United States of America: Adopted Online Data Privacy Act (HB 0567)

On 27 March 2024, the Online Data Privacy Act (HB 0567) was adopted by the Maryland Legislature after being approved by both legislative chambers. The Bill outlines consumer rights regarding the deletion and opt-out of personal data processing, imposing responsibilities on data controllers to establish secure methods for exercising these rights free of charge and providing timely responses to consumer requests. Additionally, it establishes rules and procedures governing data collection, processing, and disclosure, including prohibitions on discrimination and requirements for transparent privacy notices. Specifically, data collection must be limited to what is necessary for requested services and mechanisms for consent revocation must be provided. Contracts between controllers and processors must meet specified requirements, and stricter procedures apply to processing activities posing higher risks to consumers. Furthermore, the Bill designates the Office of the Attorney General to oversee compliance and assess data protection practices, ensuring adherence to its provisions while maintaining confidentiality. The Bill has been sent to the Governor, and, if fully enacted, enters into effect on 1 October 2025.