Bill > HB1365

This bill modifies Maryland's commercial law regarding online data privacy by changing how businesses (referred to as "controllers") collect and handle personal data. The bill refines the definition of "personal data" as any information that can be linked to a specific consumer, excluding de-identified or publicly available information. The key modification alters the requirement for data collection, expanding controllers' obligations from limiting data collection only for maintaining a specific product or service to a broader standard of collecting data that is adequate, relevant, and reasonably necessary in relation to the disclosed purposes of data processing. Additionally, the bill maintains existing requirements that controllers establish robust data security practices to protect personal data's confidentiality and integrity, and provide consumers with an easy mechanism to revoke their consent for data use. The legislation is set to take effect on October 1, 2025, and is aligned with the effective dates of related chapters in Maryland's legislative session. By broadening the scope of data collection limitations, the bill aims to give consumers more control and protection over their personal information in the digital marketplace.

Business and Industry

https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/HB1365?ys=2025RS