Maryland’s governor recently signed the Maryland Online Data Privacy Act of 2024 (MODPA), making Maryland one of six states—along with Kentucky, Nebraska, New Hampshire, New Jersey, and Rhode Island—to pass a comprehensive privacy law this year.  Overall, 19 states (and counting) now have such laws on their books.  

Maryland’s law takes effect October 1, 2025.

To whom does the law apply?

MODPA applies to organizations that conduct business in Maryland, or provide products or services that are targeted to its residents, and that, during the preceding calendar year, did one of the following:

• Controlled or processed the personal data of at least 35,000 state residents, excluding data or processing solely for the purposes of completing payment transactions, or

• Controlled or processed the personal data of at least 10,000 state residents and derived more than 20 percent of their gross revenue from the sale of personal data.

MODPA excludes from its application financial institutions, along with data subject to other privacy frameworks, including Health Insurance Portability and Accountability Act (HIPAA) and Family Educational Rights and Privacy Act (FERPA).  Notably, MODPA does not exempt HIPAA-covered entities, institutions of higher learning, or nonprofits.  

Who is protected by the law?

Consumer means an individual who is a resident of the State of Maryland.  The definition of consumer does not include an individual acting in a commercial or employment context.

What data is protected by the law?

MODPA protects “personal data,” which it defines as any information that is linked or reasonably could be linked to an identified or identifiable individual.  The law excludes de-identified data and publicly available information.

What are the rights of consumers?

MODPA grants consumers the rights to:

• Request confirmation of whether a controller is processing their personal data;
• Request access to that data;
• Request to correct it;
• Request its deletion;
• Obtain a list of the categories of third parties to which the controller has disclosed their data;
• Opt out of the sale of their personal data, or use of that data for targeted advertising or profiling; and
• Be free from discrimination for exercising their MODPA rights.

What obligations do controllers have?

MODPA requires that controllers:

• Provide consumers with a reasonably accessible, clear, and meaningful privacy notice that discloses, among other things:

• the categories of personal data processed by the controller, including sensitive data;
  • the controller’s purpose for processing personal data;
  • how a consumer may exercise rights under MODPA, including how a consumer may appeal a controller’s decision regarding the consumer’s request;
  • the categories of third parties with which the controller shares personal data;
  • the categories of personal data, including sensitive data, that the controller shares with third parties;
  • an email address or other online mechanism that a consumer may use to contact the controller; and
  • if applicable, a clear, conspicuous, and prominently displayed notice that (a) the controller sells personal data, or discloses it for targeted advertising or profiling, and (b) the consumer has the right to opt out of the disclosure of its data for those purposes.

• Limit their collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer.

• Conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, including an assessment of each algorithm that is used.

Controllers are also prohibited from selling “sensitive data,” meaning data that reveals the consumers’ racial or ethnic origin, religious beliefs, health data, sex life, sexual orientation, status as transgender or nonbinary, national origin, or citizenship.

In addition to the prohibition on selling consumer health data, MODPA prohibits providing employees or contractors with access to such data unless the employee or contractor is subject to a contractual or statutory duty of confidentiality, or, in the case of an employee, confidentiality is required as a condition of employment.

How is the law enforced?

MODPA will be enforced by the state’s attorney general.  Though it does not establish a private right of action, it permits consumers to pursue remedies under other laws.

***

If you have questions about MODPA or related issues, please reach out to a member of our Privacy, Data, and Cybersecurity practice group to discuss.