In this subtitle the following words have the meanings indicated. The following words have the meanings stated in § 10–401 of this title: Aggrieved person; Aural transfer; Communications common carrier; Contents; Electronic communication; Electronic communication service; Electronic communications system; Electronic, mechanical, or other device; Electronic storage; Intercept; Investigative or law enforcement officer; Judge of competent jurisdiction; Oral communication; Person; Readily accessible to the general public; User; and Wire communication. “Remote computing service” means the provision to the public of computer storage or processing services by means of an electronic communications system.

Except as provided in subsection (c) of this section, a person may not obtain, alter, or prevent authorized access to a wire or electronic communication while it is in electronic storage in an electronic communications system by: Intentionally accessing without authorization a facility through which an electronic communication service is provided; or Intentionally exceeding an authorization to access a facility through which an electronic communication service is provided. A person who violates the provisions of subsection (a) of this section is subject to the following penalties: If the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain: For a first offense, a fine of not more than $250,000 or imprisonment for not more than 1 year, or both; and For a second or subsequent offense, a fine of not more than $250,000 or imprisonment for not more than 2 years, or both; or In any other case, a fine of not more than $5,000 or imprisonment for not more than 6 months, or both. Subsection (a) of this section does not apply to conduct authorized: By the person or entity providing a wire or electronic communications service; By a user of a wire or electronic communications service with respect to a communication of or intended for that user; or Under the provisions of this subtitle.

Except as provided in subsection (b) of this section, a person or entity providing an electronic communication service to the public may not knowingly divulge to any other person or entity the contents of a communication while the communication is in electronic storage by that service. Except as provided in subsection (b) of this section, a person or entity providing remote computing service to the public may not knowingly divulge to any other person or entity the contents of any communication which is carried or maintained on that service: On behalf of, and received by means of electronic transmission from, or created by means of computer processing of communications received by means of electronic transmission from, a subscriber or customer of the service; and Solely for the purpose of providing storage or computer processing services to a subscriber or customer, if the provider is not authorized to access the contents of any communications for purposes of providing any services other than storage or computer processing. A person or entity may divulge the contents of a communication: To an addressee or intended recipient of the communication or an agent of the addressee or intended recipient; If authorized under the provisions of this subtitle; With the lawful consent of the originator or an addressee or intended recipient of the communication, or the subscriber in the case of remote computing service; To a person employed or authorized or whose facilities are used to forward the communication to its destination; If necessarily incident to the rendition of the service or to the protection of the rights or property of the provider of that service; or To a law enforcement agency, if the contents: Were inadvertently obtained by the service provider; and Appear to pertain to the commission of a crime.

An investigative or law enforcement officer may require a provider of wire or electronic communication service to disclose the contents of wire or electronic communication that is in electronic storage in a wire or electronic communications system only in accordance with a search warrant issued by a court of competent jurisdiction. In this subsection, “record or other information” includes name, address, local and long distance telephone connection records, or records of session times and durations, length of service (including start date) and types of service utilized, telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address, and means and source of payment for such service, including any credit card or bank account number. “Record or other information” does not include the contents of communications to which subsection (a) of this section applies. Except as provided in subparagraph (ii) of this paragraph, a provider of electronic communications service or remote computing service may disclose a record or other information pertaining to a subscriber to or a customer of the service to any person other than an investigative or law enforcement officer. A provider of electronic communications service or remote computing service shall disclose a record or other information pertaining to a subscriber to or a customer of the service to an investigative or law enforcement officer only if the officer: Uses a subpoena issued by a court of competent jurisdiction, a State grand jury subpoena, or a subpoena authorized under § 15–108 of the Criminal Procedure Article; Obtains a warrant from a court of competent jurisdiction; Obtains a court order requiring the disclosure under subsection (c) of this section; or Has the consent of the subscriber or customer to the disclosure. An investigative or law enforcement officer receiving records or information under this subsection is not required to provide notice to a subscriber or customer. A court of competent jurisdiction may issue an order requiring disclosure under subsection (b) of this section only if the investigative or law enforcement officer shows that there is reason to believe the records or other information sought are relevant to a legitimate law enforcement inquiry. A court issuing an order under this section may quash or modify the order, on a motion made promptly by the service provider, if the information or records requested are unusually voluminous in nature or if compliance with the order otherwise would cause an undue burden on the provider. Nothing in this subtitle may be construed as creating a cause of action against any provider of wire or electronic communication service, its officers, employees, agents, or other specified persons for providing information, facilities, or assistance in accordance with the terms of a court order, warrant, subpoena, or certification under this subtitle.

