Brian Frosh was elected attorney general of Maryland in 2014. He was reelected to a second term in 2018. Prior to serving as attorney general, Frosh served five terms in the Maryland State Senate and two terms in the Maryland House of Delegates. Consumer protection has been one of Frosh’s priorities under his pledge to serve as the “people’s lawyer,” and he has focused on privacy and consumer protection issues since his time in the Maryland Legislature. Here, Frosh discusses the potential for future legislation in both Maryland and federally in the U.S.
The Privacy Advisor: You recently have gained national attention as a fearless advocate for the citizens of Maryland, but you have been a strong consumer advocate throughout your entire government service. What are your priorities within the realm of data privacy and security for Maryland?
Attorney General Brian Frosh: Businesses that collect, store, distribute, sell or otherwise engage in consumer data collection have a responsibility to do it legally and ethically. An individual’s personal information is valuable, both to that person and an immeasurable number of entities that would like to use it — either for legitimate purposes or with malicious intent. New efforts to collect massive amounts of data are continually undertaken. Our office would like to see an equal effort carried out to protect that data and those individuals. Consumer protection is a priority for this office, and we want to make sure that Maryland is fighting for privacy and security as hard as those trying to subvert it.
The Privacy Advisor: The passage of the EU General Data Protection Regulation and California Consumer Privacy Act have signaled a sea change in government regulations regarding companies’ collection and processing of individuals’ personal information. A similar bill, the Online Consumer Protection Act, was introduced in the Maryland House, but hearings have been adjourned indefinitely. What are your thoughts on that legislation and its chance of passage if it comes up in the next legislative session?
Frosh: The Online Consumer Protection Act would have given consumers more and better tools for handling how their data is collected, who has access to that data, what that data comprises and whether it’s accurate. It also would have proffered more protection for minors by prohibiting the sale of their personal data to third parties. My office supported that legislation last session, and we’re working with interested stakeholders on reintroducing the bill in 2020.
The Privacy Advisor: In a similar vein, committees in both the U.S. Senate and House of Representatives have been discussing federal privacy legislation. Contemporaneously, the Federal Trade Commission held hearings on Competition and Consumer Protection in the 21st Century, one of the focuses of which was federal privacy legislation. Many of these discussions have explored the states’ role in privacy enforcement, including whether a federal privacy law should preempt state laws to avoid a patchwork of privacy legislation and the appropriate role of attorneys generals in enforcing a federal privacy law. If a federal privacy law is passed, how do you hope it would address those two topics?
Frosh: A strong federal privacy law could be very useful. But too often, we have seen lax federal standards that preempt state efforts. To ensure that consumers are adequately protected, the federal standards should be a floor, not a ceiling. States should have the ability to tailor their laws to ensure that the privacy of their citizens is safeguarded, and their attorneys general must have the authority to enforce those laws.
The Privacy Advisor: Data breaches continue to affect Maryland residents, with more than 500 reported to your office in the first five months of this year alone. During the past year, you have both participated in settlements with companies that experienced a data breach and used your platform to warn Maryland residents of newly announced breaches. As of Oct. 1, 2019, Maryland amended its security breach notification law, the Personal Information Protection Act, to include a breach notification requirement for businesses that “maintain” personal information, not just those that own or license it. Your office has advocated for additional changes to this law, as well, including expanding the notification requirements for affected individuals to include both direct and substitute notice, requiring notice for data breaches involving genetic information and more guidance regarding the timing and contents of the breach notification to your office. What other changes would you like to see to PIPA?
Frosh: Our office continues to support changes to PIPA that would guard the private information of Marylanders, such as genetic information and data collected from fitness-tracking devices. We also want businesses that experience a data breach to be required to provide notice to victims more promptly than under current law.
The Privacy Advisor: Some states are looking at a different approach to data breach laws. Ohio, for example, passed last year a safe harbor law that uses more of a carrot rather than a stick approach, immunizing companies from liability that had reasonable security safeguards in place but nevertheless fell victim to a data breach despite their best efforts. What’s your view on incentivizing companies in this manner, and would you support similar legislation in Maryland?
Frosh: Companies need to be incentivized to ensure that their customers are their number one priority. Maryland’s law requires that businesses maintain “reasonable practices” to prevent data breaches. Narrowly defining what those reasonable practices are would leave consumer data vulnerable each time hacking techniques and strategy are improved. If a business is going to collect and/or store consumer data, it has a statutory duty to protect that data.
The Privacy Advisor: You lead Maryland’s Cybersecurity Council, which you have explained aims to respond to “threats to Maryland’s citizens, critical infrastructure and state operations.” To advance these goals, the Cybersecurity Council has worked on both the proposed Online Consumer Protection Act and the PIPA amendments previously discussed. What is the Cybersecurity Council’s biggest data/privacy goal for the upcoming year?
Frosh: The council is weighing its course on upcoming privacy legislation, which may include Maryland’s version of the California Online Privacy Act, the Personal Information Protection Act bill previously discussed, and bills dealing with internet-connected devices, like voice-command devices and smart speakers, and ransomware.
The Privacy Advisor: What can people in the privacy field expect from attorneys general and Maryland, in particular, for 2020?
Frosh: The Maryland attorney general’s office will continue efforts to ensure businesses are complying with state consumer protection laws, take appropriate steps to protect any consumer data collected, and give consumers more control over their own data, including what they are sharing and with whom.
