMPLYING WITH ANOTHER APPLICABLE LAW OR REGULATION, THE DATA PROTECTION ASSESSMENT SHALL BE CONSIDERED TO SATISFY THE REQUIREMENTS ESTABLISHED IN THIS SECTION IF THE DATA PROTECTION ASSESSMENT IS REASONABLY SIMILAR IN SCOPE AND EFFECT TO THE DATA PROTECTION ASSESSMENT THAT WOULD OTHERWISE BE CONDUCTED IN ACCORDANCE WITH THIS SECTION.

(G) TO THE EXTENT THAT ANY INFORMATION CONTAINED IN A DATA PROTECTION ASSESSMENT DISCLOSED TO THE DIVISION INCLUDES INFORMATION SUBJECT TO ATTORNEY–CLIENT PRIVILEGE OR WORK PRODUCT PROTECTION, THE DISCLOSURE MAY NOT CONSTITUTE A WAIVER OF THAT PRIVILEGE OR PROTECTION.

(H) A DATA PROTECTION ASSESSMENT CONDUCTED UNDER THIS SECTION:

(1) SHALL APPLY TO PROCESSING ACTIVITIES THAT OCCUR ON OR AFTER OCTOBER 1, 2025; AND

(2) IS NOT REQUIRED FOR PROCESSING ACTIVITIES THAT OCCUR BEFORE OCTOBER 1, 2025.
---
# 14-4611.

(A) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A CONTROLLER OR A PROCESSOR TO:

1. RE-IDENTIFY DE-IDENTIFIED DATA;
2. MAINTAIN DATA IN AN IDENTIFIABLE FORM; OR
3. COLLECT, OBTAIN, RETAIN, OR ACCESS ANY DATA OR TECHNOLOGY IN ORDER TO BE CAPABLE OF ASSOCIATING AN AUTHENTICATED CONSUMER REQUEST WITH PERSONAL DATA.

(B) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO REQUIRE A CONTROLLER OR PROCESSOR TO COMPLY WITH AN AUTHENTICATED CONSUMER RIGHTS REQUEST IF THE CONTROLLER:

1. IS NOT REASONABLY CAPABLE OF ASSOCIATING THE REQUEST WITH THE PERSONAL DATA OR IT WOULD BE UNREASONABLY BURDENSOME FOR THE CONTROLLER TO ASSOCIATE THE REQUEST WITH THE PERSONAL DATA;
2. DOES NOT USE THE PERSONAL DATA TO RECOGNIZE OR RESPOND TO THE SPECIFIC CONSUMER WHO IS THE SUBJECT OF THE PERSONAL DATA OR ASSOCIATE THE PERSONAL DATA WITH OTHER PERSONAL DATA ABOUT THE SAME SPECIFIC CONSUMER; AND
3. DOES NOT SELL THE PERSONAL DATA TO A THIRD PARTY OR OTHERWISE VOLUNTARILY DISCLOSE THE PERSONAL DATA TO A THIRD PARTY OTHER THAN A PROCESSOR, EXCEPT AS OTHERWISE ALLOWED IN THIS SUBTITLE.

(C)
1. A CONTROLLER THAT DISCLOSES DE-IDENTIFIED DATA SHALL:
   i. EXERCISE REASONABLE OVERSIGHT TO MONITOR COMPLIANCE WITH ANY CONTRACTUAL COMMITMENTS TO WHICH THE DE-IDENTIFIED DATA IS SUBJECT; AND
   ii. TAKE APPROPRIATE STEPS TO ADDRESS ANY BREACHES OF ANY CONTRACTUAL COMMITMENTS.

2. THE DETERMINATION OF WHETHER OVERSIGHT IS REASONABLE AND WHETHER APPROPRIATE STEPS WERE TAKEN IN ACCORDANCE WITH PARAGRAPH (1) OF THIS SUBSECTION SHALL TAKE INTO ACCOUNT WHETHER THE
---
# 14-4612.

