In this subtitle the following words have the meanings indicated. “Affiliate” means a person that, directly or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with another person, such that the person: Owns or has the power to vote more than 50% of the outstanding shares of any voting class of the other person’s securities; Has the power to elect or influence the election of a majority of the directors, members, or managers of the other person; Has the power to direct the management of the other person; or Is subject to the other person’s exercise of the powers described in item (1), (2), or (3) of this subsection. “Authenticate” means to use reasonable means to determine that a request to exercise a consumer right in accordance with § 14–4705 of this subtitle is being made by, or on behalf of, a consumer who is entitled to exercise the consumer right with respect to the personal data at issue. “Biometric data” means data generated by automatic measurements of the biological characteristics of a consumer that can be used to uniquely authenticate a consumer’s identity. “Biometric data” includes: A fingerprint; A voice print; An eye retina or iris image; and Any other unique biological characteristics that can be used to uniquely authenticate a consumer’s identity. “Biometric data” does not include: A digital or physical photograph; An audio or video recording; or Any data generated from a digital or physical photograph or an audio or video recording, unless the data is generated to identify a specific consumer. “Business associate” has the meaning stated in HIPAA. “Child” has the meaning stated in COPPA. “Consent” means a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to allow the processing of personal data relating to the consumer for a particular purpose. “Consent” includes: A written statement; A written statement by electronic means; or Any other unambiguous affirmative action. “Consent” does not include: Acceptance of a general or broad terms of use or similar document that contains descriptions of personal data processing along with other unrelated information; Hovering over, muting, pausing, or closing a piece of content; or Agreement obtained through the use of dark patterns. “Consumer” means an individual who is a resident of the State. “Consumer” does not include: An individual acting in a commercial or employment context; or An individual acting as an employee, an owner, a director, an officer, or a contractor of a company, a partnership, a sole proprietorship, a nonprofit organization, or a governmental unit whose communications or transactions with a controller occur only within the context of the individual’s role with the company, partnership, sole proprietorship, nonprofit organization, or governmental unit. “Consumer health data” means personal data that a controller uses to identify a consumer’s physical or mental health status. “Consumer health data” includes data related to: Gender–affirming treatment; or Reproductive or sexual health care. “Control” means: Ownership of or the power to vote more than 50% of the outstanding shares of any class of voting security of a business; Any manner of control over the election of a majority of the directors of a business, or individuals exercising similar functions; or The power to exercise a controlling influence over the management of a business. “Controller” means a person that, alone or jointly with others, determines the purpose and means of processing personal data. “COPPA” means the federal Children’s Online Privacy Protection Act of 1998 and the regulations, rules, guidance, and exemptions adopted under the Act, and as the Act and the regulations, rules, guidance, and exemptions may be amended. “Covered entity” has the meaning stated in HIPAA. “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting user autonomy, decision making, or choice. “Dark pattern” includes any practice the Federal Trade Commission refers to as a “dark pattern”. “Decisions that produce legal or similarly significant effects concerning the consumer” means decisions that result in the provision or denial of: Financial or lending services; Housing; Education enrollment or opportunity; Criminal justice; Employment opportunities; Health care services; or Access to essential goods or services. “De–identified data” has the meaning stated in § 14–4401 of this title. “Division” has the meaning stated in § 13–101 of this article. “Gender–affirming treatment” has the meaning stated in § 15–151(a) of the Health – General Article. “Genetic data” has the meaning stated in § 14–4401 of this title. “Geofence” means technology that establishes a virtual geographical boundary. “Geofence” includes boundaries that are established or monitored through the use of: Global positioning technology; Cell tower connectivity; Cellular data; Radio frequency identification; Wireless fidelity technology; or Any other form of location determination technology. “HIPAA” means the federal Health Insurance Portability and Accountability Act of 1996. “Identified or identifiable consumer” means a consumer who can readily be identified, either directly or indirectly. “Mental health facility” means a health care facility in which not less than 70% of health care services offered are mental health services. “Personal data” means any information that is linked or can be reasonably linked to an identified or identifiable consumer. “Personal data” does not include: De–identified data; or Publicly available information. “Precise geolocation data” means information derived from technology that can precisely and accurately identify, within a radius of 1,750 feet, the specific location of a consumer, a mobile device, or a vehicle. “Precise geolocation data” includes global