Maryland Passes Radical Data Privacy Law
The Maryland Online Data Privacy Act is the fifth comprehensive data privacy law to pass this year, and likely the most important.
After New Jersey introduced some interesting wrinkles in its law in January, New Hampshire, Kentucky, and Nebraska followed with rather standard versions of existing state privacy laws. Maryland has shattered that status quo however with a law that has some of the strictest rules in place in all of American data privacy.
MODPA is scheduled to enter into force on October 1, 2025, and has several unique provisions that:
- Ban the sale of sensitive data
- Limit any sensitive data collection unless explicitly requested by the consumer
- Institute the strongest data minimization principles of any state privacy law
- Impact assessment requirements for any customer-facing algorithms a business uses in addition to DPIA requirements
The language in this law, particularly around children's data and data minimization, is some of the most demanding in the sphere, and will require privacy programs to heavily study their existing data collection and processing practices.
Click here for a more detailed breakdown of the law.
