Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

On April 6, the Maryland Legislature <a>sent the </a><a href="https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541" target="_blank" rel="noreferrer noopener">Maryland Online Data Privacy Act</a> (MODPA) to Governor Wes Moore for his signature and concurrence. Once MODPA is enacted into law, Maryland will join the growing number of states that have created comprehensive data privacy laws. MODPA grants Maryland residents a broad range of data protection rights and requires covered businesses to comply with new data privacy and information security requirements. In addition, <a>MODPA </a>essentially prohibits targeted advertising with respect to minors under the age of 18, unless proper consent is obtained or other limited exceptions apply. This is a significant deviation from other data privacy laws, which often only require opt-in consent for targeted advertising for consumers who are 13 (or in some instances, 16) years of age or younger.

contentpilot/introduction

MODPA does not create a private right of action and delegates enforcement authority to the Maryland attorney general. If enacted into law, MODPA will enter into force on October 1, 2025.

core/paragraph

core/heading

MODPA applies to organizations that conduct business in Maryland or produce products or services targeted to Maryland residents and during a calendar year control or process the personal data (i) of at least 35,000 consumers (excluding personal data processed solely to complete a payment transaction) or (ii) of at least 10,000 consumers and derive over 20% of gross revenue from the sale of personal data.

MODPA includes several exemptions that are standard in data privacy frameworks, including exemptions for state and local governments, organizations governed by federal law (e.g., HIPAA, GLBA), and certain nonprofit and educational institutions.

MODPA primarily regulates how data “controllers” and data “processors” can collect and process a consumer’s personal and health data. The term “consumer” is defined as any Maryland resident, but excludes individuals acting in a commercial or employment context.

The term “personal data” means any information that is linked or can be reasonably linked to an identified or identifiable consumer, but does not include “de-identified data” or “publicly available information” (each of which has its own definition).

In addition, MODPA creates additional requirements when an entity processes “sensitive data,” which is defined as a subset of personal data that includes any of the following:

core/list

The term “consumer health data” is defined as a subset of personal data that is used to identify a consumer’s physical or mental health status and includes data related to gender-affirming care treatment and reproductive and sexual health care.

Maryland’s law is relatively unique compared to other state data protection laws because of its affirmative obligations concerning confidentiality and geofencing. In particular, MODPA provides that a controller may not provide an employee or a contractor access to consumer health data unless the recipient is subject to a contractual or statutory duty of confidentiality or confidentiality of such data is required as a condition of employment.

In addition, the law prohibits a controller from providing its data processors (i.e., its service providers) access to consumer health data unless they execute agreements with certain data processing clauses (see below).

The law also categorically prohibits controllers from using a geofence to establish “a virtual boundary that is within 1,750 feet of” a mental health or reproductive or sexual health facility “for the purpose of identifying, tracking, or collecting data from or sending any notification to a consumer regarding [their] consumer health data.” The term “geofence” includes boundaries established or monitored through the use of GPS technology, cell tower connectivity, cellular data, radio frequency identification, wireless fidelity technology or other forms of location determination technology.

As with other state privacy laws, MODPA grants consumers the rights to:

MODPA requires controllers to establish a process for how they can receive, process, and respond to such data privacy requests, including how they are required to “authenticate” consumer requests and timelines for when such responses must be furnished to consumers. The law also requires controllers to create a framework for how consumers can appeal a controller’s decision on responding to a privacy request. However, <a>MODPA </a>is clear that none of these rights or other opt-out rights (see below) will require a controller to “reveal a trade secret.”

MODPA defines the “sale of personal data” as the exchange of personal data by a controller, a processor, or its affiliates, to a third party for “monetary or other valuable consideration.” With respect to selling data, MODPA:

Importantly, MODPA has several exemptions to clarify what is not considered a sale of personal data, such as the disclosure of personal data to a processor for limited purposes, to an affiliate or third party for the purposes of providing a product or service affirmatively requested by the consumer, upon the direction of the consumer, and to third parties as part of corporate restructuring- or bankruptcy-related processes.

MODPA creates a unique framework for how controllers can engage in “targeted advertising,” which is defined as “displaying advertisements to a consumer or on a device identified by a unique identifier where the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated websites or online applications to predict that consumer’s preferences or interests” and includes common exemptions related to online marketing. Specifically, MODPA:

This is a significant deviation from other data privacy laws, which often only require opt-in consent for targeted advertising for consumers who are 13 (or in some instances, 16) years of age or younger.

In addition to the privacy rights and data processing restrictions above, MODPA imposes additional obligations on data controllers. For example, a controller:

In addition, MODPA prohibits a controller from processing personal data in violation of discrimination-related laws, including discrimination against consumers for exercising their privacy rights, such as through pricing differences.

Information Security and Data Protection Assessments

MODPA requires controllers to “establish, implement and maintain reasonable administrative, technical, and physical security practices” to safeguard and protect “the confidentiality, integrity, and accessibility of personal data” and such measures must be appropriate to the “volume and nature” of the personal data at issue. Accordingly, MODPA supplements other Maryland laws related to <a href="https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&amp;section=14-3502&amp;enactments=false" target="_blank" rel="noreferrer noopener">data disposal</a> and <a href="https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&amp;section=14-3503&amp;enactments=False&amp;archived=False" target="_blank" rel="noreferrer noopener">data security</a>.

Like other privacy laws, MODPA requires a controller to conduct and document data processing assessments for each of its processing activities that present a heightened risk of harm (i.e., sale of personal data, processing of sensitive data, certain types of profiling, processing for targeted advertising) to a consumer, including an assessment for each algorithm that is used. This data protection assessment must identify and “weigh the benefits that may flow directly and indirectly from the processing to the controller, the consumer, other interested parties, and the public” against the potential risks to the rights of the consumer associated with the processing, as mitigated by safeguards the controller may employ to reduce such risk, and the necessity and proportionality of the processing in relation to its stated purpose. The law provides that the controller shall factor into this assessment the use of de-identified data, consumers’ reasonable expectations, the context of the processing of personal data, and the relationship between the controller and the consumer whose personal data will be processed. Pursuant to MODPA, the Maryland Consumer Protection Division may require that a controller provide it with a data protection assessment that is relevant to an investigation it is conducting.

Controllers are required to provide consumers with “a reasonably accessible, clear, and meaningful privacy notice” that addresses:

If a controller sells personal data to third parties or processes personal data for targeted advertising or certain types of profiling, the controller shall clearly and conspicuously disclose these activities, as well as the manner in which a consumer may exercise the right to opt out of processing.

Processor Obligations and Data Processing Agreements

MODPA also places affirmative obligations on processors, such as those related to compliance with a controller’s instructions and assistance in responding to consumer rights requests. Moreover, the law requires processors to help meet a controller’s obligations related to the security of processing personal data and providing notification of a <a href="https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&amp;section=14-3504&amp;enactments=False&amp;archived=False" target="_blank" rel="noreferrer noopener">data breach</a> occurring within the processor’s system. MODPA also requires controllers and processors to execute written agreements that contain certain data protection clauses, which must address, among other things, the nature and purpose of data processing, the duration of the processing, the types of data subject to processing, parties’ rights and obligations, confidentiality duties, compliance disclosures, and subprocessing.

The law emphasizes that “[d]etermining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which personal data is to be processed” and a processor that adheres to a controller’s data processing instructions remains a processor.

<a></a><a>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.</a>

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/04/Privacy-Cybersecurity-Update-Maryland-Poised-to-Enact-Privacy-Law.pdf

Maryland Poised to Enact Privacy Law; Sets New Standard for Targeted Advertising

Services