positioning system level latitude and longitude coordinates or other similar mechanisms. “Precise geolocation data” does not include: The content of communications; Data generated by or connected to an advanced utility metering infrastructure system; or Data generated by equipment used by a utility company. “Process” means an operation or set of operations performed by manual or automated means on personal data. “Process” includes collecting, using, storing, disclosing, analyzing, deleting, or modifying personal data. “Processor” means a person that processes personal data on behalf of a controller. “Profiling” means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable consumer’s economic situation, health, demographic characteristics, personal preferences, interests, reliability, behavior, location, or movements. “Protected health information” has the meaning stated in HIPAA. “Publicly available information” means information that a person: Lawfully obtains from a record of a governmental entity, if the person complies with each restriction or term of use that the governmental entity imposes as a condition for providing the information to the person; Reasonably believes a consumer or widely distributed media have lawfully made available to the general public; or If the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information. “Publicly available information” does not include biometric data collected by a business about a consumer without the consumer’s knowledge. “Reproductive or sexual health care” means a health care–related service or product rendered or provided concerning a consumer’s reproductive system or sexual well–being, including: A service or product provided related to an individual health condition, status, disease, diagnosis, test, or treatment; A social, psychological, behavioral, or medical intervention; A surgery or procedure; The purchase or use of a medication, including a medication purchased or used for the purposes of an abortion; A service or product related to a bodily function, vital sign, or symptom; A measurement of a bodily function, vital sign, or symptom; and An abortion, and medical and nonmedical services, products, diagnostics, counseling, and follow–up services for an abortion. “Reproductive or sexual health care facility” means a health care facility where not less than 70% of services offered are reproductive or sexual health care services. “Sale of personal data” means the exchange of personal data by a controller, a processor, or an affiliate of a controller or processer to a third party for monetary or other valuable consideration. “Sale of personal data” does not include: The disclosure of personal data to a processor that processes personal data on behalf of a controller if limited to the purposes of the processing; The disclosure of personal data to a third party for purposes of providing a product or service affirmatively requested by the consumer; The disclosure or transfer of personal data to an affiliate of the controller; The disclosure of personal data where the consumer: Directs the controller to disclose the personal data; or Intentionally uses the controller to interact with a third party; The disclosure of personal data that the consumer: Intentionally made available to the general public through a channel of mass media; and Did not restrict to a specific audience; or The disclosure or transfer of personal data to a third party as an asset that is part of an actual or proposed merger, acquisition, bankruptcy, or other transaction where the third party assumes control of all or part of the controller’s assets. “Sensitive data” means personal data that includes: Data revealing: Racial or ethnic origin; Religious beliefs; Consumer health data; Sex life; Sexual orientation; Status as transgender or nonbinary; National origin; or Citizenship or immigration status; Genetic data or biometric data; Personal data of a consumer that the controller knows or has reason to know is a child; or Precise geolocation data. “Sensitive data” includes data inferred by a controller based on personal data that, alone or in combination with other data, is used to indicate any data described under paragraph (1)(i) through (iv) of this subsection. “Targeted advertising” means displaying advertisements to a consumer or on a device identified by a unique identifier, where the advertisement is selected based on personal data obtained or inferred from the consumer’s activities over time and across nonaffiliated websites or online applications that are unaffiliated with each other, in order to predict the consumer’s preferences or interests. “Targeted advertising” does not include: Advertisements based on the context of a consumer’s current search query, visit to a website, or online application; Advertisements based on a consumer’s activities within a controller’s websites or online applications; Advertisements directed to a consumer in response to the consumer’s request for information or feedback; or Processing personal data solely to measure or report advertising frequency, performance, or reach. “Third party” means a person other than the relevant consumer, controller, processor, or affiliate of the controller or processor of relevant personal data. “Trade secret” has the meaning stated in § 11–1201 of this article.

This subtitle applies to a person that conducts business in the State or provides products or services that are targeted to residents of the State, and that during the preceding calendar year did any of the following: Controlled or processed the personal data of at least 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or Controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of its gross revenue from the sale of personal data.

