On April 30, 2019, Maryland enacted an amendment to
Maryland's Personal Information Protection Act (Md. Code Ann.
§ 14-3504), which becomes effective on October 1, 2019. The
amendment was introduced in response to a rise in consumer
complaints about identity theft. Reportedly, over one third of all
identity theft complaints in Maryland are based on credit card
fraud. After significant previous expansions to the statute, this
time the Maryland legislature sought to revise existing law to
address how businesses cooperate with each other in order to
facilitate incident response.
Expanded Applicability to Investigation Requirement
The amendment effectively expands the applicability of the
requirement to conduct a good faith, reasonable and prompt
investigation to all businesses: businesses that own, license
or maintain personal information. The amendment
also provides that the obligation to investigate is triggered when
a business discovers or "is notified that it
