Health Occupations, Public Health, and Insurance - Menopause - Provider Training Coverage Requirements, Policy Initiatives, and Access to Care
Summary
HB1365 amends Maryland’s online data privacy law to narrow and clarify how controllers may collect personal data. The bill changes the existing data-minimization standard so that a controller must limit collection to what is “adequate, relevant, and reasonably necessary” in relation to the purposes for which the data is processed, as disclosed to the consumer. Under current law, the collection standard also referenced being proportionate to a specific product or service requested by the consumer; this bill removes that phrasing and replaces it with a broader purpose-based standard.
The bill leaves intact the law’s definitions of “controller” and “personal data,” including exclusions for de-identified data and publicly available information. It also does not alter the requirements that controllers maintain reasonable data security practices or provide an effective mechanism for consumers to revoke consent. The bill is set to take effect October 1, 2025, aligned with the effective dates of related 2024 privacy legislation.
Impact
HB1365 would amend Section 14-4707(b)(1) of the Commercial Law Article, part of Maryland’s consumer data privacy framework, by revising the statutory data-collection limitation imposed on controllers. The practical effect is to shift the legal standard from collection tied to a specific consumer-requested product or service to collection tied to the disclosed processing purposes, while preserving the general requirement that collection be limited to what is adequate, relevant, and reasonably necessary. Businesses and other entities that qualify as controllers would need to ensure their data practices and privacy disclosures align with the revised standard.
Sentiment
Based on the bill text and the absence of recorded committee testimony or votes in the provided materials, the bill appears to be a technical or clarifying privacy measure rather than a highly controversial proposal. The available context does not show organized opposition or support, and the measure’s focus on refining an existing consumer privacy requirement suggests a generally policy-oriented, incremental approach. The Senate status indicates it had advanced to second reading passed, which is consistent with at least some legislative support.
Contention
The main point of potential contention is the change in the data-minimization standard: some may view the new “in relation to the purposes for which the data is processed, as disclosed to the consumer” language as more flexible for businesses, while others may see it as less protective than the prior reference to a specific product or service requested by the consumer. Privacy advocates could be concerned that the revised wording broadens permissible collection, whereas controllers and industry stakeholders may favor the clearer, purpose-based formulation. No specific stakeholder positions or recorded debate were provided in the materials.