This subtitle does not apply to: A regulatory, administrative, advisory, executive, appointive, legislative, judicial body or instrumentality of the State, including a board, bureau, commission, or unit of the State or a political subdivision of the State; A national securities association that is registered under § 15 of the federal Securities Exchange Act of 1934 or a registered futures association designated in accordance with § 17 of the federal Commodity Exchange Act; A financial institution, an affiliate of a financial institution, or data that is subject to Title V of the federal Gramm–Leach–Bliley Act and regulations adopted under that act; or A nonprofit controller that processes or shares personal data solely for the purposes of assisting: Law enforcement agencies in investigating criminal or fraudulent acts relating to insurance; or First responders in responding to catastrophic events. The following information and data are exempt from this subtitle: Protected health information under HIPAA; Patient–identifying information for purposes of 42 U.S.C. § 290dd–2; Identifiable private information that is used for purposes of the federal policy for the protection of human subjects in accordance with 45 C.F.R. § 46; Identifiable private information to the extent that it is collected and used as part of human subjects research in accordance with the ICH 36 Good Clinical Practice Guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use or the protection of human subjects under 21 C.F.R. §§ 50 and 56; Patient safety work product that is created and used for purposes of patient safety improvement in accordance with 42 C.F.R. § 3, established in accordance with 42 U.S.C. §§ 299b–21 through 299b–26; Information to the extent it is used for public health, community health, or population health activities and purposes, as authorized by HIPAA, when provided by or to a covered entity or when provided by or to a business associate in accordance with the business associate agreement with a covered entity; Information that is a medical record under § 4–301 of the Health – General Article if: The information is held by an entity that is a covered entity or business associate under HIPAA because it collects, uses, or discloses protected health information; and The entity applies the same standards for the collection, use, and disclosure of the information as required for protected health information under HIPAA and medical records under § 4–301 of the Health – General Article, including specific standards regarding legally protected health care; and Information that is de–identified in accordance with the requirements for de–identification set forth in 45 C.F.R. 164.514 that is derived from individually identifiable health information as described in HIPAA or personal information consistent with the human subject protection requirements of the U.S. Food and Drug Administration; The collection, maintenance, disclosure, sale, communication, or use of personal information bearing on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, furnisher, or user that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the federal Fair Credit Reporting Act; Personal data collected, processed, sold, or disclosed as required by the federal Driver’s Privacy Protection Act of 1994; Personal data regulated by the federal Family Educational Rights and Privacy Act; Personal data collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act; Data processed or maintained: In the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of the role; As the emergency contact information of a consumer if the data is used for emergency contact purposes; or That is: Necessary to retain to administer benefits for another individual relating to the consumer who is the subject of the information under item (i) of this item; and Used for the purposes of administering the benefits; Personal data collected, processed, sold, or disclosed in relation to price, route, or service by an air carrier subject to the federal Airline Deregulation Act to the extent this subtitle is preempted by the federal Airline Deregulation Act; and Personal data collected by or on behalf of a person regulated under the Insurance Article or an affiliate of such a person, in furtherance of the business of insurance. Controllers and processors that comply with the verifiable parental consent requirements of COPPA shall be considered compliant with an obligation to obtain parental consent in accordance with this subtitle with respect to a consumer who is a child.

A person may not: Provide an employee or a contractor access to consumer health data unless: The employee or contractor is subject to a contractual or statutory duty of confidentiality; or Confidentiality is required as a condition of employment of the employee; Provide a processor access to consumer health data unless the person providing access to the consumer health data and the processor comply with § 14–4708 of this subtitle; or Use a geofence to establish a virtual boundary that is within 1,750 feet of any mental health facility or reproductive or sexual health facility for the purpose of identifying, tracking, or collecting data from, or sending any notification to a consumer regarding the consumer’s consumer health data.

