Cybersecurity Policy Report, Maryland Legislature Passes Two Data Privacy Bills, (Apr 8, 2024)
Nearing the close of Maryland’s legislative session, the state General Assembly voted unanimously to give final approval to the proposed Maryland Online Data Privacy Act, intended to limit the collection, sale, and use of consumers’ personal data, as well as the Maryland Age-Appropriate Design Code (AADC) Act, or the Maryland Kids Code, that seeks to implement new online protections for children.
One of the passed bills (SB 541) would establish a framework controlling the manner in which an entity may process a consumer’s personal data; authorize a consumer to exercise certain rights regarding their personal data; and require a controller of personal data to establish a method for a consumer to exercise certain rights related to personal data.
The bill, which was sponsored by Sen. Dawn Gile (D.), Del. Sara Love (D.), and others, proposes to give consumers certain rights such as the right to confirm that data is being collected or processed, request that data be deleted or corrected, or view the types of data being collected. Consumers would also be afforded the right to opt out of the sale of their online personal data for purposes of targeted advertising, sale, or profiling. The bill further requires consent for the collection, sale, and processing of the data of children between the ages of 13 and 18.
In addition, the bill seeks to limit the collection of personal data to “what is reasonably necessary and proportionate” for legitimate business needs. Companies would further be required to maintain “reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data.”
The other bill is called the Maryland Kids Code (SB 571/HB 603) and would require covered entities with online products that are likely to be accessed by children to ensure that those online products are “designed in a manner that recognizes the distinct needs of children within different age ranges.” The bill requires such entities to, on or before April 1, 2026, prepare a data protection impact assessment for their online products. The assessment should consider whether the product is designed and offered in “a manner consistent with the best interests of children reasonably likely to access the online product.”
The bill further restricts data collection, sharing, and profiling and the use of data in a way that is detrimental to a child. It would require strict privacy settings by default and switching off geolocation and prohibit the use of “nudge techniques” to encourage children to weaken their privacy protections.
NetChoice is urging Gov. Wes Moore (D.) to veto SB 571/HB 603, contending that the legislation “will do nothing to materially help Maryland’s minors stay safe online, while raising serious constitutional issues, harming online speech and undermining the privacy of all Marylanders and their children.”
“The good intentions of this legislation do not change that it fails to address the core of the problem lawmakers are trying to solve: keeping young people safe online. It is also unfortunately riddled with privacy problems and constitutional concerns. We hope Gov. Moore will veto it,” said Carl Szabo, NetChoice’s vice president and general counsel. “Instead of targeting tools and innovators, lawmakers should focus on ensuring minors are being educated about digital safety in schools and better empower law enforcement to arrest online child predators.”
News: DataPrivacy StateLegislation