EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
[Brackets] indicate matter deleted from existing law.
*hb1365*
HOUSE BILL 1365
I3 5lr3142
By: Delegate Harrison
Introduced and read first time: February 7, 2025
Assigned to: Economic Matters
A BILL ENTITLED
AN ACT concerning 1
Commercial Law – Online Data Privacy – Limits on Data Collection 2
FOR the purpose of altering certain requirements for a controller relating to the collection 3
of personal data; and generally relating to the collection and processing of personal 4
data. 5
BY repealing and reenacting, without amendments, 6
Article – Commercial Law 7
Section 14–4701(a), (k), and (w) 8
Annotated Code of Maryland 9
(2013 Replacement Volume and 2024 Supplement) 10
(As enacted by Chapter 454 of the Acts of the General Assembly of 2024) 11
BY repealing and reenacting, with amendments, 12
Article – Commercial Law 13
Section 14–4707(b)(1) 14
Annotated Code of Maryland 15
(2013 Replacement Volume and 2024 Supplement) 16
(As enacted by Chapter 454 of the Acts of the General Assembly of 2024) 17
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 18
That the Laws of Maryland read as follows: 19
Article – Commercial Law 20
14–4701. 21
(a) In this subtitle the following words have the meanings indicated. 22
(k) “Controller” means a person that, alone or jointly with others, determines the 23
purpose and means of processing personal data. 24 2 HOUSE BILL 1365
(w) (1) “Personal data” means any information that is linked or can be 1
reasonably linked to an identified or identifiable consumer. 2
(2) “Personal data” does not include: 3
(i) De–identified data; or 4
(ii) Publicly available information. 5
14–4707. 6
(b) (1) A controller shall: 7
(i) Limit the collection of personal data to what is ADEQUATE, 8
RELEVANT, AND reasonably necessary [and proportionate to provide or maintain a specific 9
product or service requested by the consumer to whom the data pertains] IN RELATION TO 10
THE PURPOSES FOR WHI CH THE DATA IS PROCE SSED, AS DISCLOSED TO THE 11
CONSUMER ; 12
(ii) Establish, implement, and maintain reasonable administrative, 13
technical, and physical data security practices to protect the confidentiality, integrity, and 14
accessibility of personal data appropriate to the volume and nature of the personal data at 15
issue; and 16
(iii) Provide an effective mechanism for a consumer to revoke the 17
consumer’s consent under this section that is at least as easy as the mechanism by which 18
the consumer provided the consumer’s consent. 19
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 20
October 1, 2025, the effective dates of Chapters 424 and 425 of the Acts of the General 21
Assembly of 2024. If the effective dates of Chapters 424 and 425 are amended, this Act shall 22
take effect on the taking effect of Chapters 424 and 425. 23