Nothing in this section may be construed to require a controller to reveal a trade secret. A consumer shall have the right to: Confirm whether a controller is processing the consumer’s personal data; If a controller is processing a consumer’s personal data, access the consumer’s personal data; Considering the nature of the consumer’s personal data and the purposes of the processing of the personal data, correct inaccuracies in the consumer’s personal data; Require a controller to delete personal data provided by, or obtained about, the consumer unless retention of the personal data is required by law; If the processing of personal data is done by automatic means, obtain a copy of the consumer’s personal data processed by the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to easily transmit the data to another controller without hindrance; Obtain a list of the categories of third parties to which the controller has disclosed the consumer’s personal data or a list of the categories of third parties to which the controller has disclosed any consumer’s personal data if the controller does not maintain this information in a format specific to the consumer; and Opt out of the processing of personal data for purposes of: Targeted advertising; The sale of personal data; or Profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. A controller shall establish a secure and reliable method for a consumer to exercise a consumer right under this section. A consumer may exercise a consumer right under this section by the method established by the controller under paragraph (1) of this subsection. A consumer may designate an authorized agent in accordance with § 14–4706 of this subtitle to opt out of the processing of the consumer’s personal data under subsection (b)(7) of this section on behalf of a consumer. A parent or legal guardian of a child may exercise a consumer right listed in subsection (b) of this section on the child’s behalf regarding the processing of personal data. A guardian or conservator of a consumer subject to a guardianship, conservatorship, or other protective arrangement may exercise a consumer right listed in subsection (b) of this section on the consumer’s behalf regarding the processing of personal data. Except as otherwise provided in this subtitle, a controller shall comply with a request by a consumer to exercise a consumer right listed in this section. A controller shall respond to a consumer request not later than 45 days after the controller receives the consumer request. A controller may extend the completion period by an additional 45 days if: It is reasonably necessary to complete the request based on the complexity and number of the consumer’s requests; and The controller informs the consumer of the extension and the reason for the extension within the initial 45–day response period. If a controller declines to act regarding a consumer’s request, the controller shall: Inform the consumer without undue delay, but not later than 45 days after receiving the request, of the justification for declining to act; and Provide instructions for how to appeal the decision. A controller shall provide information to a consumer in response to a consumer’s request to exercise rights under this subtitle free of charge once during any 12–month period. If requests from a consumer are manifestly unfounded, excessive, technically infeasible, or repetitive, a controller may: Charge the consumer a reasonable fee to cover the administrative costs of complying with the request; or Decline to act on the request. The controller has the burden of demonstrating the manifestly unfounded, excessive, technically infeasible, or repetitive nature of the request. If a controller is unable to authenticate a request to exercise a consumer right afforded under subsection (b)(1) through (5) of this section using commercially reasonable efforts, the controller: May not be required to comply with a request to initiate an action in accordance with this section; and Shall provide notice to the consumer that the controller is unable to authenticate the request to exercise the right until the consumer provides additional information reasonably necessary to authenticate the consumer and the consumer’s request to exercise the consumer’s rights. A controller may not be required to authenticate an opt–out request. A controller that has obtained personal data about a consumer from a source other than the consumer shall be considered compliant with the consumer’s request to delete the consumer’s data in accordance with subsection (b)(4) of this section by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring that the consumer’s personal data: Remains deleted from the controller’s records; and Is not being used for any other purpose. A controller shall establish a process for a consumer to appeal the controller’s refusal to act on a consumer rights request within a reasonable period after the consumer receives the decision. The appeal process shall be: Conspicuously available; and Similar to the process for submitting requests to initiate an action in accordance with this section. Not later than 60 days after receiving an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If a controller denies an appeal, the controller shall provide the consumer with an online mechanism, if available, through which the consumer may contact the Division to submit a complaint.

A consumer may designate an individual to serve as the consumer’s authorized agent and act on the consumer’s behalf to opt out of the processing of the consumer’s personal data for one or more of the purposes specified in § 14–4705(b)(7) of this subtitle. A consumer may designate an authorized agent by an Internet link or a browser setting, browser extension, global device setting, or other similar technology, indicating a consumer’s intent to opt out of the processing of the consumer’s personal data. A controller shall comply with an opt–out request received from an authorized agent if, using commercially reasonable efforts, the controller is able to authenticate: The identity of the consumer; and The authorized agent’s authority to act on the consumer’s behalf.

