Nebraska and Maryland Become 16 and 17: State Data Privacy Law Update
Maryland and Nebraska have joined the ranks after signing their own respective comprehensive data privacy laws. Both the Maryland Online Data Privacy Act, effective October 1, 2025, and the Nebraska Data Privacy Act, effective January 1, 2024, resemble the other state data privacy laws. Like other states, these laws do not address vehicle performance data specifically, but it is implicated.
VPD Provisions
Maryland’s Online Data Privacy Act does not specifically define “vehicle information” or include any provisions specific to VPD. “Personal data” is defined as any information that is linked or can be reasonably linked to an identified or identifiable person. It does not include de-identified data or publicly available information. S. B. 541 § 14-4601 (W)(1-2)(I-II) (MD. 2024). “Sensitive data” is defined to include any data that reveals race or ethnicity, religious beliefs, health information, sexual orientation, transgender or nonbinary status, citizenship or immigration status, biometric data, precise geolocation, and personal data of a known child. S. B. 541 § 14-4601 (GG)(1)(I-VII)-(GG)(4) (MD. 2024).
The Act restricts the processing of personal data for a purpose that is not reasonably necessary with the disclosed purposes for which the data is process without the consumer’s consent. S. B. 541 § 14-4607 (A)(8) (MD. 2024).
Under the Act, “biometric data” is defined as data that is “generated by automatic measurements of the biological characteristics of a consumer that can be used to uniquely authenticate a consumer’s identity.” S. B. 541 § 14-4601 (D)(1) (MD. 2024). This can include fingerprints, voice prints, or eye retina or iris images.
Maryland’s Online Data Privacy Act exempts personal data collected or processed in compliance with the federal Driver’s Privacy Protection Act of 1994. S. B. 541 § 14-4603 (B)(8) (MD. 2024).
Under the Act does not restrict a controller’s or processor’s ability to collect, use, or retain personal data for internal use to effectuate a product recall, identify and repair technical errors, and perform internal operations. S. B. 541 § 14-4612 (B)(2)(I-III) (MD. 2024).
Privacy Law
Maryland Online Data Privacy Act, effective October 1, 2025.
The Nebraska Data Privacy Act does not specifically define “vehicle information” or include any provisions specific to VPD. “Personal data” is defined as any information that is reasonably linked to an identifiable individual, and include pseudonymous data when the data is used by a controller or processor in conjunction with additional information that reasonably links the data to an identifiable individual. LB1074 § 1(20)(a-b) (NE 2024). “Sensitive data” is defined as data “revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status.” It also includes biometric data, data collected from a known child, and precise geolocation data. LB1074 § 1(30)(a-d) (NE 2024).
The NEDPA restricts the collection and processing of personal data to what is adequate and reasonably necessary to the purposes the data is processed as disclosed to the consumer. LB1074 § 12(1)(a) (NE 2024).
The bill defines “biometric data” as “data that is generated to identify a specified individual through an automatic measurement of a biological characteristic of such individual,” and it includes fingerprints, voiceprints, and retina and iris images. LB1074 § 1(3)(a)(i-iv) (NE 2024).
The bill does not apply to “[p]ersonal data collected, processed, sold, or disclosed in compliance with the federal Driver’s Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as such act existed on January 1, 2024.” LB1074 § 4(12) (NE 2024).
Nebraska Data Privacy Act, effective January 1, 2025.
With Maryland and Nebraska becoming the sixteenth and seventeenth states to enact data privacy legislation, we are one step closer to hitting the halfway point! Up next? Minnesota and Vermont.
Copyright Nelson Law LLC
The opinions expressed in this blog are those of the author(s) and do not necessarily reflect the views of the Firm, its clients, or any of its or their respective affiliates. This blog post is for general information purposes and is not intended to be and should not be taken as legal advice.