InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
Maryland enacts child consumer protection laws
On May 9, the Governor of Maryland approved SB 571 (the “Act) to provide consumer online protections for children. The Act will afford protections from online products aimed at children or that are likely accessed by children. Specifically, the Act will require companies that provide online products “reasonably likely to be access[ed] by children” to prepare a data protection impact assessment (DPIA) for the online product. The DPIA will identify the purpose of the online product, how the product uses children’s data, determine if the product would be in children’s best interests, and include a description of the compliance steps the company will have taken to comply with the duty to act in a manner consistent with the best interests of children, among other requirements. The Act outlined several violations, including against processing data not in children’s best interests, profiling children, processing geolocation, using of dark patterns, or monitoring of children’s activities without first notifying the parent/guardian. The Act will go into effect on October 1.
Maryland enshrines its consumer online data privacy act
On May 9, the Governor of Maryland approved SB 541 (the “Act”) which enacted the Maryland Online Data Privacy Act of 2024, setting forth new provisions for businesses and data processors under the state’s UDAP commercial code. The Act will prevent persons or processors from providing access to consumer health data unless contractually required, or from using a geofence within a certain distance from health or mental health facilities. The Act will enable consumers to exercise certain rights with respect to their data, including confirming use, accessing data, correcting inaccuracies, requiring deletion of data (unless protected by law), and opting out of targeted advertising or sales of one’s personal data. Consumers will also be able to designate an agent to opt-out on their behalf.
The Act will prohibit controllers from selling sensitive data and from collecting, processing, or sharing sensitive consumer data unless “the collection or processing is strictly necessary to… maintain a specific product,” among others. The Act will enable controllers to limit collection to what would be “reasonabl[y] necessary” and establish data security practices. Controllers will also be forced to provide consumers with a privacy notice that will outline their use of the data and a consumer’s rights, as well as establish a secure method for a consumer to exercise such rights. The Act will not apply to financial institutions or to consumer credit data that is protected under the FCRA. The Act will go into effect on October 1, 2025.
Maryland enacts new powers for regulators to examine third parties
On May 9, the Governor of Maryland approved HB 250 (the “Act”) which will authorize the Commissioner of Financial Regulation to examine third parties that service entities under the supervision of the state’s Office of Financial Regulation (OFR). Such licensed entities include both depository and non-depository financial institutions. Currently, the OFR lacks the authority to examine third parties until the Act goes into effect. The Act will define third-party service providers as a “person who performs activities relating to financial services on behalf of a regulated entity for that regulated entity’s customers,” and include data processing centers, activities that support financial services, and internet-related services. On enforcement, the Act will authorize the OFR to enforce the law against any third party that refuses to submit to an examination, refuses to pay a fee, or engages in “unsafe or unsound” behaviors as determined by the OFR. The Act will outline several authorities of the OFR, including notifying the licensed person, which information the OFR can access, and levying fees. Following a notice and hearing, the Commissioner may issue a cease-and-desist order, suspend or revoke a violator’s license, or issue a penalty of up to $10,000 for the first violation and up to $25,000 for each subsequent violation. The Act takes effect on October 1.
Maryland updates prohibited items reported on consumer credit reports
On May 9, the Governor of Maryland approved SB 41 (the “Act”) which will change the requirements on prohibitions for consumer reporting agencies as to what information they may include in consumer credit reports.
The Act will prohibit consumer reporting agencies from reporting bankruptcies more than 10 years before the credit report would be issued, suits and judgments of more than seven years, paid tax liens greater than seven years, accounts placed for collection of more than seven years, arrest records or other crime reports of greater than seven years, and “any other adverse information that predates the report” by more than seven years. These reporting prohibitions do not apply to credit transactions with a principal amount of at least $150,000, as well as both the underwriting of life insurance with a face value of at least $150,000 or the employment of someone with a salary of at least $75,000. The Act will go into effect on October 1.
District Court addresses plain meaning of “pattern or practice of noncompliance” under RESPA.
On February 7, the U.S. District Court for the District of Maryland granted in part and denied in part a defendant mortgage company’s motion to dismiss a class action lawsuit alleging RESPA violations related to escrow account management for borrowers. Class action plaintiffs claim that the defendant’s failure to pay their property taxes in a timely manner, resulting in their homes being potentially subject to local tax sale procedures for unpaid taxes, created a “pattern or practice of noncompliance” within the meaning of RESPA.
In moving to dismiss, defendant argued that alleged violations of servicing obligations that fall under separate subsections of RESPA cannot create a “pattern or practice of noncompliance” for obligations of the section setting for the escrow-handling obligations. While noting that “case law interpreting RESPA statutory damages claims is still developing,” the court found that the statute does not require identical violations from the same subsection of RESPA to state a “pattern or practice” claim. The court reasoned that the absence of the word “subsection” from the statute is noteworthy, and it indicates that Congress did not intend to confine “pattern or practice” to a single subsection, and held that the plain meaning of the provision only requires plaintiffs to allege repeated violations of the “[s]ervicing of mortgage loans and administration of escrow accounts” section of RESPA (i.e., all of the obligations set forth in 12 U.S.C. § 2605). The court also rejected defendant’s argument that plaintiffs failed to state a claim because they “cannot rely upon their own allegations or the existence of public complaints and lawsuits which have not resulted in a judgment against it for violations of RESPA,” finding that allegations of servicing violations from multiple named plaintiffs in separate jurisdictions was sufficient to survive a motion to dismiss.
Separately, the court dismissed allegations that defendant violated RESPA by failing to respond to plaintiffs’ qualified written requests, finding that plaintiffs’ claims of “emotional distress, without more, do[] not establish the causal link necessary to show actual damages,” and that plaintiffs did not support claims that voluntary postage costs for sending correspondence to defendants could be recognized as economic damages.
