Data Minimization Sensitive and Health Data - Maryland MODPA
Maryland Online Data Privacy Act of 2024 MD-MODPA-Sensitive-Data-Health-Biometric-Section-14-4607-Reasonably-Necessary-Proportionate-Data-Minimization: Maryland MODPA Data Minimization + Sensitive + Health + Biometric + Section 14-4607 + Reasonably Necessary + Proportionate
STRONGEST US STATE DATA MINIMIZATION STANDARD: Section 14-4607 limits controller collection of personal data to what is REASONABLY NECESSARY AND PROPORTIONATE to provide or maintain the specific product or service requested by the consumer (unique dual reasonably-necessary-AND-proportionate test going beyond all other US state laws using only reasonably-necessary). Processing for any purpose other than provision of product/service requires explicit consumer consent. Sensitive Data (Section 14-4601(W)) requires affirmative opt-in consent - covers racial/ethnic origin + religious beliefs + consumer health data + sex life/sexual orientation + status as transgender or nonbinary + national origin + citizenship or immigration status + genetic data + biometric data + precise geolocation (1750-foot radius) + personal data of known child. Consumer Health Data (Section 14-4601(I)) separate category covering mental/physical health + reproductive/sexual health + gender-affirming care + diagnoses + treatments + medications + bodily functions + healthcare service use. BANS: (a) sale of consumer health data; (b) sale of sensitive data of consumers 13 to under 18 years; (c) sale of biometric data; (d) collection of biometric data without explicit consent. Minor processing (13 to under 18 years where controller knows or willfully disregards age) requires opt-in consent + ban on targeted advertising + sale. Data Protection Assessment mandatory for sensitive processing + targeted advertising + sale + profiling presenting heightened risk + AI/ML training (Section 14-4609).
What else in your programme already covers this
This control maps to 253 controls across 85 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.
3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.