Maryland 2025 Regular Session

Maryland House Bill HB1365 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1
2	2
3	3	EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
4	4	[Brackets] indicate matter deleted from existing law.
5	5	hb1365
6	6
7	7	HOUSE BILL 1365
8	8	I3 5lr3142
9	9
10	10	By: Delegate Harrison
11	11	Introduced and read first time: February 7, 2025
12	12	Assigned to: Economic Matters
13	13
14	14	A BILL ENTITLED
15	15
16	16	AN ACT concerning 1
17	17
18	18	Commercial Law – Online Data Privacy – Limits on Data Collection 2
19	19
20	20	FOR the purpose of altering certain requirements for a controller relating to the collection 3
21	21	of personal data; and generally relating to the collection and processing of personal 4
22	22	data. 5
23	23
24	24	BY repealing and reenacting, without amendments, 6
25	25	Article – Commercial Law 7
26	26	Section 14–4701(a), (k), and (w) 8
27	27	Annotated Code of Maryland 9
28	28	(2013 Replacement Volume and 2024 Supplement) 10
29	29	(As enacted by Chapter 454 of the Acts of the General Assembly of 2024) 11
30	30
31	31	BY repealing and reenacting, with amendments, 12
32	32	Article – Commercial Law 13
33	33	Section 14–4707(b)(1) 14
34	34	Annotated Code of Maryland 15
35	35	(2013 Replacement Volume and 2024 Supplement) 16
36	36	(As enacted by Chapter 454 of the Acts of the General Assembly of 2024) 17
37	37
38	38	SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 18
39	39	That the Laws of Maryland read as follows: 19
40	40
41	41	Article – Commercial Law 20
42	42
43	43	14–4701. 21
44	44
45	45	(a) In this subtitle the following words have the meanings indicated. 22
46	46
47	47	(k) “Controller” means a person that, alone or jointly with others, determines the 23
48	48	purpose and means of processing personal data. 24 2 HOUSE BILL 1365
49	49
50	50
51	51
52	52	(w) (1) “Personal data” means any information that is linked or can be 1
53	53	reasonably linked to an identified or identifiable consumer. 2
54	54
55	55	(2) “Personal data” does not include: 3
56	56
57	57	(i) De–identified data; or 4
58	58
59	59	(ii) Publicly available information. 5
60	60
61	61	14–4707. 6
62	62
63	63	(b) (1) A controller shall: 7
64	64
65	65	(i) Limit the collection of personal data to what is ADEQUATE, 8
66	66	RELEVANT, AND reasonably necessary [and proportionate to provide or maintain a specific 9
67	67	product or service requested by the consumer to whom the data pertains] IN RELATION TO 10
68	68	THE PURPOSES FOR WHI CH THE DATA IS PROCE SSED, AS DISCLOSED TO THE 11
69	69	CONSUMER ; 12
70	70
71	71	(ii) Establish, implement, and maintain reasonable administrative, 13
72	72	technical, and physical data security practices to protect the confidentiality, integrity, and 14
73	73	accessibility of personal data appropriate to the volume and nature of the personal data at 15
74	74	issue; and 16
75	75
76	76	(iii) Provide an effective mechanism for a consumer to revoke the 17
77	77	consumer’s consent under this section that is at least as easy as the mechanism by which 18
78	78	the consumer provided the consumer’s consent. 19
79	79
80	80	SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 20
81	81	October 1, 2025, the effective dates of Chapters 424 and 425 of the Acts of the General 21
82	82	Assembly of 2024. If the effective dates of Chapters 424 and 425 are amended, this Act shall 22
83	83	take effect on the taking effect of Chapters 424 and 425. 23