What does Maryland's data breach law ask a business to do?

Who does this law apply to?

The law applies to a business that owns, licenses or keeps computerized personal information of Maryland residents. On learning of a breach it must investigate promptly and in good faith.

The owner or licensee must notify the individual unless the business reasonably determines the breach does not create a likelihood that personal information has been or will be misused.

A business that owns, licenses, or maintains computerized data that includes personal information of an individual residing in the State, when it discovers or is notified that it incurred a breach of the security of a system, shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information of the individual has been or will be misused as a result of the breach.

unless the business reasonably determines that the breach of the security of the system does not create a likelihood that personal information has been or will be misused, the owner or licensee of the computerized data shall notify the individual of the breach.

What counts as personal information?

Personal information is a first name or first initial and last name together with items such as a Social Security, taxpayer or passport number, a driver's licence or state identification card number, a financial account or card number with its code, health information, health insurance numbers, or biometric data. It also covers a user name or email address with the password or security question and answer that opens an email account.

An individual's first name or first initial and last name in combination with any one or more of the following data elements, when the data elements are not encrypted, redacted, or otherwise protected by another method that renders the information unreadable or unusable:

A user name or e-mail address in combination with a password or security question and answer that permits access to an individual's e-mail account;

How fast must people be told?

Notice to individuals must be given as soon as reasonably practicable, but not later than 45 days after the business discovers or is notified of the breach. The text allows a delay for law enforcement or to find the scope of the breach.

Except as provided in subsection (d) of this section, the notification required under paragraph (2) of this subsection shall be given as soon as reasonably practicable, but not later than 45 days after the business discovers or is notified of the breach of the security of a system.

Who else must be told?

Before notifying individuals, the business must notify the Office of the Attorney General. When 1,000 or more individuals are notified, the business must also tell each nationwide consumer reporting agency about the timing, distribution and content of the notices.

Prior to giving the notification required under subsection (b) of this section and subject to subsection (d) of this section, a business shall provide notice of a breach of the security of a system to the Office of the Attorney General.

If a business is required under § 14-3504 of this subtitle to give notice of a breach of the security of a system to 1,000 or more individuals, the business also shall notify, without unreasonable delay, each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined by 15 U.S.C. § 1681a(p), of the timing, distribution, and content of the notices.

Is encrypted information treated differently?

Data elements that are encrypted, redacted, or otherwise made unreadable or unusable fall outside the definition of personal information. Encrypted means made indecipherable without the cryptographic key.

"Encrypted" means the protection of data in electronic or optical form using an encryption technology that renders the data indecipherable without an associated cryptographic key necessary to enable decryption of the data.

What if a vendor holds the data?

A business that keeps personal information it does not own or license must tell the owner or licensee of a breach as soon as reasonably practicable, but not later than 10 days after it discovers or is notified of the breach.

Except as provided in subsection (d) of this section, the notification required under paragraph (1) of this subsection shall be given as soon as reasonably practicable, but not later than 10 days after the business discovers or is notified of the breach of the security of a system.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.