(A) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO RESTRICT A CONTROLLER’S OR PROCESSOR’S ABILITY TO:

1. COMPLY WITH FEDERAL, STATE, OR LOCAL LAWS OR REGULATIONS;

2. ~~COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL, STATE, LOCAL, OR OTHER GOVERNMENTAL AUTHORITY~~ COMPLY WITH A CIVIL OR CRIMINAL SUBPOENA OR SUMMONS BY A FEDERAL, STATE, LOCAL, OR OTHER JUDICIAL BODY, CRIMINAL, OR REGULATORY INQUIRY, INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL, STATE, LOCAL, OR OTHER GOVERNMENTAL AUTHORITY;

3. COOPERATE WITH LAW ENFORCEMENT AGENCIES CONCERNING CONDUCT OR ACTIVITY THAT THE CONTROLLER OR PROCESSOR REASONABLY AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR LOCAL LAWS OR REGULATIONS;

4. INVESTIGATE, ESTABLISH, EXERCISE, PREPARE FOR, OR DEFEND A LEGAL CLAIM;

5. PROVIDE A PRODUCT OR SERVICE SPECIFICALLY REQUESTED BY A CONSUMER;

6. PERFORM UNDER A CONTRACT TO WHICH A CONSUMER IS A PARTY, INCLUDING FULFILLING THE TERMS OF A WRITTEN WARRANTY;

7. TAKE STEPS AT THE REQUEST OF A CONSUMER BEFORE ENTERING INTO A CONTRACT;

8. TAKE IMMEDIATE STEPS TO PROTECT AN INTEREST THAT IS ESSENTIAL FOR THE LIFE OR PHYSICAL SAFETY OF A CONSUMER OR ANOTHER INDIVIDUAL AND WHEN THE PROCESSING CANNOT BE MANIFESTLY BASED ON ANOTHER LEGAL BASIS;

9. PREVENT, DETECT, PROTECT AGAINST, INVESTIGATE, PROSECUTE THOSE RESPONSIBLE, OR OTHERWISE RESPOND TO A SECURITY INCIDENT, IDENTITY THEFT, FRAUD, HARASSMENT, MALICIOUS OR DECEPTIVE ACTIVITY, OR ANY OTHER TYPE OF ILLEGAL ACTIVITY;
---
# 2024 LAWS OF MARYLAND

(10) PRESERVE THE INTEGRITY OR SECURITY OF SYSTEMS; OR

(11) ASSIST ANOTHER CONTROLLER, PROCESSOR, OR THIRD PARTY WITH AN OBLIGATION UNDER THIS SUBTITLE.

(B) (1) THIS SUBSECTION DOES NOT APPLY TO AN OBLIGATION REQUIRED UNDER § 14–4611 OF THIS SUBTITLE.

(2) AN OBLIGATION IMPOSED ON A CONTROLLER OR PROCESSOR UNDER THIS SUBTITLE MAY NOT RESTRICT A CONTROLLER’S OR PROCESSOR’S ABILITY TO COLLECT, USE, OR RETAIN PERSONAL DATA FOR INTERNAL USE TO:

   (I) EFFECTUATE A PRODUCT RECALL;

   (II) IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR EXISTING OR INTENDED FUNCTIONALITY; OR

   (III) PERFORM INTERNAL OPERATIONS THAT ARE:

      1. REASONABLY ALIGNED WITH THE EXPECTATIONS OF THE CONSUMER OR CAN BE REASONABLY ANTICIPATED BASED ON THE CONSUMER’S EXISTING RELATIONSHIP WITH THE CONTROLLER; OR

      2. OTHERWISE COMPATIBLE WITH PROCESSING DATA IN FURTHERANCE OF:

         A. THE PROVISION OF A PRODUCT OR SERVICE SPECIFICALLY REQUESTED BY A CONSUMER; OR

         B. THE PERFORMANCE OF A CONTRACT TO WHICH THE CONSUMER IS A PARTY.

(C) (1) AN OBLIGATION IMPOSED ON A CONTROLLER OR A PROCESSOR UNDER THIS SUBTITLE DOES NOT APPLY WHEN COMPLIANCE BY THE CONTROLLER OR PROCESSOR WITH THE SUBTITLE WOULD VIOLATE AN EVIDENTIARY PRIVILEGE UNDER STATE LAW.

