Maryland

Data Breach Requirements: Md. Code Ann., Com. Law § 14-3501 et seq.

The numbering and internal citations herein are derived from the applicable state statute.

Personal Information

The term “personal information” means:
(i) An individual’s first name or first initial and last name in combination with any one or more of the following data elements, when the name or the data elements are not encrypted, redacted, or otherwise protected by another method that renders the information unreadable or unusable:

1. A Social Security number, an individual taxpayer identification number, a passport number, or other identification number issued by the federal government;
2. A driver’s license number or state identification card number;
3. An account number, a credit card number, or a debit card number, in combination with any required security code, access code, or password, that permits access to an individual’s financial account;
4. Health information, including information about an individual’s mental health;
5. A health insurance policy or certificate number or health insurance subscriber identification number, in combination with a unique identifier used by an insurer or an employer that is self-insured, that permits access to an individual’s health information; or
6. Biometric data of an individual generated by automatic measurements of an individual’s biological characteristics such as a fingerprint, voice print, genetic print, retina or iris image, or other unique biological characteristic, that can be used to uniquely authenticate the individual’s identity when the individual accesses a system or account; or
   (ii) A username or email address in combination with a password or security question and answer that permits access to an individual’s email account.

Security Breach Definition

The term “breach of the security of a system” means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of the personal information maintained by a business.

Good Faith Exception

A breach of the security of a system does not include the good faith acquisition of personal information by an employee or agent of a business for the purposes of the business, provided that the personal information is not used or subject to further unauthorized disclosure.

Risk of Harm Analysis

A business that owns, licenses, or maintains computerized data that includes personal information of an individual residing in the state, when it discovers or is notified that it incurred a breach of the security of a system, shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information of the individual has been or will be misused as a result of the breach. Unless the business reasonably determines that the breach of the security of the system does not create a likelihood that personal information has been or will be misused, the owner or licensee of the computerized data shall notify the individual of the breach.

Notification Timeline

The breach notification shall be given as soon as reasonably practicable, but not later than 45 days after the business discovers or is notified of the breach of the security of a system.

Security and Investigation Exceptions

The breach notification may be delayed:
(i) If a law enforcement agency determines that the notification will impede a criminal investigation or jeopardize homeland or national security; or
(ii) To determine the scope of the breach of the security of a system, identify the individuals affected, or restore the integrity of the system.
(2) If notification is delayed under paragraph (1)(i) of this subsection, notification shall be given as soon as reasonably practicable, but not later than 30 days after the law enforcement agency determines that it will not impede a criminal investigation and will not jeopardize homeland or national security.

Notification Content Requirements

The breach notification shall include:
(1) To the extent possible, a description of the categories of information that were, or are reasonably believed to have been, acquired by an unauthorized person, including which of the elements of personal information were, or are reasonably believed to have been, acquired;
(2) Contact information for the business making the notification, including the business’ address, telephone number, and toll-free telephone number if one is maintained;
(3) The toll-free telephone numbers and addresses for the major consumer reporting agencies; and
(4)(i) The toll-free telephone numbers, addresses, and website addresses for: the Federal Trade Commission; and the Office of the Attorney General; and (ii) a statement that an individual can obtain information from these sources about steps the individual can take to avoid identity theft.

Delivery Methods

A breach notice shall be provided by one of the following methods:
(1) By written notice sent to the most recent address of the individual in the records of the business;
(2) By email to the most recent email address of the individual in the records of the business, if: (i) the individual has expressly consented to receive electronic notice; or (ii) the business conducts its business primarily through internet account transactions or the internet;
(3) By telephonic notice, to the most recent telephone number of the individual in the records of the business; or
(4) By substitute notice if the business does not have sufficient contact information to give notice in accordance with item (1), (2), or (3) of this subsection.

Substitute Notice

Substitute notice shall consist of:
(1) Emailing the notice to an individual entitled to notification under subsection (b) of this section, if the business has an email address for the individual to be notified;
(2) Conspicuous posting of the notice on the website of the business, if the business maintains a website; and
(3) Notification to major print or broadcast media in geographic areas where the individuals affected by the breach likely reside.

Notice to Government Agencies

Prior to giving the breach notification (and subject to subsection to the timeline delay exceptions), a business shall provide notice of a breach of the security of a system to the Office of the Attorney General. The notice required under paragraph (1) of this subsection shall include, at a minimum: (i) the number of affected individuals residing in the state; (ii) a description of the breach of the security of a system, including when and how it occurred; (iii) any steps the business has taken or plans to take relating to the breach of the security of a system; and (iv) the form of notice that will be sent to affected individuals and a sample notice.

Consumer Reporting Agencies

If a business is required to give notice of a breach of the security of a system to 1,000 or more individuals, the business also shall notify, without unreasonable delay, each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis of the timing, distribution, and content of the notices. This does not require the inclusion of the names or other personal identifying information of recipients of notices of the breach of the security of a system.

Preemption and Compliance

A business that complies with the requirements for notification procedures, the protection or security of personal information, or the destruction of personal information under the rules, regulations, procedures, or guidelines established by the primary or functional federal or state regulator of the business shall be deemed to be in compliance with this subtitle.

