Coalition Complaint re: Maryland Data Privacy Act Violations
This week, a coalition of public interest groups–including, among others, We Are CASA, the Center on Privacy & Technology at Georgetown Law, and the Electronic Frontier Foundation–filed a complaint calling upon the Maryland AG to investigate companies' compliance with Maryland's data privacy laws.
Earlier this month, I blogged about the huge amount of data being collected, aggregated, and sold by the company Flock. Flock is just one of many companies in the business of selling citizen data to, among others, the U.S. government for use in enforcement operations, including immigration actions. The complaint name checks Flock, Insight LPR, LexisNexis, Motorola, Penlink, Thomson Reuters, and ThunderCat Technology.
Here's the legal skinny. In 2024, Maryland passed the Maryland Online Data Privacy Act (MODPA)--a state effort to protect the digital privacy of Marylanders. As the complaint explains, MODPA prevents data brokers from:
- Collecting, processing, or sharing Marylanders’ sensitive data, including location data, except as strictly necessary to deliver a product or service requested by the consumer; or
- Selling Marylanders’ sensitive data, including location data.
The complaint alleges that MODPA is being violated by companies:
- collecting, processing, sharing, and selling Marylanders’ precise geolocation data,
- selling Marylanders’ personal data to immigration enforcement authorities, and
- selling Marylanders’ motor vehicle records to immigration enforcement authorities in circumstances not required by the federal Driver’s Privacy Protection Act.
