Coalition alleges companies are violating Maryland's new data privacy law

A group of civil rights and privacy organizations in Maryland have filed a complaint, accusing seven companies of violating the state's new data privacy law.

The Maryland Data Privacy Act was one of several laws passed in this year's legislative session aimed at curbing federal immigration enforcement in the state.

The advocacy groups are now calling on the Maryland attorney general to enforce the law, which is just a little more than a month old.

The AG's office confirmed it received the complaint and is reviewing it now.

Detailing the complaint

The advocacy group, We Are CASA, has been raising concerns about what it calls a recent surge in federal immigration enforcement in Maryland.

The organization's legal director says state data is being used as a tool by U.S. Immigrant and Customs Enforcement (ICE).

"Just as an example, we have seen arrest warrants that say ICE was running license plates," said We Are CASA's legal director Shana Khader. "That's accessing state data in order to find information about these drivers."

We Are CASA is a part of the coalition that filed a 29-page complaint Wednesday, saying a slew of companies have "violated Marylanders' privacy rights," particularly the Maryland Data Privacy Act.

The seven companies named in the complaint are Penlink, Motorola, Thomson Reuters, Insight LPR, LexisNexis, Flock Safety and ThunderCat Technology.

The complaint claims the companies' products have been improperly collecting, sharing and selling personal data, like cellphone and vehicle location data. In some cases, the data is being sold to agencies like ICE, according to the complaint. 

"There are most likely additional companies that are engaged in this behavior," Khader said.

WJZ reached out to each company named in the complaint, but only Penlink and Thomson Reuters responded, saying they are compliant with Maryland's privacy laws.

In a statement, a Penlink spokesperson said it has reached out to We Are CASA and other members of the coalition asking for the complaint to be withdrawn.

Other groups included in the coalition are the Center for Democracy & Technology, the Center on Privacy & Technology at Georgetown Law, Consumer Federation of America, Council on American-Islamic Relations (CAIR), Demand Progress Education Fund, Electronic Frontier Foundation, Electronic Privacy Information Center, Fight for the Future, and Surveillance Technology Oversight Project.

Bolstering privacy law

The Maryland Data Privacy Act was signed into law in May and went into effect in July.

It aimed to strengthen restrictions for data brokers around what they can and can't do with Marylanders' personal data.

Howard County Sen. Clarence Lam was one of the sponsors of the law in the legislative session. He also sponsored it as it went through the legislature in the 2025 session.

Lam said the growth of A.I. and the Trump administration's immigration strategy have made the law necessary.

"We've seen this administration use every tool out there to be able to pull information out of state databases and departments, often times in a way that is very concerning about how they might use that data later on to track people down," he said.

Other notable laws passed this legislative session included a ban on 287(g) agreements and the Maryland Community Trust Act. Both restrict state and local law enforcement cooperation with federal immigration authorities like ICE.

This story will be updated if additional responses are received from the companies named in the complaint.