A subpoena or court order issued under § 10-4A-04 of this subtitle may include a requirement that the service provider to whom the request is directed create a backup copy of the contents of the electronic communications sought in order to preserve those communications. Without notifying the subscriber or customer of the subpoena or court order, the service provider shall create a backup copy as soon as practicable consistent with the provider’s regular business practices and shall confirm to the governmental entity that the backup copy has been made. The service provider shall create a backup copy under this subsection within 24 hours after the day on which the service provider receives the subpoena or court order. Except as provided in § 10-4A-06 of this subtitle, the investigative or law enforcement officer shall give notice to the subscriber or customer within 3 days after the day on which the governmental entity receives confirmation that a backup copy has been made under paragraph (1) of this subsection. The service provider may not destroy the backup copy until the later of: The delivery of the information; or The resolution of any proceedings, including appeals of any proceedings, concerning a subpoena or court order issued under § 10-4A-04 of this subtitle. The service provider shall release the backup copy to the requesting investigative or law enforcement officer no sooner than 14 days after the day on which the officer gives notice to the subscriber or customer, if the service provider: Has not received notice from the subscriber or customer that the subscriber or customer has challenged the officer’s request; and Has not initiated proceedings to challenge the officer’s request. An investigative or law enforcement officer may seek to require the creation of a backup copy under subsection (a)(1) of this section if, in the officer’s sole discretion, the officer determines that there is reason to believe that notification to the subscriber or customer under § 10-4A-04 of this subtitle of the existence of the subpoena or court order may result in destruction of or tampering with evidence. A determination under subparagraph (i) of this paragraph is not subject to challenge by the subscriber or customer or service provider. Within 14 days after a subscriber or customer receives notice from an investigative or law enforcement officer under subsection (a)(2) of this section, the subscriber or customer may file a motion to quash the subpoena or vacate the court order. The subscriber or customer shall serve a copy of the motion on the investigative or law enforcement officer and give written notice of the challenge to the service provider. A motion to vacate a court order shall be filed in the court that issued the order. A motion to quash a subpoena shall be filed in the appropriate court. A motion or application under this subsection shall contain an affidavit or sworn statement stating: That the applicant is a customer or subscriber to the service from which the contents of electronic communications maintained for the applicant have been sought; and The applicant’s reasons for believing that the records sought are not relevant to a legitimate law enforcement inquiry or that there has not been substantial compliance with the provisions of this chapter in some other respect. The applicant shall serve a copy of the motion or application on the investigative or law enforcement officer in accordance with the Maryland Rules. If the court finds that the applicant has complied with paragraphs (1) and (2) of this subsection, the court shall order the investigative or law enforcement officer to file a sworn response, which may be filed in camera if the investigative or law enforcement officer includes in the response the reasons which make an in camera review appropriate. If the court is unable to determine the motion or application on the basis of the parties’ initial allegations and response, the court may conduct additional proceedings as it deems appropriate. All such proceedings shall be completed and the motion or application decided as soon as practicable after the filing of the investigative or law enforcement officer’s response. If the court finds that the applicant is not the subscriber or customer for whom the communications sought by the investigative or law enforcement officer are maintained, or that there is a reason to believe that the law enforcement inquiry is legitimate and that the communications sought are relevant to that inquiry, the court shall deny the motion or application and order the subpoena or court order to be enforced. If the court finds that the applicant is the subscriber or customer for whom the communications sought by the investigative or law enforcement officer are maintained, and that there is no reason to believe that the communications sought are relevant to a legitimate law enforcement inquiry, or that there has not been substantial compliance with the provisions of this subtitle, the court shall order the subpoena to be quashed or the court order to be vacated. A court order denying a motion or application under this subsection is not a final order and no interlocutory appeal may be taken by the customer.

