On May 9, 2024, Maryland passed its version of a comprehensive consumer data privacy statute called the Maryland Online Data Privacy Act (“MODPA”). Like all similar statutes, the purpose of the MODPA is to protect consumer data that is collected from online businesses and websites used for various purposes, such as completing sales transactions and engaging in targeted advertising. The MODPA uses the standard framework of imposing obligations on businesses that collect and process data and by granting a number of “data rights” to consumers. In this article, the Consumer Data Privacy and Compliance Attorneys at Revision Legal provide an overview of what consumers should know about the MODPA and what rights are protected for residents of Maryland.

Enforcement

The MODPA becomes fully operative on April 1, 2026. Section 14-6414, Sec. 2.

The MODPA will be enforced by the Consumer Protection Division of the Maryland Attorney General’s Office. The MODPA does not create a new enforcement mechanism but rather makes a violation of the MODPA equivalent to a violation of Maryland’s deceptive trade practices statutes. Md. Comm. Law Code, Section 13-301 et seq. Under those statutes, consumers can file complaints with the Consumer Protection Division for investigation and punishment. Consumers have no private right of action under the MODPA.

Meaning of “Personal Data”

Under the MODPA, “personal data” is effectively any data or information that can be used singularly or in combination with other data to identify a specific consumer. Thus, a consumer’s name, address, or social security number are types of “personal data.” Like similar statutes, the MODPA exempts certain categories of data, such as de-identified data or data that is publicly available.

Like similar statutes, the MODPA creates a subcategory of “personal data” that is called “sensitive data,” which is given higher protection. Sensitive data includes information about a consumer’s race or ethnic origin, religious beliefs, sexual orientation, etc. Sensitive data also include genetic data, biometric data, and precise geolocation data.

Rights Granted

The MODPA is probably the most consumer-protective data privacy statute enacted in the United States so far. Maryland consumers are protected by some very strong statutory prohibitions on what data controllers and processors can do. For example, controllers of consumer personal data are prohibited from selling or sharing “sensitive data” and cannot even “collect, process, or share” such sensitive data except where the collection or processing is “strictly necessary” to provide or maintain a “specific product or service” for the consumer. Another example is the sale or sharing of personal data regarding children, which is banned, and the processing of such data is prohibited for purposes of targeted advertising.

Maryland consumers are also protected by various rights granted with respect to their personal data. The rights granted are similar to the rights granted by similar statutes. These include the rights to:

• Know if a controller is collecting and processing personal data
• Know the categories of third parties to which a controller has disclosed personal data
• Access any such data
• Obtain copies of their data in a portable and usable format (where data is collected/processed through automated methods)
• Correct inaccuracies
• To require deletion of personal data — obtained from any source — unless retention is required by law
• Opt out of collection and processing of personal data for the purposes of targeted advertising, the sale/sharing of personal data, and profiling
• Consent – and withdraw consent – to the sale and processing of data under certain conditions
• Internal appeal mechanisms and procedures if a controller does not take action on a consumer’s requests (such as to delete data)
• Receive an active email address or other online mechanisms to contact the controller
• Receive a reasonably accessible, clear, and meaningful privacy notice from a controller collecting and/or processing personal data disclosing various information such as that data is being collected, what data is being collected, the business purposes for which the data is collected, etc.
• And more

Contact the Consumer Data Privacy and Compliance Attorneys at Revision Legal

For more information, contact the experienced Consumer Data Privacy and Compliance Lawyers at Revision Legal. You can contact us through the form on this page or call (855) 473-8474.