Md. Code Regs. 10.25.05.14

Current through Register Vol. 51, No. 12, June 14, 2024

Section 10.25.05.14 - Compliance and Enforcement

A. If a data recipient fails to comply with any of the terms and conditions of a data use agreement, or it becomes known after execution of a data use agreement that a data recipient provided false information during the application process, the Commission, acting through the Executive Director, may take one or more of the following administrative and judicial enforcement actions, depending upon the facts, circumstances, and gravity of the acts of noncompliance:

(1) Terminate a data recipient's current access to data;

(2) Suspend a data recipient's current access to data for a period of time:

(a) Subject to conditions that a data recipient must satisfy before the suspension may be lifted and access to data reinstated; or

(b) If required by the Executive Director, until a data recipient enters into a new data use agreement that requires compliance with a corrective action plan addressing the acts of noncompliance;

(3) Require a data recipient to suspend or retract for a designated period of time a product that has been created or published from the data, subject to conditions that a data recipient must satisfy before the suspension or retraction may be lifted;

(4) Demand the secure destruction or return of data and require documentary proof that all data released to a data recipient has been destroyed;

(5) Terminate a data use agreement; or

(6) Prohibit a data recipient from submitting a new application requesting data for a designated period of time.

B. The Executive Director may refer an instance of unauthorized access, use, or disclosure of data to the Office of the Attorney General of Maryland, the Maryland State's Attorney Office, or any other appropriate State or federal law enforcement authority.

C. The Commission, based upon information provided by the Executive Director, may seek any appropriate administrative and judicial remedy allowed by State or federal law for:

(1) Failing to comply with any terms and conditions for accessing and using data; and

(2) Any instance of unauthorized or impermissible access, use, and disclosure of data.

Md. Code Regs. 10.25.05.14

Regulation .14 adopted effective 48:25 Md. R.1071-1098, eff. 12/13/2021