(2) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO PREVENT A CONTROLLER OR PROCESSOR FROM PROVIDING PERSONAL DATA CONCERNING A CONSUMER TO A PERSON COVERED BY AN EVIDENTIARY PRIVILEGE UNDER STATE LAW AS PART OF A PRIVILEGED COMMUNICATION.
---
# WES MOORE, Governor Ch. 455

**(D) (1) A CONTROLLER OR PROCESSOR THAT DISCLOSES PERSONAL DATA TO A PROCESSOR OR A THIRD–PARTY CONTROLLER IN COMPLIANCE WITH THIS SUBTITLE IS NOT IN VIOLATION OF THIS SUBTITLE IF THE PROCESSOR OR THIRD–PARTY CONTROLLER THAT RECEIVES THE PERSONAL DATA VIOLATES THIS SUBTITLE AND:**

   **(I) AT THE TIME THE DISCLOSING CONTROLLER OR PROCESSOR DISCLOSED THE PERSONAL DATA, THE DISCLOSING CONTROLLER OR PROCESSOR DID NOT HAVE ACTUAL KNOWLEDGE THAT THE RECEIVING PROCESSOR OR THIRD–PARTY CONTROLLER WOULD VIOLATE THIS SUBTITLE; AND**

   **(II) THE DISCLOSING CONTROLLER WAS, AND REMAINED, IN COMPLIANCE WITH ITS OBLIGATIONS AS THE DISCLOSER OF THE PERSONAL DATA.**

**(2) A THIRD–PARTY CONTROLLER OR PROCESSOR THAT RECEIVES PERSONAL DATA FROM A CONTROLLER OR PROCESSOR IN COMPLIANCE WITH THIS SUBTITLE IS NOT IN VIOLATION OF THIS SUBTITLE FOR THE INDEPENDENT MISCONDUCT OF THE CONTROLLER OR PROCESSOR FROM WHICH THE THIRD–PARTY CONTROLLER OR PROCESSOR RECEIVED THE PERSONAL DATA.**

**(E) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO:**

   **(1) IMPOSE AN OBLIGATION ON A CONTROLLER OR A PROCESSOR THAT ADVERSELY AFFECTS THE RIGHTS OR FREEDOMS OF ANY PERSON, INCLUDING THE RIGHTS OF A PERSON TO FREEDOM OF SPEECH OR FREEDOM OF THE PRESS AS GUARANTEED IN THE FIRST AMENDMENT TO THE U.S. CONSTITUTION; OR**

   **(2) APPLY TO A PERSON’S PROCESSING OF PERSONAL DATA DURING THE PERSON’S PERSONAL OR HOUSEHOLD ACTIVITIES.**

**(F) IF A CONTROLLER OR PROCESSOR PROCESSES PERSONAL DATA IN ACCORDANCE WITH AN EXEMPTION UNDER THIS SECTION, THE CONTROLLER OR PROCESSOR SHALL DEMONSTRATE THAT THE PROCESSING:**

   **(1) QUALIFIES FOR AN EXEMPTION; AND**

   **(2) COMPLIES WITH THE REQUIREMENTS OF SUBSECTION (G) OF THIS SECTION.**

**(G) PERSONAL DATA PROCESSED BY A CONTROLLER OR PROCESSOR IN ACCORDANCE WITH THIS SECTION:**

   **(1) SHALL BE SUBJECT TO REASONABLE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL MEASURES TO:**

- 35 -
---
# 2024 LAWS OF MARYLAND

(I) PROTECT THE CONFIDENTIALITY, INTEGRITY, AND ACCESSIBILITY OF THE PERSONAL DATA; AND

(II) REDUCE REASONABLY FORESEEABLE RISKS OF HARM TO CONSUMERS RELATING TO THE COLLECTION, USE, OR RETENTION OF PERSONAL DATA; AND

(2) MAY BE PROCESSED TO THE EXTENT THAT THE PROCESSING IS:

(I) REASONABLY NECESSARY AND PROPORTIONATE TO THE PURPOSES LISTED IN THIS SECTION; AND

(II) ADEQUATE, RELEVANT, AND LIMITED TO WHAT IS NECESSARY IN RELATION TO THE SPECIFIC PURPOSES LISTED IN THIS SECTION.

