Maryland has amended its breach notification law to require businesses that maintain data, not just those that own or license the data, to conduct “a reasonable and prompt investigation” into whether personal information has been or will be misused. This requirement will go into effect in October 2019. Starting then, vendors who maintain information will also have a duty to investigate, not just data owners. This is unlike other states with “duty to investigate” requirements, like Connecticut, Delaware, New Hampshire, and Wyoming, among others. In those states (and others), only the data owner is statutorily required to investigate. To the extent that vendors have been obligated to investigate, that obligation falls under other provisions of breach notice laws, namely requirements for the vendor to “cooperate” with the data owner. Or, in some cases, companies may have contractually required their vendors to conduct investigations in the event of a breach or potential breach.

Putting it Into Practice: Data owners may welcome this investigation requirement now being placed on data “maintainers.” For companies that maintain data on behalf of others, they should keep this duty to investigate requirement in mind, in addition to existing “cooperation” obligations.