Maryland Governor Wes Moore signed into law Thursday new online privacy protections for state residents. But it will be awhile before those take effect.
The Maryland Online Privacy Act of 2024 was a ‘behemoth’ to pass through the General Assembly this year according to one of its sponsors, Senator Dawn Gile (D-Anne Arundel). She says the lack of similar legislation passed by Congress was one of many inspirations for the measure. “So it’s incumbent on state’s to do something to protect your personal data,” Gile told WYPR.
She explains the bill limits what ‘controllers’ such as websites, apps, and other online marketplaces can do with personal data given to them. “They can only use it for the purpose for which you’re intending for it to be used for,” Gile said. “They can’t sell it or otherwise transfer it to others.” Controllers under the bill are defined as entities that:
- controlled or processed the personal data of at least 35,000 consumers (excluding personal data controlled or processed solely for the purpose of completing a payment transaction)
- controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of its gross revenue from the sale of personal data.
Among the protections the law gives consumers includes:
- requiring a controller of data to establish a secure and reliable method for a consumer to exercise a right (including the deletion of personal data given)
- establishing a timeframe and related requirements for a controller to respond to and/or comply with a request from a consumer
- requiring the controller to notify the consumer in a specified manner if the controller chooses not to take action on a request
- requiring a controller to provide a consumer, free of charge, with the information a consumer requests, subject to certain limitations
- and requiring a controller to establish a process that a consumer may use to appeal a controller decision.
But it will be a while before Maryland joins the growing list of states to enact online privacy laws, as this bill does not take effect until October 1, 2025.
