Md. Legislator Says Data Minimization Rule Could Bug Consumers

A Maryland Democrat and state retailers rallied for a bill that would remove teeth from data minimization rules in the Maryland Online Data Privacy Act (MODPA) during a livestreamed hearing Tuesday. But consumer groups lambasted HB-1365, as they did shortly after it was introduced last month (see 2502100032), arguing that it would gut the privacy law that takes effect Oct. 1.

Maryland Attorney General Anthony Brown (D) agreed with bill opponents. HB-1365 “asks the legislature to reconsider” MODPA “data minimization language before the law has even gone into effect,” the AG office’s consumer protection division said in written testimony Tuesday. “MODPA’s data minimization language is an important privacy protection that was intended to ensure that a consumer’s personal data is used only for the purposes for which it was collected.” Altering the state privacy law “while companies are in the process of implementing the existing guidelines penalizes law-abiding companies,” added the division.

“Moreover, by focusing on the company’s privacy disclosure rather than the purpose for which the consumer engages with the business, the bill would negate the protection that MODPA affords consumers,” the division wrote. “Since the proposed language is tied to the purpose ‘as disclosed to the consumer,’ it allows businesses to draft lengthy, and ultimately meaningless privacy disclosures that ‘disclose’ any and all potential uses of the consumer personal data. In contrast, MODPA’s existing language limits the collection of personal data to what is reasonably necessary and proportionate to provide the product or service ‘requested by the consumer.’”

Among state comprehensive privacy laws, Maryland’s includes one of the most restrictive rules limiting what data companies may collect at the outset. In part, it says a controller shall limit “the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains.”

However, under the bill by Del. Andrea Harrison (D), Maryland’s privacy law would instead say that a controller shall limit collection to what is “adequate, relevant and reasonably necessary in relation to the purposes for which the data is processed, as disclosed to the consumer.” The bill wouldn’t modify the law’s data minimization rules for sensitive data.

While “on paper” the law might make sense, “in practice, what I'm hearing is that this language may well require that businesses create new pop-up, click-through boxes on their websites and apps,” only for Maryland residents, Harrison said at the hearing. The “additional consent boxes could lead to residents to simply click through, and they may not actually read what they're consenting to, because there may be so many consent boxes that will be required under this regulation.” Many consumers find pop-ups requesting consent “annoying,” yet with the existing privacy law, “we may not actually be providing more privacy, but rather simply providing more consent.”

"No other state in the country has moved in this direction,” added Harrison. “Instead, since Maryland has taken this path, potentially at the expense of the consumer … our neighbors in Virginia and Washington, D.C., may have access to better or newer products and services than our residents.” The legislator concluded: “It is important that our residents and constituents do not fall victim to consent fatigue, have the same privacy protections as other states, and the same access to goods and services.”

However, picking up on the AG office’s concerns, Del. Pam Queen (D) asked if it’s too soon to change the privacy law considering it isn’t yet being enforced. "How do we know this frustrates consumers?” Harrison replied that she’s talked to the AG office about that concern, but right now, businesses are “trying to figure out how to implement this.”

Businesses vs. Consumer Advocates

Maryland's stores strongly support HB-1365, which will help businesses create the best possible consumer experience, said Maryland Retailers Alliance President Cailey Locklair. “Currently, the data minimization language in the law goes too far by imposing overly stringent restrictions on businesses that will, in turn … frustrate consumers,” she said. “Retailers use consumer data to personalize the shopping experience for our consumers, alert customers of new products and serve them with coupons or even sale notices.”

The existing data minimization rule “would create a sort of opt-in process, like we don't really even know how it would work,” Locklair responded to a legislator’s question. "Like, we will willy-nilly be sending you targeted advertisements about anything under the sun."

HB-1365 would make Maryland’s privacy law better for commerce, said TechNet Executive Director-Mid-Atlantic Region Margaret Durkin. Possible "unintended consequences" of the current rule could be that businesses limit personalization services and accessibility features, she said. Megan Stokes, Computer & Communications Industry Association state director, said that the existing rule would limit accessibility tools, including voice recognition and text-to-speech, since businesses would have to prove they are "strictly necessary.”

Del. April Rose (R) supported the bill, saying she feels more comfortable as a consumer getting personalized ads from stores. Also, flagging Maryland fiscal issues, she questioned keeping a rule that could make it harder for people to buy things and therefore generate sales taxes.

“This bill undermines the entire intent of Maryland's privacy laws,” countered Electronic Privacy Information Center attorney Kara Williams. The EPIC lawyer rejected the notion that Maryland’s data minimization rules make it harder for consumers to make purchases. Limiting what data a business can collect upfront should actually reduce consent fatigue, she argued. The reason for so many pop-ups is that "this is how businesses are choosing to implement it.”

Rose asked if requiring data minimization reduces consumers’ options. But Williams responded, “We can't be concerned about … consent fatigue and want to put the onus on the individual. There is no way for those things to align together."

Consumer Reports Policy Analyst Matt Schwartz said HB-1365 is "supported by the very companies that exploit consumer data for profit.” While the bill would revise the minimization rule to something akin to Connecticut’s privacy law, Connecticut Sen. James Maroney (D) is currently proposing to revise the law he authored to match Maryland (see 2502260035), added Schwartz.

Harrison’s bill would “needlessly weaken the protections Maryland consumers gained" from last year's comprehensive privacy law,” agreed Ellen Hengesbach, U.S. PIRG associate.