A controller may not: Except where the collection or processing is strictly necessary to provide or maintain a specific product or service requested by the consumer to whom the personal data pertains, collect, process, or share sensitive data concerning a consumer; Sell sensitive data; Process personal data in violation of State or federal laws that prohibit unlawful discrimination; Process the personal data of a consumer for the purposes of targeted advertising if the controller knew or should have known that the consumer is under the age of 18 years; Sell the personal data of a consumer if the controller knew or should have known that the consumer is under the age of 18 years; Knowingly sell the personal data of a consumer to a federal, State, or local governmental unit that, within the 6 months that immediately precede the sale of the personal data, has engaged in or supported civil immigration enforcement through the provision of personnel or material resources; Discriminate against a consumer for exercising a consumer right contained in this subtitle, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods or services to the consumer; Collect, process, or transfer personal data or publicly available data in a manner that unlawfully discriminates in or otherwise unlawfully makes unavailable the equal enjoyment of goods or services on the basis of race, color, religion, national origin, sex, sexual orientation, gender identity, or disability, unless the collection, processing, or transfer of personal data is for: The controller’s self–testing to prevent or mitigate unlawful discrimination; The controller’s diversifying of an applicant, participant, or customer pool; or A private club or group not open to the public, as described in § 201(e) of the Civil Rights Act of 1964; or Unless the controller obtains the consumer’s consent, process personal data for a purpose that is neither reasonably necessary to, nor compatible with, the disclosed purposes for which the personal data is processed, as disclosed to the consumer. A controller shall: Limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains; Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue; and Provide an effective mechanism for a consumer to revoke the consumer’s consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer’s consent. If a consumer revokes consent under this section, the controller shall stop processing the consumer’s personal data as soon as practicable, but not later than 30 days after receiving the request. Nothing in subsection (a) or (b) of this section may be construed to: Require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain; or Prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program, provided that the selling of personal data is not a condition of participation in the program. A controller shall provide a consumer with a reasonably accessible, clear, and meaningful privacy notice that includes: The categories of personal data processed by the controller, including sensitive data; The controller’s purpose for processing personal data; How a consumer may exercise the consumer’s rights under this subtitle, including how a consumer may appeal a controller’s decision regarding the consumer’s request or may revoke consent; The categories of third parties with which the controller shares personal data with a level of detail that enables a consumer to understand the type of, business model of, or processing conducted by each third party; The categories of personal data, including sensitive data, that the controller shares with third parties; and An active e–mail address or other online mechanism that a consumer may use to contact the controller. If a controller sells personal data to third parties or processes personal data for targeted advertising or for the purposes of profiling the consumer in furtherance of decisions that produce legal or similarly significant effects, the controller shall clearly and conspicuously disclose the sale or processing, as well as the manner in which a consumer may exercise the right to opt out of the sale or processing. The disclosure required under paragraph (1) of this subsection shall be prominently displayed, and use clear, easy to understand, and unambiguous language, to state whether the consumer’s information will be sold or shared with a third party. The privacy notice under subsection (d) of this section shall establish one or more secure and reliable methods for a consumer to submit a request to exercise a consumer right in accordance with this subtitle that take into account: The ways in which consumers normally interact with the controller; The need for secure and reliable communication of consumer requests; and The ability of the controller to verify the identity of a consumer making the request. A controller may not require a consumer to create a new account in order to exercise a consumer right. A controller may require a consumer to use an existing account to exercise a consumer right. A controller may utilize the following methods to satisfy paragraph (1) of this subsection: Providing a clear and conspicuous link on the controller’s website to a webpage that allows a consumer, or an authorized agent of the consumer, to opt out of the targeted advertising or the sale of the consumer’s personal data; or On or before October 1, 2025, allowing a consumer to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of personal data, through an opt–out preference signal sent, with the consumer’s consent, by a platform, technology, or mechanism to the controller indicating the consumer’s intent to opt out of the processing or sale. A platform, technology, or mechanism used in accordance with paragraph (3) of this subsection shall: Be consumer–friendly and easy to use by the average consumer; Use clear, easy to understand, and unambiguous language; Be as consistent as possible with any other similar platform, technology, or mechanism required by any federal or State law or regulation; Enable the controller to reasonably determine whether the consumer: Is a resident of the State; and Has made a legitimate request to opt out of any sale of the consumer’s personal data or targeted advertising; and Require a consumer to make an affirmative, unambiguous, and voluntary choice in order to opt out of any processing of the consumer’s personal data. A platform, technology, or mechanism used in accordance with paragraph (3) of this subsection may not: Unfairly disadvantage another controller; or Use a default setting to opt a consumer out of any processing of the consumer’s personal data. If a consumer’s decision to opt out of the processing of the consumer’s personal data for the purposes of targeted advertising, or the sale of personal data through an opt–out preference signal sent in accordance with subsection (f)(3) of this section conflicts with the consumer’s existing controller–specific privacy setting or the consumer’s voluntary participation in a controller’s bona fide loyalty, rewards, premium features, discounts, or club card program, the controller may notify the consumer of a conflict and provide the choice to confirm controller–specific privacy settings or participation in a program listed in this paragraph. A controller that recognizes signals approved by other states shall be considered in compliance with this section.

