Data-Minimization Bill Could Give Maine ‘Escape Hatch’ if ‘Sky Falls’ in Maryland
Delaying the Maine privacy bill’s effective date gives the state an “escape hatch if things go awry in Maryland,” said House Chair Amy Kuhn (D) at a Maine Judiciary Committee meeting Friday. The panel weighed an amendment to Kuhn’s comprehensive measure (LD-1822), which features a data-minimization standard similar to the one in the Maryland privacy law. Also, members narrowed to two, from three, the number of comprehensive privacy bills pending before the committee.
Sign up for a free preview to unlock the rest of this article
Maryland’s privacy law takes effect Oct. 1 this year. Under Kuhn’s amendment, LD-1822 would take effect Sept. 1, 2026, which is two months later than originally proposed (see 2505220044). "Let's say the sky falls and on Oct. 2, Google Ads won't let anybody in Maryland run an ad,” explained Kuhn. “This gives us time to run a bill” to fix what Maine potentially passed “and have it go into effect at the end of the year” in 2026.
The amendment also seeks to resolve L.L. Bean's concerns about data minimization by clarifying what data collection may be considered “reasonably necessary” under the bill, said Kuhn. The amendment says that it includes “any routine administrative, operational, website, or account-servicing activity that is consistent with the reasonable expectations of the consumer.”
In addition, it says that the data minimization requirement “does not prevent a controller from processing personal data collected in accordance with this paragraph to provide advertising to a consumer based on the consumer's activities within a controller's own websites or online applications.”
If a consumer goes to the L.L. Bean website and looks at a kayak, but never adds it to the shopping cart, there was a question about if that was “enough of an activity that L.L. Bean can attach a cookie, travel across the internet … and show me kayaks when I'm on another website,” said Kuhn: The amendment was “designed to clarify that the answer is yes."
Rep. David Sinclair (D) questioned conditioning the clarification on what is “consistent with the reasonable expectations of the consumers.” He said that standard sounds like "a really wide-open barn door.”
“The whole purpose of the bill is to align the rules with consumer expectation,” Kuhn replied. “For example, if you're traveling around the internet, and your expectation is that your data isn't being sold, that's not a realistic expectation.” However, Sen. Rachel Talbot Ross (D) said she shared Sinclair’s unease with using an undefined “reasonable” standard.
Rep. Elizabeth Caruso (R) said she still wasn’t sure about the minimization language, even if it might work for L.L. Bean under the amendment. “How implementable is this for small businesses?” she asked.
"The data minimization applies at the collector level, not at the processing level,” Kuhn clarified. “There is nothing here that prohibits small business to go to the ad exchanges” and buy an ad, she said.
Later in the meeting, the committee discussed two alternative privacy bills: LD-1088 by Rep. Rachel Henderson (R) and LD-1224 by Rep. Tracy Roberts (D). Since the bills are largely similar to each other, Rep. Ellie Sato (D) made a motion to proceed with LD-1088 as the only alternative to Kuhn’s LD-1822.
Before the vote, Henderson noted that she had come prepared to suggest killing her bill while keeping the one Roberts crafted. Ultimately, however, the panel agreed 10-0 that the Roberts bill “ought not to pass.”
Afterward, Henderson said she planned to draft an amendment to LD-1088 that would adapt some elements of LD-1224 she liked. The committee plans to reconvene in the later part of next week to further review the Kuhn and Henderson bills.