Maryland has joined the growing list of states to pass a law — the Judge Andrew F. Wilkinson Judicial Security Act — that allows current and former members of the Maryland judiciary to request certain of their personal information not be made available to the public. The act is named after former Washington County Circuit Court Judge Andrew F. Wilkinson, who was senselessly murdered by an individual involved in a divorce proceeding over which Judge Wilkinson was presiding. The act passed the Maryland House and Senate unanimously and will take effect on June 1, 2024.
Maryland's act follows the onset of litigation involving New Jersey's "Daniel's Law," and passage of the federal law that seeks to protect the safety of members of the judiciary by allowing persons protected by the laws to limit public access to their personal information. So far in 2024, 37 states have begun considering or adopted similar privacy-based legislation designed to protect members of the judiciary and, in some states, other government officials involved in law enforcement.
"Protected Individuals" Under the Act
The act applies to "protected individuals," which are defined as current or retired: (i) Maryland judges or justices; (ii) federal judges domiciled in Maryland; (iii) Maryland magistrates; (iv) federal magistrates domiciled in Maryland; and (v) commissioners of the District Court of Maryland, as well as their children, spouses, or other dependents who reside in the same household.
"Personal Information" Under the Act
The act defines "personal information" as: (i) a home address; (ii) a home telephone number; (iii) a mobile telephone number; (iv) a personal email; (v) a social security number; (vi) a driver's license number; (vii) a federal tax identification number; (viii) a bank account number; (ix) a credit or debit card number; (x) a license plate number or unique identifier of a vehicle; (xi) a birth or marital record; (xii) a child's name; (xiii) a school or daycare; (xiv) a place of worship; or (xv) a place of employment for a spouse, child, or dependent of a "protected individual."
Publications Covered by the Act
The act prevents a person from publishing the personal information of a protected individual and defines "publish" as "to post or otherwise make available to the general public on the internet, social media, or social networks."
Invoking the Act
A "protected individual" must submit or have the Office of Information Privacy (OIP) submit on their behalf, a written request to have an online publication removed under the act. The act notes that a written request can be sent by mail or email and must "adequately identify the document, posting, or other publication containing the personal information."
The written request must also provide "sufficient information" confirming the requesting party's status as a "protected individual," unless the request is made by the OIP on the requester's behalf.
Notably, while the act empowers a "protected individual" to preemptively request that a governmental entity "not publish the protected individual's information," the act does not provide that authority against private persons. The act only allows a "protected individual" to request that private persons remove information that has been "published."
Exemptions to the Act
The act contains two notable exemptions. It excludes from the definition of "personal information": (i) information that has been publicly disclosed with the consent of the protected individual; and (ii) "information that is relevant to and displayed as part of a news story, commentary, editorial, or any other speech on matters of public concern."
Compliance Period
An entity or person receiving a request under the act must comply with the request within 72 hours of receipt. Once complied with, the entity or person must notify the requestor of the removal by certified mail or e-mail.
Enforcement
A protected individual or the OIP can bring an action against a governmental entity for failure to comply with the act. The act authorizes awards of declaratory relief, injunctive relief, and reasonable attorney's fees and costs, but does not provide for the recovery of statutory damages.
The act also allows for a protected individual or the OIP to bring an action against a private person for failure to comply with the act. It authorizes awards of declaratory relief, injunctive relief, damages incurred as result of the noncompliance and reasonable attorney's fees. The act further authorizes the award of punitive damages in cases of willful noncompliance.
Criminal Actions
The act also made it a misdemeanor for an individual to knowingly publish "personal information" on a "protected individual" when the publishing of that information results in an assault, harassment, trespass, or malicious destruction of property.
Creation of the Judicial Address Confidentiality Program
The act also created the Judicial Address Confidentiality Program, managed by the OIP. A protected individual may apply to join the program, which requires the individual to prove their protected individual status. Once proven, the OIP may request that a person or governmental agency use a substitute address designated by the OIP as the protected individual's address, request the shielding of real property records showing the protected individual's ownership interest in the real property, or request the shielding of the protected individual's actual address from public inspection in a record maintained by a government entity.