If a controller uses a processor to process the personal data of consumers, the controller and the processor shall enter into a contract that governs the processor’s data processing procedures with respect to processing performed on behalf of the controller. The contract shall be binding and shall clearly set forth: Instructions for processing data; The nature and purpose of processing; The type of data subject to processing; The duration of processing; and The rights and obligations of both parties. The contract shall require that the processor: Ensure that each person processing personal data is subject to a duty of confidentiality with respect to the personal data; Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data, considering the volume and nature of the personal data; Stop processing data on request by the controller made in accordance with a consumer’s authenticated request; At the controller’s direction, delete or return all personal data to the controller as requested at the end of the provision of service, unless retention of the personal data is required by law; On the reasonable request of the controller, make available to the controller all information in the processor’s possession necessary to demonstrate the processor’s compliance with the obligations in this subtitle; After providing the controller an opportunity to object, engage a subcontractor to assist with processing personal data on the controller’s behalf only in accordance with a written contract that requires the subcontractor to meet the processor’s obligations regarding the personal data under the processor’s contract with the controller; and Allow and cooperate with reasonable assessments by the controller, the controller’s designated assessor, or a qualified and independent assessor arranged for by the processor to assess the processor’s policies and technical and organizational measures in support of the obligations under this subtitle. On request, the processor shall provide a report of an assessment required by paragraph (3)(v) of this subsection to the controller. An assessment conducted in accordance with paragraph (3)(v) of this subsection shall be conducted using an appropriate and accepted control standard or framework and assessment procedure for the assessments. A processor shall: Adhere to the contract and instructions of a controller; Assist the controller in meeting the controller’s obligations under this subtitle, including: By appropriate technical and organizational measures as much as reasonably practicable to fulfill the controller’s obligation to respond to consumer rights requests, considering the nature of processing and the information available to the processor; and By assisting the controller in meeting the controller’s obligations in relation to the security of processing the personal data and in relation to the notification of a breach of the security of a system, as defined in § 14–3504 of this title; and Provide necessary information to enable the controller to conduct and document data protection assessments. Nothing in this section may be construed to relieve a controller or a processor from the liabilities imposed on the controller or processor by virtue of the controller’s or processor’s role in the processing relationship in accordance with this section. The determination of whether a person is acting as a controller or a processor with respect to a specific processing of data is a fact–based determination that depends on the context in which personal data is being processed. A person is considered to be a controller if the person: Is not limited in the person’s processing of specific personal data in accordance with a controller’s instructions; or Fails to adhere to a controller’s instructions with respect to a specific processing of personal data. A processor that continues to adhere to a controller’s instructions with respect to a specific processing of personal data remains a processor. If a processor or third party begins, alone or jointly with others, determining the purposes and means of the processing of personal data, the processor: Is a controller with respect to the processing; and May be subject to an enforcement action under this subtitle. Nothing in this section may be construed to alter a controller’s obligation to limit a person’s processing of personal data or to take steps to ensure that a processor adheres to the controller’s instructions.

If a third party uses or shares a consumer’s information in a manner inconsistent with promises made to the consumer at the time of collection of the information, the third party shall provide an affected consumer with notice of the new or changed practice before implementing the new or changed practice. The notice provided under subsection (a) of this section shall be provided in a manner and at a time reasonably calculated to allow a consumer to exercise the rights provided under this subtitle.

