(a) The purpose of this title is to establish standards for: (1) data security; and (2) the investigation of and notification to the Commissioner of a cybersecurity event applicable to carriers. (b) This title may not be construed to: (1) create or imply a private cause of action for violation of its provisions; or (2) curtail a private cause of action which would otherwise exist in the absence of this title. (c) Compliance with this title does not relieve a carrier from a duty to comply with any other requirements of federal law or Title 14 of the Commercial Law Article relating to the protection and privacy of personal information.
Maryland Legal Code