(H) A PERSON THAT PROCESSES PERSONAL DATA FOR A PURPOSE EXPRESSLY IDENTIFIED IN THIS SECTION MAY NOT BE CONSIDERED A CONTROLLER SOLELY BASED ON THE PROCESSING OF PERSONAL DATA.

## 14-4613.

(A) EXCEPT AS PROVIDED IN SUBSECTION (B) OF THIS SECTION, A VIOLATION OF THIS SUBTITLE IS:

(1) AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE PRACTICE WITHIN THE MEANING OF TITLE 13 OF THIS ARTICLE; AND

(2) SUBJECT TO THE ENFORCEMENT AND PENALTY PROVISIONS CONTAINED IN TITLE 13 OF THIS ARTICLE, EXCEPT FOR § 13-408 OF THIS ARTICLE.

(B) THIS SECTION DOES NOT PREVENT A CONSUMER FROM PURSUING ANY OTHER REMEDY PROVIDED BY LAW.

## 14-4614.

(A) THIS SECTION APPLIES TO AN ENFORCEMENT ACTION UNDER § 14-4613 OF THIS SUBTITLE FOR AN ALLEGED VIOLATION THAT OCCURS ON OR BEFORE APRIL 1, 2027.

(B) BEFORE INITIATING ANY ACTION UNDER § 14-4613 OF THIS SUBTITLE, THE DIVISION MAY ISSUE A NOTICE OF VIOLATION TO THE CONTROLLER OR PROCESSOR IF THE DIVISION DETERMINES THAT A CURE IS POSSIBLE.
---
# (C) (1) IF THE DIVISION ISSUES A NOTICE OF VIOLATION UNDER SUBSECTION (B) OF THIS SECTION, THE CONTROLLER OR PROCESSOR SHALL HAVE AT LEAST 60 DAYS TO CURE THE VIOLATION AFTER RECEIPT OF THE NOTICE.

(2) IF THE CONTROLLER OR PROCESSOR FAILS TO CURE THE VIOLATION WITHIN THE TIME PERIOD SPECIFIED BY THE DIVISION, THE DIVISION MAY BRING AN ENFORCEMENT ACTION UNDER § 14–4613 OF THIS SUBTITLE.

# (D) IN DETERMINING WHETHER TO GRANT A CONTROLLER OR PROCESSOR AN OPPORTUNITY TO CURE AN ALLEGED VIOLATION, THE DIVISION MAY CONSIDER THE FOLLOWING FACTORS:

(1) THE NUMBER OF VIOLATIONS;

(2) THE SIZE AND COMPLEXITY OF THE CONTROLLER OR PROCESSOR;

(3) THE NATURE AND EXTENT OF THE CONTROLLER’S OR PROCESSOR’S PROCESSING ACTIVITIES;

(4) THE LIKELIHOOD OF INJURY TO THE PUBLIC;

(5) THE SAFETY OF PERSONS OR PROPERTY;

(6) WHETHER THE ALLEGED VIOLATION WAS LIKELY CAUSED BY A HUMAN OR TECHNICAL ERROR; AND

(7) THE EXTENT TO WHICH THE CONTROLLER OR PROCESSOR HAS VIOLATED THIS SUBTITLE OR SIMILAR LAWS IN THE PAST.

# SECTION 2. AND BE IT FURTHER ENACTED, That § 14–4612 of the Commercial Law Article, as enacted by Section 1 of this Act, shall be construed to apply only prospectively and may not be applied or interpreted to have any effect on or application to any personal data processing activities before April 1, 2025 2026.

# SECTION 3. AND BE IT FURTHER ENACTED, That, if any provision of this Act or the application thereof to any person or circumstance is held invalid for any reason in a court of competent jurisdiction, the invalidity does not affect other provisions or any other application of this Act that can be given effect without the invalid provision or application, and for this purpose the provisions of this Act are declared severable.

# SECTION 4. AND BE IT FURTHER ENACTED, That this Act shall take effect October 1, 2024 2025.

Approved by the Governor, May 9, 2024.