In this section, “processing activities that present a heightened risk of harm to a consumer” means: The processing of personal data for the purposes of targeted advertising; The sale of personal data; The processing of sensitive data; and The processing of personal data for the purposes of profiling, in which the profiling presents a reasonably foreseeable risk of: Unfair, abusive, or deceptive treatment of a consumer; Having an unlawful disparate impact on a consumer; Financial, physical, or reputational injury to a consumer; A physical or other intrusion on the solitude or seclusion or the private affairs or concerns of a consumer in which the intrusion would be offensive to a reasonable person; or Other substantial injury to a consumer. A controller shall conduct and document, on a regular basis, a data protection assessment for each of the controller’s processing activities that present a heightened risk of harm to a consumer, including an assessment for each algorithm that is used. A data protection assessment conducted in accordance with this section shall identify and weigh the benefits that may flow directly and indirectly from the processing to the controller, the consumer, other interested parties, and the public against: The potential risks to the rights of the consumer associated with the processing as mitigated by safeguards that may be employed by the controller to reduce these risks; and The necessity and proportionality of processing in relation to the stated purpose of the processing. The controller shall factor into a data protection assessment: The use of de–identified data; The reasonable expectations of consumers; The context of the processing; and The relationship between the controller and the consumer whose personal data will be processed. The Division may require that a controller make available to the Division a data protection assessment that is relevant to an investigation conducted by the Division. The Division may evaluate a data protection assessment for compliance with the responsibilities established in this subtitle. A controller’s data protection assessment may be used in an action to enforce this subtitle. A data protection assessment is confidential and is exempt from disclosure under the federal Freedom of Information Act or the Public Information Act. A single data protection assessment may address a comparable set of processing operations that include similar activities. If a controller conducts a data protection assessment for the purpose of complying with another applicable law or regulation, the data protection assessment shall be considered to satisfy the requirements established in this section if the data protection assessment is reasonably similar in scope and effect to the data protection assessment that would otherwise be conducted in accordance with this section. To the extent that any information contained in a data protection assessment disclosed to the Division includes information subject to attorney–client privilege or work product protection, the disclosure may not constitute a waiver of that privilege or protection. A data protection assessment conducted under this section: Shall apply to processing activities that occur on or after October 1, 2025; and Is not required for processing activities that occur before October 1, 2025.

Nothing in this subtitle may be construed to require a controller or a processor to: Re–identify de–identified data; Maintain data in an identifiable form; or Collect, obtain, retain, or access any data or technology in order to be capable of associating an authenticated consumer request with personal data. Nothing in this subtitle may be construed to require a controller or processor to comply with an authenticated consumer rights request if the controller: Is not reasonably capable of associating the request with the personal data or it would be unreasonably burdensome for the controller to associate the request with the personal data; Does not use the personal data to recognize or respond to the specific consumer who is the subject of the personal data or associate the personal data with other personal data about the same specific consumer; and Does not sell the personal data to a third party or otherwise voluntarily disclose the personal data to a third party other than a processor, except as otherwise allowed in this subtitle. A controller that discloses de–identified data shall: Exercise reasonable oversight to monitor compliance with any contractual commitments to which the de–identified data is subject; and Take appropriate steps to address any breaches of any contractual commitments. The determination of whether oversight is reasonable and whether appropriate steps were taken in accordance with paragraph (1) of this subsection shall take into account whether the disclosed data includes data that would be considered sensitive data if the data were re–identified.