The act further provides that a person may not knowingly disclose a program participant's actual address, and that the participant, or the OIP, may bring an action for declaratory relief, injunctive relief, and reasonable attorney's fees for a violation of this section. This section of the act does not authorize actions against governmental agencies.
Maryland Law vs. New Jersey Law
There are significant differences between the act and New Jersey's Daniel's Law. As an initial matter, the laws differ in whose information they protect and what information is protected. The Maryland act only applies to "personal information" of current and former members of Maryland's judiciary. Daniel's Law, on the other hand, applies not only to New Jersey's judiciary, but also to law enforcement officers, child protective investigators in the Division of Child Protection and Permanency, and prosecutors. As for the information protected, Maryland's law is significantly broader. The act defines "personal information" to include: (i) a home address; (ii) a home telephone number; (iii) a mobile telephone number; (iv) a personal email; (v) a social security number; (vi) a driver's license number; (vii) a federal tax identification number; (viii) a bank account number; (ix) a credit or debit card number; (x) a license plate number or unique identifier of a vehicle, (xi) a birth or marital record, (xii) a child's name; (xiii) a school or daycare; (xiv) a place of worship; or (xv) a place of employment for a spouse, child, or dependent of a "protected individual." Daniel's Law only protects three of those 15 categories: (i) home address; (ii) unlisted home telephone number; and (iii) unlisted mobile telephone number.
The laws also greatly differ in their enforcement mechanisms and remedies. First, while both laws require the provision of written notice requesting the nondisclosure of certain information, Daniel's Law does not define or describe what constitutes sufficient "written notice" under the law. Conversely, Maryland expressly requires that the written notice be: (i) sent by certified mail or by e-mail; (ii) "provide sufficient information to confirm the requester is a ‘protected individual'" (unless the notice comes from the OIP); and (iii) "adequately identify the document, posting, or other publication containing the personal information." Second, under Daniel's Law, a "covered person" can assign their right to bring a civil action for a violation of the statute. The act does not contain a similar assignment provision. Third, Daniel's Law requires that a court award "actual damages, but not less than liquidated damages computed at the rate of $1,000 for each violation," while the act only provides for actual damages against persons found to have violated the act.
Perhaps most notably, the act and Daniel's Law differ significantly in terms of who they can be enforced against and whether enforcement can be preemptive. Under Daniel's Law, a "covered person" can prevent a "person, business, or association" from "disclos[ing] or re-disclos[ing]" their home address or unpublished home telephone number. Conversely, under the act, a "protected individual" can only demand that a "person who has published the Protected Individual's personal information remove the Protected Individual's Personal Information from publication." Therefore, the act, unlike Daniel's Law, does not apply to businesses and associations, and does not allow for preemptive requests for the nondisclosure of "personal information" pertaining to a "protected individual."
Lastly, the laws differ in their compliance periods. Perhaps because the act is purely a remedial statute when applied against a private party, it only provides a person 72 hours to comply with a written request. This is a much shorter compliance period than the 10 business days provided under Daniel's Law.
The laws do have some similarities. Both provide for an award of punitive damages against a private party found to have willingly violated the statute. Likewise, both have an exception for newspapers articles published before the enactment of the laws. Though it should be noted that the act's exception is much broader in that it includes any "information that is relevant to and displayed as part of a news story, commentary, editorial, or any other speech on matters of public concern" and is not limited to publications pre-dating the act's enactment.
The below chart provides a high-level comparison of the act with Daniel's Law, as well as the Daniel Anderl Judicial Security and Privacy Act of 2022 (the Anderl Act) which is the federal version of Daniel's Law.
Final Takeaway
With the act's passage and effective date of June 1, and other states continuing to consider similar legislation, it is important that entities be aware of these laws and review their policies for potential compliance with requests sent by individuals demanding non-disclosure under applicable state and federal law.
