Privacy advocates call on Maryland to investigate data brokers
Maryland has passed some of the strictest data privacy provisions in the country.
asserted
Maryland → call → country
But privacy and civil rights advocates say commercial data brokers are violating state law by collecting and selling Marylanders' geolocation data, as well as selling information to federal immigration authorities.
asserted
brokers → say → authorities
A coalition of privacy and civil rights groups filed a consumer complaint Wednesday that calls on the state attorney general to investigate specific companies and take enforcement action against them.
asserted
that → file → them
The complaint comes as U.S. Immigration and Customs Enforcement has been ramping up its use of commercially-available personal data and surveillance tools to track and deport immigrants as well as monitor protesters.
asserted
Enforcement → come → protesters
Two of the named data brokers, Penlink and Thomson Reuters, denied the allegations and told NPR they were in compliance with the law.
asserted
they → name → law
The complaint alleges Penlink, Thomson Reuters, Motorola, Insight LPR, LexisNexis, Flock Safety and others, are collecting and selling personal information and location data on Maryland residents to law enforcement customers in violation of state privacy law.
asserted
Penlink → allege → law
Penlink sells cell phone location data through its Webloc program, while the other companies sell car location data captured by license plate readers.
asserted
companies → sell → readers
Several of the named companies have contracts with ICE, including Penlink.
asserted
Several → name → Penlink
Thomson Reuters and LexisNexis provide data tools to ICE that contain a wide range of personal information from public records and proprietary data sources.
asserted
that → provide → records
The complaint also names ThunderCat Technology, which has a contract with Homeland Security Investigations, which is part of ICE, to provide the agency with individual taxpayer identification numbers (ITIN) data.
asserted
which → name → data
The complaint calls on Maryland Attorney General Anthony G. Brown to "use the full force" of the state's strong privacy laws, "and take immediate action to rein in agencies' use of commercially purchased data that enables mass surveillance of Americans without judicial, legislative, or public oversight."
Georgetown University Law Center's Technology Law Clinic authored the consumer complaint on behalf of We Are CASA, which advocates for working class, Black, Latino, Indigenous and immigrant rights, and 11 other organizations that focus on privacy and civil rights, including the Center for Democracy & Technology and the Electronic Privacy Information Center.
asserted
that → call → Democracy
"Through our direct services programming, we have witnessed parents worried about updating their address with state agencies, individuals increasingly cautious about engaging with any institution that collects personal data, even if they meet the program's eligibility requirements," said George Escobar, the executive director of We Are CASA in a statement.
asserted
We → witness → statement
"Ensuring a more equitable Maryland for all starts with an investigation of these data companies and strict enforcement of our values as laid out in state law," the statement continued.
asserted
statement → ensure → law
A statement provided to NPR by Thomson Reuters reads, "We are confident that we are in compliance with all applicable laws and regulations governing our business and operations."
asserted
we → provide → business
The company specifies on its website that the license plate recognition product it offers, "is not capable of tracking real time locations of a vehicle; it provides access to ad hoc images collected randomly."
asserted
it → specify → images
Penlink also denied that it was violating state law.
asserted
it → deny → law
"The allegations against Penlink in the complaint are false, as Penlink does not process or sell precise location data of Marylanders in accordance with Maryland privacy law," reads a company statement provided to NPR.
asserted
statement → process → NPR
"Penlink complies with applicable U.S. privacy laws and data-broker regulations, and we will continue to update our practices as data and privacy laws evolve."
asserted
laws → comply → practices
Maryland's law defines "precise geolocation data" as "information derived from technology that can precisely and accurately identify, within a radius of 1,750 feet, the specific location of a consumer, a mobile device, or a vehicle."
asserted
that → define → consumer
The complaint alleges that Penlink's products are being used by Maryland agencies.
asserted
products → allege → agencies
Penlink did not respond to NPR's questions about Baltimore County Police Department's contract for Webloc, which was previously reported by Citizen Lab, or a proposed contract upgrade with Maryland State Police for Penlink's PRX product.
asserted
which → respond → product
State records proposing that contract list "geolocation information" as part of the tool's capabilities.
asserted
records → propose → capabilities
None of the other named companies responded to NPR's request for comment by deadline.
asserted
None → name → deadline
Multiple emails to Flock Safety resulted in the same automated response: "Our media team is currently touching grass and taking a break.
asserted
team → result → break
Unlike our cameras, we can't work 24/7, so we'll get back to you when we've had a snack and regained the ability to form coherent sentences."
asserted
we → work → sentences
Many law enforcement agencies purchase sensitive data on Americans from data brokers to learn intimate details about where they go, who they meet with and where they live — without needing to obtain a warrant.
asserted
they → purchase → warrant
Advances in artificial intelligence are quickly making such data products even more powerful.
asserted
products → make → intelligence
Lawmakers from both parties have argued that law enforcement should not be able to purchase data they would otherwise need a warrant to obtain, since such data purchases circumvent protections granted by the Fourth Amendment, which prohibits "unreasonable searches and seizures."
asserted
which → argue → searches
But Congress has yet to pass a law that would close this so-called "data broker loophole."
asserted
that → have → loophole
Maryland lawmakers, however, have attempted to put restrictions on what data brokers can do with its residents' data.
asserted
brokers → attempt → data
The Maryland Online Data Privacy Act passed in 2024, and state lawmakers passed additional updates to that law in the most recent legislative session that took effect last month.
asserted
that → pass → effect
The Maryland attorney general's office declined to comment on the consumer complaint.
asserted
office → decline → complaint
When NPR inquired with the office in late June about the new data privacy provisions taking effect July 1, spokesperson Kelsey Hartman told NPR, "Entities subject to the law should ensure they are in compliance."
asserted
they → inquire → compliance
Under current Maryland law, data brokers are barred from collecting or sharing state residents' sensitive data, including location data, unless it is to deliver a product or service the consumer requested, or in response to certain law enforcement demands.
asserted
consumer → bar → demands
Data brokers are barred from selling or sharing Marylanders' location data unless law enforcement has gone through a legal process to obtain a subpoena or warrant.
asserted
enforcement → bar → subpoena
State law also bars data brokers from selling information to agencies that enforce immigration law, unless the law requires it or they receive a warrant.
asserted
they → bar → warrant
The complaint argues the named companies are violating the law by selling location data, or by selling to ICE, or in some cases — both.
asserted
companies → argue → cases
"If these practices are allowed to proceed, federal agencies will effectively be able to circumvent constitutional limits and judicial oversight altogether, and to conduct dragnet searches and go on fishing expeditions through Marylanders' private lives in ways that they should not be able to do," the complaint warns.
asserted
complaint → allow → that
New Jersey, Virginia, Oregon and Connecticut also recently banned the sale of some categories of sensitive data, including geolocation data.
asserted
Jersey → ban → data
Maryland's law is unique for its rules barring data brokers from selling personal data to entities that assist with immigration enforcement, said Greg Nojeim, director of the Center for Democracy and Technology's Security and Surveillance Project.
asserted
Nojeim → bar → Project
…and 3 more, not listed.