A business that is subject to and in compliance with § 501(b) of the federal Gramm-Leach-Bliley Act, § 216 of the federal Fair and Accurate Credit Transactions Act, 15 U.S.C. § 1681w, the federal Interagency Guidelines Establishing Information Security Standards, and the federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, and any revisions, additions, or substitutions, shall be deemed to be in compliance with this subtitle. An affiliate that complies with § 501(b) of the federal Gramm-Leach-Bliley Act, 15 U.S.C. § 6801, § 216 of the federal Fair and Accurate Credit Transactions Act, 15 U.S.C. § 1681w, the federal Interagency Guidelines Establishing Information Security Standards, and the federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, and any revisions, additions, or substitutions, shall be deemed to be in compliance with this subtitle.

A business that is subject to and in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) shall be deemed to be in compliance with this subtitle. An affiliate that is in compliance with HIPAA shall be deemed to be in compliance with this subtitle.

Data Processor Obligations

(c)(1) A business that maintains computerized data that includes personal information of an individual residing in the state that the business does not own or license, when it discovers or is notified of a breach of the security of a system, shall notify, as soon as practicable, the owner or licensee of the personal information of the breach of the security of a system.
(2) Except as provided in subsection (d) of this section, the notification required under paragraph (1) of this subsection shall be given as soon as reasonably practicable, but not later than 10 days after the business discovers or is notified of the breach of the security of a system.
(3) A business that is required to notify an owner or licensee of personal information of a breach of the security of a system under paragraph (c)(1) of this subsection shall share with the owner or licensee information relative to the breach.

Other Information

In the case of a breach of the security of a system involving personal information that permits access to an individual’s email account under § 14-3501(e)(1)(ii) of this subtitle and no other personal information under § 14-3501(e)(1)(i) of this subtitle, the business may comply with the breach notification requirement by providing the notification in electronic or other form that directs the individual whose personal information has been breached promptly to: (i) change the individual’s password and security question or answer, as applicable; or (ii) take other steps appropriate to protect the email account with the business and all other online accounts for which the individual uses the same username or email and password or security question or answer. Notwithstanding, the breach notification provided here may be given to the individual by any method, except the notification may not be given to the individual by sending notification by email to the email account affected by the breach. The breach notification described here may be given by a clear and conspicuous notice delivered to the individual online while the individual is connected to the affected email account from an internet protocol address or online location from which the business knows the individual customarily accesses the account.

(4)(i) If the business that incurred the breach of the security of a system is not the owner or licensee of the computerized data, the business may not charge the owner or licensee of the computerized data a fee for providing information that the owner or licensee needs to make a notification under subsection (b)(2) of this section.
(ii) The owner or licensee of the computerized data may not use information relative to the breach of the security of a system for purposes other than:

1. Providing notification of the breach;
2. Protecting or securing personal information; or
3. Providing notification to national information security organizations created for information-sharing and analysis of security threats, to alert and avert new or expanded breaches.

Data Disposal and Security: Md. Code Ann., Com. Law §§ 14-3501 to 14-3503.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

Key Terms

The term “personal information” means:
(i) An individual’s first name or first initial and last name in combination with any one or more of the following data elements, when the data elements are not encrypted, redacted, or otherwise protected by another method that renders the information unreadable or unusable:

1. A Social Security number, an individual taxpayer identification number, a passport number, or other identification number issued by the federal government;
2. A driver’s license number or state identification card number;
3. An account, credit, or a debit card number, in combination with any required security code, access code, or password, that permits access to an individual’s financial account;
4. Health information, including information about an individual’s mental health;
5. A health insurance policy or certificate number or health insurance subscriber identification number, in combination with a unique identifier used by an insurer or an employer that is self-insured, that permits access to an individual’s health information;
6. Biometric data of an individual generated by automatic measurements of an individual’s biological characteristics such as a fingerprint, voice print, genetic print, retina or iris image, or other unique biological characteristic that can be used to uniquely authenticate the individual’s identity when the individual accesses a system or account; or
7. For purposes of the notifications required under section 14-3504(b)(2), (c), (d), (e), (f), and (g) of this subtitle, genetic information with respect to an individual;
   (ii) A username or email address in combination with a password or security question and answer that permits access to an individual’s email account; or
   (iii) For the purposes of the requirements of this title other than the notifications required under section 14-3504(b)(2), (c), (d), (e), (f), and (g) of this subtitle, genetic information with respect to an individual when the genetic information is not encrypted, redacted, or otherwise protected by another method that renders the information unreadable or unusable.

Security Requirements

To protect personal information from unauthorized access, use, modification, or disclosure, a business that owns, maintains or licenses personal information of an individual residing in the state shall implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information owned, maintained or licensed and the nature and size of the business and its operations.

A business that uses a nonaffiliated third party as a service provider to perform services for the business and discloses personal information about an individual residing in the state under a written contract with the third party shall require by contract that the third party implement and maintain reasonable security procedures and practices that:
(i) Are appropriate to the nature of the personal information disclosed to the nonaffiliated third party; and
(ii) Are reasonably designed to help protect the personal information from unauthorized access, use, modification, disclosure, or destruction.

Data Disposal

When a business is destroying a customer’s, an employee’s, or a former employee’s records that contain personal information of the customer, employee, or former employee, the business shall take reasonable steps to protect against unauthorized access to or use of the personal information, taking into account:
(1) The sensitivity of the records;
(2) The nature and size of the business and its operations;
(3) The costs and benefits of different destruction methods; and
(4) Available technology.