Privacy Law Library

Maryland Consumer Credit Reporting Agencies Act

MD CCRA

Credit reporting · Financial

Maryland's credit reporting law limits when consumer reports may be furnished, bars reporting of stale information, criminal records that did not end in conviction or were expunged, and (since 2025) any medical debt, and gives consumers rights to free reports, disputes, and security freezes. Agencies must register and post a bond, and users must give adverse action notices.

Where
Maryland
Citation
Md. Code, Com. Law §§ 14-1201 to 14-1225
Status
In force
Last amended
2025-10-01
Enforced by
Commissioner of Financial Regulation (14-1218, 14-1225); private civil actions (14-1221)
People can sue
Yes
Penalties
Willful noncompliance: actual damages, punitive damages, costs, and attorney's fees; negligent noncompliance: actual damages, costs, and fees (14-1221), within 2 years (14-1222). Obtaining information under false pretenses, or unauthorized disclosure by agency staff, is punishable by up to $5,000 and 1 year (14-1223, 14-1224).
Applies to
  • Consumer reporting agencies furnishing consumer reports on Maryland consumers, which must register annually with the Commissioner of Financial Regulation (14-1215)
  • Users of consumer reports and persons procuring investigative consumer reports (14-1204, 14-1212)

What a privacy notice must say

  • Disclose to the consumer before procuring an investigative consumer report about character, reputation, or mode of living.Com. Law 14-1204(a)
  • Users taking adverse credit, insurance, or employment action based on a consumer report must tell the consumer and identify the reporting agency.Com. Law 14-1212(a)

Rights it gives people

  • Place, temporarily lift, and remove security freezes within 3 business days of a request (faster for certain lifts), and provide the statutory freeze notice; separate freezes are available for protected minors and foster youth.Com. Law 14-1212.1, 14-1212.2, 14-1212.3
  • Reinvestigate disputed items and delete inaccurate or unverifiable information within 7 business days of the determination.Com. Law 14-1208(a)

Practices it requires

  • Do not include records of criminal proceedings in which the consumer was acquitted, exonerated, falsely accused, not convicted, or that were nolle prossed, or expunged records.Com. Law 14-1203.1 · From 2024-10-01
  • Do not report, incorporate, or keep on file any adverse medical debt information or medical debt collection actions, regardless of when incurred; users may not use medical debt information to judge creditworthiness.Com. Law 14-1213 · From 2025-10-01
  • Furnish consumer reports only on court order, the consumer's written instructions, or to persons with listed permissible purposes such as credit, employment, insurance, or licensing.Com. Law 14-1202(a)
  • Do not report bankruptcies older than 10 years or most other adverse items older than 7 years, except for large transactions.Com. Law 14-1203

Registration

  • Register annually with the Commissioner of Financial Regulation and maintain a bond that also covers consumers harmed by a security breach at the agency.Com. Law 14-1215, 14-1216, 14-1217

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Original enactment date not verified; the 7-year exceptions for large credit, insurance, or employment transactions (14-1203(b)) not reviewed. | The 14-1203.1 effective_on date assumes 2024 ch. 432 created that section; the chapter's section list was not read.

Research reference, not legal advice.