Can I use third-party marketing automation tools that collect personal information in Maryland? What are the requirements?

Using Third-Party Marketing Automation Tools in Maryland

If you plan to use third-party marketing automation tools that collect personal information in Maryland, you need to comply with the Maryland Code of Regulations (MDCR) Title 31, Subtitle 16, Chapter 08.

Opt-Out Requirements

Under MDCR 31.16.08.11, a licensee may not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless the licensee has provided the consumer with an initial notice as required under Regulation .05 of this chapter, an opt-out notice as required in Regulation .08 of this chapter, and given the consumer a reasonable opportunity, before it discloses the information to the nonaffiliated third party, to opt out of the disclosure. A licensee provides a consumer with a reasonable opportunity to opt out if the licensee mails the notices required in Regulations .05 and .08 of this chapter to the consumer and allows the consumer to opt out by mailing a form within 30 days from the date the licensee mailed the notices, calling a toll-free telephone number within 30 days from the date the licensee mailed the notices, or using any other reasonable means within 30 days from the date the licensee mailed the notices.

Limits on Disclosure of Nonpublic Personal Financial Information to Nonaffiliated Third Parties

Under MDCR 31.16.08.11, a licensee may not, directly or through an affiliate, disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless the licensee has provided the consumer with an initial notice as required under Regulation .05 of this chapter, an opt-out notice as required in Regulation .08 of this chapter, and given the consumer a reasonable opportunity, before it discloses the information to the nonaffiliated third party, to opt out of the disclosure.

Other Exceptions to Notice and Opt-Out Requirements

Under MDCR 31.16.08.16, the requirements for initial notice to consumers in Regulation .05A(2) of this chapter, the opt-out in Regulations .08 and .11 of this chapter, and service providers and joint marketing in Regulation .14 of this chapter do not apply when a licensee discloses nonpublic personal financial information with the consent or at the direction of the consumer, to protect the confidentiality or security of a licensee’s records pertaining to the consumer, service, product, or transaction, to protect against or prevent actual or potential fraud or unauthorized transactions, for required institutional risk control or for resolving consumer disputes or inquiries, to persons holding a legal or beneficial interest relating to the consumer, to persons acting in a fiduciary or representative capacity on behalf of the consumer, to provide information to insurance rate advisory organizations, guaranty funds or agencies that are rating a licensee, persons that are assessing the licensee’s compliance with industry standards, and the licensee’s attorneys, accountants, and auditors, to comply with federal, state, or local laws, rules, and other applicable legal requirements, to comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by federal, state, or local authorities, to respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance, or other purposes as authorized by law, or for purposes related to the replacement of a group benefit plan, a group health plan, a group welfare plan, or a workers’ compensation plan.

Conclusion

In summary, if you plan to use third-party marketing automation tools that collect personal information in Maryland, you need to comply with the opt-out requirements, limits on disclosure of nonpublic personal financial information to nonaffiliated third parties, and other exceptions to notice and opt-out requirements as outlined in the Maryland Code of Regulations (MDCR) Title 31, Subtitle 16, Chapter 08.

Jurisdiction

Maryland

• Privacy