Blog

Maryland passes comprehensive state privacy law

With Governor Wes Moore signing Maryland’s privacy bill into law, it now becomes the 18th state with a comprehensive privacy law in the US

Keshawna Campbell
Privacy Research Manager, OneTrust Center of Excellence
May 10, 2024

When does the MODPA come into effect?
Who does the MODPA apply to?
What are some key highlights of the MODPA?
What does this mean for your business?

On May 9, 2024, Maryland became the 18th state to officially pass a comprehensive state privacy law, the Maryland Online Data Protection Act (MODPA). Let's go through the key highlights of Maryland’s legislation.

Some key requirements introduced by the MODPA include additional requirements around health data, third-party data sharing, and anti-discriminatory stipulations.

When does the MODPA come into effect?

Maryland’s privacy law will come into effect on October 1, 2025 – but doesn’t apply to any data processing before April 1, 2026, giving businesses sufficient time to comply with the regulation.

Who does the MODPA apply to?

The MODPA applies to the following businesses in Maryland or businesses that provide products/services to Maryland residents classified as consumers:

Businesses that control/process the personal data of over 35,000 consumers (excluding personal data processing for transactional purposes)
Businesses that control/process the personal data of over 10,000 consumers and generate over 20% of their revenue from the sale of this data

Who is a consumer?

The law defines a consumer as “an individual who is a resident of the state.”

However, the definition of a consumer does not include “an individual acting in a commercial or employment context.” This means that the employees of a company or governmental unit are not considered consumers when looking at the personal data being processed by an organization.

What are some key highlights of the MODPA?

The MODPA has similar stipulations to other US state privacy laws. The law includes stipulations regarding consumer rights, consent, and the conducting of data protection assessments.

Consumer rights

The MODPA offers the following consumer rights to Maryland residents, in line with most major privacy regulations today.

Right to confirm processing
Right to access
Right to correction
Right to deletion
Right to portability
Right to opt-out of:
1. The sale of personal data
2. Profiling
3. Targeted advertising

In addition to these rights, the MODPA also provides consumers with the right to know what categories of third parties their data is being shared with.

Consent

The MODPA defines consent as a “clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to allow the processing of personal data relating to the consumer for a particular purpose.” This includes a written statement (electronic or non-electronic), or any other “unambiguous action.”

The law further defines sensitive data as racial or ethnic origin, religious beliefs, consumer health data, details regarding sex life, sexual orientation, transgender or nonbinary status, national origin, or citizenship or immigration status. It also includes genetic data or biometric data, personal information of a consumer that the controller is aware of, or has reason to believe, pertains to a child, and precise geolocation data.

Privacy notices

The law requires companies to provide a privacy notice to their website visitors that is “easily accessible, clear, and meaningful.” It must include the following:

The types of personal data being processed by the controller, including any sensitive data
The purposes for which the controller processes personal data
Instructions on how a consumer can exercise their rights under this subtitle, including ways to appeal the controller's decision about a request or to revoke consent
Details about the categories of third parties with whom the controller shares personal data, offering enough information for a consumer to understand the nature, business model, or processing activities of each third party
The types of personal data, including sensitive data, shared with these third parties
A direct e-mail address or another online method for consumers to contact the controller

Data protection asessments

Maryland’s privacy law requires data protection assessments to be conducted for any data processing activities that “present a heightened risk of harm to the consumer.” These include the following:

The processing of personal data specifically for targeted advertising
The sale of personal data
The handling of sensitive data
The use of personal data for profiling activities that could foreseeably present a risk of:
1. Unfair, abusive, or deceptive treatment of consumers
2. Result in unlawful disparate impacts
3. Cause financial, physical, or reputational harm
4. Lead to an intrusion on the solitude or seclusion of private affairs or an intrusion deemed offensive by reasonable standards
5. Cause other significant injuries to consumers

Enforcement

The MODPA allows for a 60-day cure period for organizations to remedy their data practices to maintain compliance. However, this cure period stipulation expires on April 1, 2027. The law is enforceable by the Consumer Protection division of the Maryland Attorney General’s office.

Other highlights

The MODPA also includes a few more mentions around health data, third-party uses of consumer data, and anti-discriminatory rules.

Health data

Maryland’s privacy law prevents companies from accessing the consumer health data of their employees unless there is a confidentiality agreement in place. Processors also have further restrictions around processing health data, and businesses are prohibited from using a geofence to establish a virtual boundary that is within 1,750 feet of a mental health or sexual health facility.