In this section the following words have the meanings indicated. “Adverse result” means: Endangering the life or physical safety of an individual; Flight from prosecution; Destruction of or tampering with evidence; Intimidation of potential witnesses; or Otherwise seriously jeopardizing an investigation or unduly delaying a trial. “Supervisory official” means: The Secretary or Deputy Secretary of State Police; The chief of police, deputy chief of police, or equivalent official of a law enforcement agency of any political subdivision of the State; The Attorney General of the State or a Deputy Attorney General; The State Prosecutor or Deputy State Prosecutor; or A State’s Attorney or Deputy State’s Attorney. An investigative or law enforcement officer acting under § 10–4A–04 of this subtitle may: If a court order is sought, include in the application a request for an order delaying the notification required under § 10–4A–05 of this subtitle for a period not to exceed 90 days, which the court shall grant, if the court determines that there is reason to believe that notification of the existence of the court order may have an adverse result; or If a subpoena issued by a court of competent jurisdiction or a grand jury subpoena is obtained, delay the notification required under § 10–4A–05 of this subtitle for a period not to exceed 90 days, upon the execution of a written certification to a court of competent jurisdiction by a supervisory official that there is reason to believe that notification of the existence of the subpoena may have an adverse result. The investigative or law enforcement officer shall maintain a true copy of a certification executed under subsection (b)(2) of this section. Extensions of a delay in notification may be granted by the court upon application or by certification by a supervisory official under subsection (b) of this section. An extension may not exceed 90 days. Upon expiration of the period of a delay of notification under subsection (b) or (d) of this section, the investigative or law enforcement officer shall serve upon, or deliver by registered or first–class mail, to the customer or subscriber a copy of the process or request together with a notice that: States with reasonable specificity the nature of the law enforcement inquiry; and Informs the customer or subscriber: That information maintained for the customer or subscriber by the service provider named in the process or request was supplied to or requested by that investigative or law enforcement officer and the date on which the information was supplied or the request was made; That notification of the customer or subscriber was delayed; Of the identity of the investigative or law enforcement officer or court that made the certification or determination authorizing the delay; and Of the statutory authority for the delay. If notice to the subscriber is not required under § 10–4A–04(b)(1) of this subtitle or if notice is delayed under subsection (b) or (d) of this section, an investigative or law enforcement officer acting under § 10–4A–04 of this subtitle may apply to a court for an order requiring a provider of electronic communications service or remote computing service to whom a warrant, subpoena, or court order is directed, for such period as the court deems appropriate, not to notify any other person of the existence of the warrant, subpoena, or court order. The court shall enter an order under this subsection if the court determines that there is reason to believe that notification of the existence of the warrant, subpoena, or court order will have an adverse result.

Except as otherwise provided in subsection (c) of this section, an investigative or law enforcement officer obtaining the contents of communications, records, or other information under § 10-4A-03, § 10-4A-04, or § 10-4A-05 of this subtitle shall pay to the person or entity assembling or providing the information a fee for reimbursement for costs that are reasonably necessary and that have been directly incurred in searching for, assembling, reproducing, or otherwise providing the information. Reimbursable costs shall include any costs due to necessary disruption of normal operations of any electronic communication service or remote computing service in which the information may be stored. The amount of the fee authorized under subsection (a) of this section shall be mutually agreed upon by the investigative or law enforcement officer and the person or entity providing the information, or, in the absence of agreement, shall be determined by the court which issued the order for production of the information or the court in which a criminal prosecution relating to the information would be brought, if no court order was issued for production of the information. The requirement of subsection (a) of this section does not apply with respect to records or other information maintained by a communications common carrier that relate to telephone toll records and telephone listings obtained under § 10-4A-04 of this subtitle. The court may, however, order a payment described in subsection (a) of this section if the court determines the information required is unusually voluminous in nature or otherwise caused an undue burden on the provider.

Except as provided in § 10–4A–04(d) of this subtitle, a provider of electronic communication service, subscriber, or customer aggrieved by a knowing or intentional violation of this subtitle may recover appropriate relief in a civil action against the person or entity that engaged in the violation. In a civil action under this section, appropriate relief includes: Appropriate preliminary and other equitable or declaratory relief; Damages under subsection (c) of this section; and A reasonable attorney’s fee and other litigation costs reasonably incurred. The court may assess as damages in a civil action under this section the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation, but in no case shall a person entitled to recover receive less than $1,000. A good faith reliance on any of the following is a complete defense to any civil or criminal action brought under this subtitle or any other State law: A court warrant or order, a grand jury subpoena, a legislative authorization, or a statutory authorization; or A good faith determination that § 10–402(d) of this title permitted the conduct that is the subject of the action. A civil action under this section shall be filed within 2 years after the day on which the claimant first discovered or had a reasonable opportunity to discover the violation.