There is a newer version
of
this Section
2017 Maryland Code
Commercial Law
Title 14 - Miscellaneous Consumer Protection Provisions
Subtitle 35 - Maryland Personal Information Protection Act.
§ 14-3504. Security breach (Amendment effective January 1, 2018.)
Universal Citation: MD Comm L Code § 14-3504 (2017)
- (a) "Breach of the security of a system" defined. -- In this section:
- (1) "Breach of the security of a system" means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of the personal information maintained by a business; and
- (2) "Breach of the security of a system" does not include the good faith acquisition of personal information by an employee or agent of a business for the purposes of the business, provided that the personal information is not used or subject to further unauthorized disclosure.
- (b) Business owns or licenses personal data -- Investigation of breach. --
- (1) A business that owns or licenses computerized data that includes personal information of an individual residing in the State, when it discovers or is notified of a breach of the security of a system, shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information of the individual has been or will be misused as a result of the breach.
- (2) If, after the investigation is concluded, the business determines that the breach of the security of the system creates a likelihood that personal information has been or will be misused, the business shall notify the individual of the breach.
- (3) Except as provided in subsection (d) of this section, the notification required under paragraph (2) of this subsection shall be given as soon as reasonably practicable, but not later than 45 days after the business concludes the investigation required under paragraph (1) of this subsection.
- (4) If after the investigation required under paragraph (1) of this subsection is concluded, the business determines that notification under paragraph (2) of this subsection is not required, the business shall maintain records that reflect its determination for 3 years after the determination is made.
- (c) Business maintains personal data -- Notification of breach. --
- (1) A business that maintains computerized data that includes personal information of an individual residing in the State that the business does not own or license, when it discovers or is notified of a breach of the security of a system, shall notify, as soon as practicable, the owner or licensee of the personal information of the breach of the security of a system.
- (2) Except as provided in subsection (d) of this section, the notification required under paragraph (1) of this subsection shall be given as soon as reasonably practicable, but not later than 45 days after the business discovers or is notified of the breach of the security of a system.
- (3) A business that is required to notify an owner or licensee of personal information of a breach of the security of a system under paragraph (1) of this subsection shall share with the owner or licensee information relative to the breach.
- (d) Delay of notification required under (b) and (c). --
- (1) The notification required under subsections (b) and (c) of this section may be delayed:
- (i) If a law enforcement agency determines that the notification will impede a criminal investigation or jeopardize homeland or national security; or
- (ii) To determine the scope of the breach of the security of a system, identify the individuals affected, or restore the integrity of the system.
- (2) If notification is delayed under paragraph (1)(i) of this subsection, notification shall be given as soon as reasonably practicable, but not later than 30 days after the law enforcement agency determines that it will not impede a criminal investigation and will not jeopardize homeland or national security.
- (1) The notification required under subsections (b) and (c) of this section may be delayed:
- (e) Methods of giving notification required under (b). -- The notification required under subsection (b) of this section may be given:
- (1) By written notice sent to the most recent address of the individual in the records of the business;
- (2) By electronic mail to the most recent electronic mail address of the individual in the records of the business, if:
- (i) The individual has expressly consented to receive electronic notice; or
- (ii) The business conducts its business primarily through Internet account transactions or the Internet;
- (3) By telephonic notice, to the most recent telephone number of the individual in the records of the business; or
- (4) By substitute notice as provided in subsection (f) of this section, if:
- (i) The business demonstrates that the cost of providing notice would exceed $ 100,000 or that the affected class of individuals to be notified exceeds 175,000; or
- (ii) The business does not have sufficient contact information to give notice in accordance with item (1), (2), or (3) of this subsection.
- (f) Substitute notice. -- Substitute notice under subsection (e)(4) of this section shall consist of:
- (1) Electronically mailing the notice to an individual entitled to notification under subsection (b) of this section, if the business has an electronic mail address for the individual to be notified;
- (2) Conspicuous posting of the notice on the Web site of the business, if the business maintains a Web site; and
- (3) Notification to statewide media.
- (g) Contents of notification required under subsection (b). -- Except as provided in subsection (i) of this section, the notification required under subsection (b) of this section shall include:
- (1) To the extent possible, a description of the categories of information that were, or are reasonably believed to have been, acquired by an unauthorized person, including which of the elements of personal information were, or are reasonably believed to have been, acquired;
- (2) Contact information for the business making the notification, including the business' address, telephone number, and toll-free telephone number if one is maintained;
- (3) The toll-free telephone numbers and addresses for the major consumer reporting agencies; and
- (4) (i) The toll-free telephone numbers, addresses, and Web site addresses for:
- 1. The Federal Trade Commission; and
- 2. The Office of the Attorney General; and
- (ii) A statement that an individual can obtain information from these sources about steps the individual can take to avoid identity theft.
- (h) Notification to Office of the Attorney General. -- Prior to giving the notification required under subsection (b) of this section and subject to subsection (d) of this section, a business shall provide notice of a breach of the security of a system to the Office of the Attorney General.
- (i) Breach of security affecting only email account. --
- (1) In the case of a breach of the security of a system involving personal information that permits access to an individual's e-mail account under § 14-3501(e)(1)(ii) of this subtitle and no other personal information under § 14-3501(e)(1)(i) of this subtitle, the business may comply with the notification requirement under subsection (b) of this section by providing the notification in electronic or other form that directs the individual whose personal information has been breached promptly to:
- (i) Change the individual's password and security question or answer, as applicable; or
- (ii) Take other steps appropriate to protect the e-mail account with the business and all other online accounts for which the individual uses the same user name or e-mail and password or security question or answer.
- (2) Subject to paragraph (3) of this subsection, the notification provided under paragraph (1) of this subsection may be given to the individual by any method described in this section.
- (3)
- (i) Except as provided in subparagraph (ii) of this paragraph, the notification provided under paragraph (1) of this subsection may not be given to the individual by sending notification by e-mail to the e-mail account affected by the breach.
- (ii) The notification provided under paragraph (1) of this subsection may be given by a clear and conspicuous notice delivered to the individual online while the individual is connected to the affected e-mail account from an Internet Protocol address or online location from which the business knows the individual customarily accesses the account.
- (1) In the case of a breach of the security of a system involving personal information that permits access to an individual's e-mail account under § 14-3501(e)(1)(ii) of this subtitle and no other personal information under § 14-3501(e)(1)(i) of this subtitle, the business may comply with the notification requirement under subsection (b) of this section by providing the notification in electronic or other form that directs the individual whose personal information has been breached promptly to:
- (j) Waiver. -- A waiver of any provision of this section is contrary to public policy and is void and unenforceable.
- (k) Compliance with other requirements of federal law. -- Compliance with this section does not relieve a business from a duty to comply with any other requirements of federal law relating to the protection and privacy of personal information.
Disclaimer: These codes may not be the most recent version. Maryland may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