Maryland finalizes money transmitter regulation; adds agent of the payee exemption
On November 17, the Maryland Commissioner of Financial Regulation recently adopted edits to proposed regulations, Code Md. Code Regs. 09.03.14.01, .03-.18, bringing Maryland generally in alignment with the CSBS Money Transmitter Model Law which has been recently adopted by several other states (covered by InfoBytes here, here, and here). Some provisions in the new regulation conform with the model law, while a few stand out as unique additions in Maryland.
For example, among the newly adopted regulations, amended Regulation .03 provides an exemption for persons appointed as an agent of the payee if (i) there is a written agreement between the payee and agent for payment processing, aligning with Maryland law; (ii) there is public recognition of the agent collecting payments on behalf of the payee; (iii) upon the agent’s receipt of payment, the payor’s obligation ends without risk; (iv) the agent is not serving in an escrow capacity; (v) the agent is not acting as an agent to more than one party; and (vi) the agent mandates prompt, unconditional payment without tying it to future events or performances. This agent of the payee exemption deviates from the model law’s version of the same exemption.
Additionally, amended Regulation .08 establishes corporate governance standards that require money transmitter licensees to maintain a framework that is commensurate with the size, operational complexity, and overall risk profile of the licensee. This standard also sets expectations around internal audit, external audit, and risk management functions of a license. While this concept is not provided for in the model money transmission law, it aligns with the CSBS model state regulatory prudential standards for nonbank mortgage servicers (covered by InfoBytes here).
The final regulation will be effective December 11, 2023.
Maryland says crypto enforcement could affect money transmitter licensure
On June 22, the Maryland Commissioner of Financial Regulation issued an advisory on recent enforcement actions by Maryland and federal securities enforcement agencies against cryptocurrency-related businesses that could potentially impact businesses pursuing money transmitter licensure. The actions allege certain businesses offered products constituting securities while they were only licensed as money transmitters by the Commissioner of Financial Regulation. The state takes “character and fitness” into consideration for licensure and although the Commissioner does not enforce securities laws, he or she must consider violations of law, including violations of Maryland securities law, when determining whether to grant licenses. The advisory reads, “compliance with law, particularly Maryland law, regardless of whether or not the law falls within the Commissioner’s purview, must be considered when determining whether a licensee warrants the belief that business will be conducted lawfully, and thus whether the licensee is, or remains, qualified for licensure.” Moreover, violations of securities laws could form the grounds for action by the Commissioner against a licensee, “including but not limited to, an action seeking to revoke a license.”
Maryland says shared appreciation agreements are mortgage loans
The Maryland governor recently signed HB 1150 (the “Act”), which subjects certain shared appreciation agreements (SAAs) to the Maryland Mortgage Lender Law. Under the Act, the term “loan” now “includes an advance made in accordance with the terms of a shared appreciation agreement.” An SAA is defined by the Act to mean “a writing evidencing a transaction or any option, future, or any other derivative between a person and a consumer where the consumer receives money or any other item of value in exchange for an interest or future interest in a dwelling or residential real estate, or a future obligation to repay a sum on the occurrence of [certain] events,” such as an ownership transfer, a repayment maturity date, a consumer’s death, or other events. The Act specifies that a loan is subject to the state’s mortgage lender law if the loan is an SAA and “allows a borrower to repay advances and have any repaid amounts subsequently readvanced to the borrower.”
Interim guidance released by the Maryland Commissioner of Financial Regulation further clarifies that SAAs are mortgage loans, and that those who offer SAAs to consumers in the state are required to obtain a Maryland mortgage lender licensing unless exempt. Under the Act, the commissioner will issue regulations addressing enforcement and compliance, including SAA disclosure requirements. The Act takes effect July 1. However, for SAA applications taken on or after July 1 (and until regulations are promulgated and effective), the commissioner will not cite a licensee for disclosure requirement violations, provided the licensee makes a good faith effort to give the applicant specified information within ten days of receiving an application. Licensees will be required to provide the information again at least 72 hours before settlement if the actual terms of the SAA differ from those provided in the initial disclosure.
Maryland eliminates separate licensing requirement for branches
On May 8, the Maryland governor signed HB 686 to eliminate a requirement that collection agencies and certain non-depository financial institutions must maintain separate licenses for branch locations. The Act now allows such entities to conduct business at multiple licensed locations under a single license. The Act also amends and clarifies other provisions relating to application requirements, licensee information listed in the Nationwide Multi-State Licensing System and Registry, requirements when using trade names, examinations, Commissioner of Financial Regulation assessments, and surety bond requirements. The Act is effective July 1.
Maryland amends student financing company registration
On May 8, the Maryland governor signed HB 913 to amend certain provisions relating to student financing company registration and reporting requirements. Among other things, the Act defines the term “student financing company” to mean “an entity engaged in the business of securing, making, or extending student financing products, or any purchaser, assignee, or holder of student financing products.” Student financing companies seeking to provide services in the state will be required to register with the Commissioner of Financial Regulation beginning March 15, 2024. Additionally, the Act provides that a student financing company seeking to renew its registration on an annual basis may be required to pay a fee at the time of renewal. The Act also authorizes the Commissioner to adopt registration procedures for student financing companies, including the use of the Nationwide Multi-State Licensing System and Registry, and may impose certain fees for using the registry. Additionally, the Act makes several technical clarifying provisions to the reporting requirements for student financing companies to be filed with the Commissioner annually on or before March 15. Furthermore, on or before June 15, 2024 (and each June 15 thereafter), information reported by the student financing companies will be available on a publicly accessible website to be developed and maintained by the Commissioner. The Act is effective October 1.