On April 30, 2019, Maryland governor Larry Hogan approved a
series of amendments to the Maryland Personal Information
Protection Act. The amendments, effective October 1, 2019, impact
data breach obligations imposed on businesses that
"maintain" computerized data containing personal
information. "Personal information" under the Maryland
privacy act includes a broad category of personal
identifiers—such as an individual's social security
number, tax ID number, or biometric data—combined with his or
her first and last name.
Under the existing law, any Maryland business that owns or
licenses computerized data that includes personal information of an
individual who resides in Maryland must undertake a prompt and
reasonable investigation when it is notified or becomes aware of
unauthorized access to such information. If the business determines
that the data breach "creates a likelihood that personal
information has been or will be misused," it must provide
notice of the