Third-party use of data

The law states that if a third party uses or shares a consumer’s information in a manner “inconsistent with promises made to the consumer at the time of collection of the information,” the third party must provide the affected consumer with notice of the new or changed practice before implementing it.

Anti-discriminatory provision

The MODPA includes a statement that mentions that data controllers cannot “collect, process, or transfer personal data or publicly available data” in a manner that discriminates between consumers and prevents the “equal enjoyment of goods or services” based on race, color, religion, national origin, sex, sexual orientation, gender identity, or disability, unless exceptions apply.

What does this mean for your business?

The MODPA goes into effect on October 1, 2025, but only applies to personal data processed from April 1, 2026 onwards. This gives businesses nearly two years to prepare for regulatory compliance. For more information on how your organization can be prepared for upcoming privacy regulations, learn more about the OneTrust Privacy & Data Governance Cloud.

Blog

Maryland passes comprehensive state privacy law

Table of contents

When does the MODPA come into effect?

Who does the MODPA apply to?

Who is a consumer?

What are some key highlights of the MODPA?

Consumer rights

Consent

Privacy notices

Data protection asessments

Enforcement

Other highlights

Health data

Third-party use of data

Anti-discriminatory provision

What does this mean for your business?

You may also like

Privacy Management

Staying equipped for compliance: A global recap of emerging privacy laws

November 20, 2024

Consent & Preferences

Mastering US opt-out requirements: A practical guide for marketers

Discover how to manage US opt-out requirements and enhance your marketing efforts with this guide. Download now to simplify compliance and build trust.

October 22, 2024

Privacy Automation

Global regulatory update: Recent privacy developments and compliance trends

Join us for a webinar on the latest updates and emerging trends in global privacy regulations.

September 12, 2024

Privacy Management

Preparing for child data protection laws in the US

Join DataGuidance and a panel of experts as we discuss US privacy laws the protection of minors' data.

August 07, 2024

Privacy Management

The road to 50 states: Rhode Island joins the US privacy landscape with a new law

Rhode Island has become the 20th US State to pass a privacy law. On June 25, 2024, the Governor of Rhode Island transmitted the Data Transparency and Privacy Protection Act (RIDTPPA) without signature allowing the Act to become law. Join the webinar to learn more.

July 16, 2024

Privacy Management

Preparing for the future of privacy in healthcare: Going beyond HIPAA compliance

Join us for a discussion on preparing your organization for healthcare privacy compliance that goes beyond HIPAA.

July 11, 2024

Privacy Management

The road to 50 states: Minnesota and Vermont join the US privacy landscape

In this webinar, OneTrust DataGuidance and expert contributors unpack the MCPA and VDPA, examining the requirements, exceptions, and practical implications of the legislations on the data controllers and processors.

June 17, 2024

Privacy Management

From legislation to operation: How to prepare for the new wave of US Privacy laws

Prepare your organization for the new wave of US privacy laws.

June 06, 2024

Third-Party Risk

TPRM privacy compliance: Questions to ask when working with third parties

Download this checklist to learn what questions to ask when designing a third-party risk management program that enables privacy compliance.

May 31, 2024

Comparing US state privacy law requirements

Download our infographic and compare the many US state privacy law requirements that have been enacted or will soon come into effect.

May 14, 2024

Privacy Management

Federal US privacy bill on the horizon? Exploring the draft APRA & new state privacy legislation

Join OneTrust DataGuidance and expert contributors for an overview of the Kentucky Consumer Privacy Act (KCPA), Maryland's Senate Bill 0541, and the draft American Privacy Rights Act and explore how a federal bill could shape the US privacy landscape.

April 23, 2024

Privacy Management

US state privacy laws timeline

View our timeline to understand the progression of current US state privacy laws and key dates.

April 23, 2024

Privacy Management

Spring into action! Navigating CPRA: Ensuring compliance and protecting privacy

Join us for an interactive webinar we dive into the CPRA, which will go into force on March 29th.

March 21, 2024

Privacy Management

The road to 50 states: New Jersey and New Hampshire join the US privacy landscape

oin OneTrust DataGuidance for a webinar highlighting the key requirements within the new US laws, New Jersey Senate Bill 332 and New Hampshire Senate Bill 255.

February 01, 2024

Privacy Automation

Embedding Privacy by Design through PIA Automation

Join us for a webinar on Embedding Privacy by Design through PIA Automation.

January 11, 2024

Privacy Management

Automating fulfillment of subject rights requests in the US

Learn how Privacy Rights Automation helps to fully automate privacy rights requests.

December 06, 2023