Nothing in this subtitle may be construed to restrict a controller’s or processor’s ability to: Comply with federal, State, or local laws or regulations; Except as provided in paragraph (2) of this subsection, comply with a civil, criminal, or regulatory subpoena or summons by a federal, State, local, or other governmental authority; Except as provided in paragraph (2) of this subsection, cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, State, or local laws or regulations; Investigate, establish, exercise, prepare for, or defend a legal claim; Provide a product or service specifically requested by a consumer; Perform under a contract to which a consumer is a party, including fulfilling the terms of a written warranty; Take steps at the request of a consumer before entering into a contract; Take immediate steps to protect an interest that is essential for the life or physical safety of a consumer or another individual and when the processing cannot be manifestly based on another legal basis; Prevent, detect, protect against, investigate, prosecute those responsible, or otherwise respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or any other type of illegal activity; Preserve the integrity or security of systems; or Assist another controller, processor, or third party with an obligation under this subtitle. This paragraph does not apply if a controller or processor is presented with a valid warrant issued by a federal or State court that particularly describes the personal data to be accessed. Paragraph (1)(ii) of this subsection does not apply to a controller’s or processor’s compliance with a subpoena or summons that is derived from a federal, State, or local governmental unit that, within the 6 months that immediately precede the issuance of the subpoena or summons, has engaged in or supported civil immigration enforcement through the provision of personnel or material resources. Paragraph (1)(iii) of this subsection does not apply to a controller or processor that knows the law enforcement agency requesting the cooperation has, within the 6 months that immediately precede the request for cooperation, engaged in or supported civil immigration enforcement through the provision of personnel or material resources. The Division may post materials on its website to provide consumer education and other resources regarding civil immigration enforcement. This subsection does not apply to an obligation required under § 14–4711 of this subtitle. An obligation imposed on a controller or processor under this subtitle may not restrict a controller’s or processor’s ability to collect, use, or retain personal data for internal use to: Effectuate a product recall; Identify and repair technical errors that impair existing or intended functionality; or Perform internal operations that are: Reasonably aligned with the expectations of the consumer or can be reasonably anticipated based on the consumer’s existing relationship with the controller; or Otherwise compatible with processing data in furtherance of: The provision of a product or service specifically requested by a consumer; or The performance of a contract to which the consumer is a party. An obligation imposed on a controller or a processor under this subtitle does not apply when compliance by the controller or processor with the subtitle would violate an evidentiary privilege under State law. Nothing in this subtitle may be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under State law as part of a privileged communication. A controller or processor that discloses personal data to a processor or a third–party controller in compliance with this subtitle is not in violation of this subtitle if the processor or third–party controller that receives the personal data violates this subtitle and: at the time the disclosing controller or processor disclosed the personal data, the disclosing controller or processor did not have actual knowledge that the receiving processor or third–party controller would violate this subtitle; and the disclosing controller was, and remained, in compliance with its obligations as the discloser of the personal data. A third–party controller or processor that receives personal data from a controller or processor in compliance with this subtitle is not in violation of this subtitle for the independent misconduct of the controller or processor from which the third–party controller or processor received the personal data. Nothing in this subtitle may be construed to: Impose an obligation on a controller or a processor that adversely affects the rights or freedoms of any person, including the rights of a person to freedom of speech or freedom of the press as guaranteed in the First Amendment to the U.S. Constitution; or Apply to a person’s processing of personal data during the person’s personal or household activities. If a controller or processor processes personal data in accordance with an exemption under this section, the controller or processor shall demonstrate that the processing: Qualifies for an exemption; and Complies with the requirements of subsection (g) of this section. Personal data processed by a controller or processor in accordance with this section: Shall be subject to reasonable administrative, technical, and physical measures to: Protect the confidentiality, integrity, and accessibility of the personal data; and Reduce reasonably foreseeable risks of harm to consumers relating to the collection, use, or retention of personal data; and May be processed to the extent that the processing is: Reasonably necessary and proportionate to the purposes listed in this section; and Adequate, relevant, and limited to what is necessary in relation to the specific purposes listed in this section. A person that processes personal data for a purpose expressly identified in this section may not be considered a controller solely based on the processing of personal data.

Except as provided in subsection (b) of this section, a violation of this subtitle is: An unfair, abusive, or deceptive trade practice within the meaning of Title 13 of this article; and Subject to the enforcement and penalty provisions contained in Title 13 of this article, except for § 13–408 of this article. This section does not prevent a consumer from pursuing any other remedy provided by law.

This section applies to an enforcement action under § 14–4713 of this subtitle for an alleged violation that occurs on or before April 1, 2027. Before initiating any action under § 14–4713 of this subtitle, the Division may issue a notice of violation to the controller or processor if the Division determines that a cure is possible. If the Division issues a notice of violation under subsection (b) of this section, the controller or processor shall have at least 60 days to cure the violation after receipt of the notice. If the controller or processor fails to cure the violation within the time period specified by the Division, the Division may bring an enforcement action under § 14–4713 of this subtitle. In determining whether to grant a controller or processor an opportunity to cure an alleged violation, the Division may consider the following factors: The number of violations; The size and complexity of the controller or processor; The nature and extent of the controller’s or processor’s processing activities; The likelihood of injury to the public; The safety of persons or property; Whether the alleged violation was likely caused by a human or technical error; and The extent to which the controller or processor has violated this subtitle or similar laws in the past.