July 2022: Maryland Amends Its Personal Information Protection Act

Update Applicable to:
All employers that retain records of personal information in the state of Maryland.

What happened?
On May 29, 2022, the Maryland Legislature enacted a House Bill (HB 962), which amends Maryland’s Personal Information Protection Act (the Act) by modifying the data breach notification requirements and scope of businesses subject to the data security requirements.

What are the details?
Effective October 1, 2022, the key changes summarized below will go into effect:

1. Expanded scope of data security requirements: The requirement to implement and maintain “reasonable” security measures will also apply to businesses that maintain the personal information of Maryland residents (and not just those who own or license such information).

2. Expanded definition of personal information: The definition of genetic information has been revised and expanded. This change follows a similar update California made to its breach notification law.

3. Additional notice requirements to the Attorney General: Additional information must now be provided in any notice to the Attorney General. This includes the number of affected Maryland individuals and a description of the breach, including when and how it occurred. It also includes steps the company has taken or plans to take relating to the security of the system and a sample notice sent to affected individuals.

4. Impacts on timing requirements: Businesses that maintain personal data must notify the owner of the data of a breach as soon as practicable but within 10 (formerly 45) days of discovering or being notified of the breach. While companies maintaining information may have shorter notification obligations by contract in some cases, this is a fairly aggressive statutorily imposed timing requirement.

For businesses owning or licensing personal information whose notification is delayed because of circumstances surrounding a law enforcement investigation, the notification must be made as soon as reasonably practicable, but within seven (previously 30) days after the law enforcement agency determines that notification will not impede an investigation. This is if the original 45-day period has lapsed or by the end of the original 45-day period.

For more information, please see the links below:

House Bill (HB 962)

Article 1 – Article 2

What do employers need to do?
Employers should review the links provided above and adjust policies relating to breached data to comply with the law.