Md. Code, Commercial Law § 14-4711

(a) Nothing in this subtitle may be construed to require a controller or a processor to:

(1) Re–identify de–identified data;

(2) Maintain data in an identifiable form; or

(3) Collect, obtain, retain, or access any data or technology in order to be capable of associating an authenticated consumer request with personal data.

(b) Nothing in this subtitle may be construed to require a controller or processor to comply with an authenticated consumer rights request if the controller:

(1) Is not reasonably capable of associating the request with the personal data or it would be unreasonably burdensome for the controller to associate the request with the personal data;

(2) Does not use the personal data to recognize or respond to the specific consumer who is the subject of the personal data or associate the personal data with other personal data about the same specific consumer; and

(3) Does not sell the personal data to a third party or otherwise voluntarily disclose the personal data to a third party other than a processor, except as otherwise allowed in this subtitle.

(c) (1) A controller that discloses de–identified data shall:

(i) Exercise reasonable oversight to monitor compliance with any contractual commitments to which the de–identified data is subject; and

(ii) Take appropriate steps to address any breaches of any contractual commitments.

(2) The determination of whether oversight is reasonable and whether appropriate steps were taken in accordance with paragraph (1) of this subsection shall take into account whether the disclosed data includes data that would be considered sensitive data if the data were re–identified.