A sponsor of legislation that is now being considered by the Maryland General Assembly and designed to protect residents’ privacy online called the current data environment in the United States “almost like the Wild Wild West.”

The bill, backed by state Sen. Arthur Ellis, D-Charles, and others, requires only personal data that is “reasonably necessary” be collected for a specific product or service as requested by a consumer. That “data” can sometimes be as personal as someone’s own fingerprint or face.

In 2022, the American facial recognition software company Clearview AI settled a lawsuit, agreeing to limit sales of its facial recognition database after allegations it acquired people’s photos without their consent. “Data” can also include other sensitive items like race, one’s location, even one’s religion.

Over a dozen U.S. states from Connecticut to California have enacted comprehensive privacy laws in recent years. A primary sponsor of the Maryland Online Data Privacy Act of 2024, state Sen. Dawn Gile, D-Anne Arundel, gave a reason why: “Congress has failed to act.”

The Maryland bill, in most cases (excepting the disclosure of a trade secret), gives an individual the right to know what data about themself is being collected. It allows an individual access to their personal information and provides a right to know of any third parties to whom that data has been disclosed. The bill, as drafted, also allows an individual to correct any inaccuracies in the data that is held, have that data deleted, and opt out of the sale or further use of that data.

As the legislation is considered in the Maryland Senate Finance Committee, more than a couple members are looking to pass the bill to provide privacy protections for the state’s residents instead of waiting on Washington, D.C., where Ellis says there is a case of “passing the buck.”

“We, as a state, we can and we should (take responsibility) until the national standards keep up,” said Ellis, pointing to the federal government’s inaction. “It will influence how these companies do business across the U.S.”

More: Gov. Moore takes action on artificial intelligence; here’s what’s in new executive order

Maryland Attorney General calls for more enforcement resources

Maryland Attorney General Anthony Brown, a former U.S. congressman, has seen this story with online data privacy legislation before. Not because bills have failed in recent years (they have), but because he introduced similar legislation over 20 years ago that ended up as law.

In 2001, about a decade into the commercialization of the internet, the first-term state delegate then representing Prince George’s County sponsored House Bill 14, which established a unit in the Office of the Attorney General to “protect the privacy of individuals’ personal information and to protect the public from unlawful conduct or practices in electronic transactions.” Between the two chambers, the bill passed with 184 legislators in favor and only one legislator against.

“We created a unit,” said Brown, of the 2001 Maryland law he backed, during a Feb. 28, 2024 phone interview, “but the Legislature never funded the unit.”

Over 20 years after his bill’s passage, Brown says the online landscape has “changed dramatically,” as he referenced several new technologies, including deepfakes, and called it a “much more complex landscape.”

“But the issues remain the same,” said the former state delegate, of data privacy. And the now-attorney general, starting his second year, is aiming to not repeat what happened from his tenure in the General Assembly.

“As my office is currently configured and staffed and equipped, I cannot enforce the provisions of the online data privacy (bill),” said Brown, calling for additional resources for the office, a refrain he has utilized dating back to the day he was sworn over a year ago in January.

He said new personnel — forensic investigators, data analytics experts, mediators — would be required to enforce a new law. “I need people who are experienced in this area,” Brown said. “Yeah, I’ll need a few lawyers, but I need a lot of non-lawyers to do the work as well.”

More: Anthony Brown sworn in as attorney general, brings big asks to Annapolis

Maryland bill, as introduced, received a B-, privacy groups say

Michele Gilman, a professor at the University of Baltimore School of Law, called the legislation substantively a “great bill,” but expressed disappointment in a lack of a “private right of action.”

“The advantage of a private right of action,” she said, “is it would allow people to vindicate their rights on their own with or without the support of the attorney general.”

During a Feb. 28 interview on the Senate floor, the bill’s primary sponsor, Gile, said the “main opposition” to the legislation was a private right of action, a provision not included in the bill as introduced. “That was kind of a balance that we ended up trying to strike this year,” she said, calling that specific opposition, including from companies, a “resounding chorus.”

Gile, an attorney, indicated her thought that there was “some merit” to concern raised by some about frivolous lawsuits.

According to the grades included in a “State of Privacy” report by a pair of privacy advocacy groups that ranked the 14 other states’ comprehensive privacy laws, the Maryland bill, as introduced without a private right of action, received a B-. California (the only state with a private right of action in law) received a B+ and was the only other state to receive a grade above a C+.

Gilman, who directs a law clinic representing low-income Marylanders at the University of Baltimore, indicated she and student attorneys would be able to bring cases to help enforce the statute, if there was a private right of action.

“The way it’s drafted now,” said Gilman, “we won’t be able to play that role.”

More: Maryland’s new Artificial Intelligence advisor starts as legislator calls for privacy law

Republican senator says he does not see bill as a ‘partisan issue.’

State Sen. Justin Ready, R-Carroll/Frederick, a member of the Finance Committee that heard testimony about the bill, said the Attorney General’s Consumer Protection Division is “probably the appropriate place” for enforcement.

Ready, the minority whip, said he does not view the legislation as “a partisan issue.”

“We don’t want people’s data being sold and trafficked without their consent,” he said, during a Feb. 29 interview on the Senate floor.

Sometimes that “data,” like online shopping habits and search history, can be used for purposes that some people may prefer (i.e. — targeted advertisements). The legislation applies to companies that collect over data of at least 35,000 consumers or at least 10,000 consumers, if the firm makes a fifth of its revenue from selling data. Ready called the legislation a “complex, big bill.”

“We live in an interconnected world, so figuring out where’s that line, where’s that balance,” he said, “we’re trying to find that.”

More: Russia called out for actions in Ukraine by Rep. Andy Harris, Maryland US senators

Privacy bills needs to pass both chambers to reach governor

Ellis, the bill sponsor who called the current data environment “almost like the Wild Wild West,” said Maryland has a lot of wealth in the state and puts a lot of money into the digital economy.

A 2023 report on the State of the Tech Workforce from the Computing Technology Industry Association (CompTIA) supports that, showing over 14,000 tech firms with payroll in Maryland. The report indicated that the technology sector made up 8.9% of Maryland’s overall economy.

The United States Air Force veteran Ellis compared Maryland and the U.S. to Europe, where a data privacy law, the General Data Protection Regulation (GDPR), went into effect in 2018.

 “The European Union does a much better job in holding firms accountable and responsible,” said Ellis, during a Feb. 28 interview on the ground floor of the nation’s oldest state capitol in continuous legislative use, “We’re still laissez-faire, anything goes in this country.”

The Senate Finance Committee is expected to vote on the measure this week, according to a bill sponsor. A companion bill in the House also had a committee hearing in February. Both bills need to pass in their respective chambers in order for the legislation to reach the governor’s desk.

More: Maryland bill seeks to streamline application process for items like licenses, permits

Dwight A. Weingarten is an investigative reporter, covering the Maryland State House and state issues. He can be reached at dweingarten@gannett.com or on Twitter at @DwightWeingart2.