In the latest issue of The Wright Toolbox:
CYBERATTACKS IN MARYLAND NOW REQUIRE NEW NOTICES
by Donald Walsh
Effective October 1, Maryland has amended its data breach notification law expanding required action by businesses which have become aware of a data security breach. Maryland already requires businesses which own, control or possess personal information who have a data security breach to conduct a reasonable, prompt and good faith investigation seeking to determine if personal information has been impacted as a result of the breach. The new law clarifies its applicability to all businesses that own, license or maintain the personal information of Maryland residents and requires notification to affected individuals.
Attempting to ensure the integrity of the notice, the new law provides that the business cannot use information related to the breach other than to provide notification, protect or secure personal information, or provide notification to “national information security organizations created for information sharing and analysis of security threats, to alert and avert new or expanded breaches.” There are also limitations on whether the business can pass any costs on to those companies or owners for whom the business is holding the information.
Under current law notification of a data breach must be made to affected individuals within 45 days of when the business discovers or is made aware of the breach and to the Maryland Attorney General prior to the time notice is given to affected individuals.
What’s In Your Contract?
You negotiated your contract and you think that you know every term and provision that is in the contract. But, what about the terms that are not in the contract, do you know about those? Conversely, what about the provisions that are in the contract, but that are not enforceable? What is actually in the contract includes far more than what the eye can see. Certain laws, statutes or regulations may become part of the contract automatically by operation of law even if the parties were not aware of such laws, statutes or regulations.
It is a well-established principle of Maryland contract law that parties are presumed to contract mindful of the existing law, and that “all applicable or relevant laws must be read into the agreement of the parties just as if expressly provided by them, except where a contrary intention is evident.” As an example, if a supplier provides goods to a construction project (lumber, steel, misc. metal, ducts, wire, paint, etc.) that are defective in a manner which gives rise to the buyer’s right to reject such goods; if timely notice is not provided of the defects, the buyer’s right to reject the goods or claim damages may be waived, even if the contract between the parties is silent on the issue. This is so because a contract for the sale of goods in Maryland is subject to the Commercial Law Article of the Annotated Code of Maryland by operation of law. §2-605 of the Code provides that if notice of the defective condition is not provided by the buyer within a reasonable time, the ability to claim a breach or assert a warranty claim for those defective goods may be waived. Similarly, if a contractor performs work for an owner, Maryland law requires that the owner pay for that work in a prompt manner. Md. Code Ann., Real Property Article, §9-302. Under the Prompt Payment Act, if there is no stated time for payments to be made in the contract, the Act requires payment for undisputed work to be made within 30 days after the day on which the occupancy permit is granted or 30 days after the day on which the owner or the owner’s agent takes possession. If the contract between the owner and the contractor provides for specific dates or times of payment, the Act requires the owner to pay to the contractor undisputed amounts owed within 7 days after the date or time specified in the contract.
Not only can the “operation of law” include contract terms that are not specifically discussed or noted in the contract, the operation of law can also void terms and conditions that are in the contract. For example, if your contract has a provision which waives your right to file a Mechanics’ Lien against the property, Maryland law will void that provision. Section 9-113 of the Real Property Article provides that, “an executory contract between a contractor and any subcontractor that is related to construction, alteration, or repair of a building, structure, or improvement may not waive or require the subcontractor to waive the right to claim a mechanics’ lien.” Any provision of a contract made in violation of the statute is void as against the public policy of the State. Similarly, under Maryland law, any provision in a contract which seeks to waive the rights of a claimant to sue on a payment bond is void and unenforceable as against public policy. Finally, the fact that the contract documents may contain a “pay if paid clause” or a “pay when paid clause” does not abrogate the right of a claimant to assert a claim against a payment bond or a Mechanics’ Lien because Maryland law voids such provisions. Therefore, while it is important to be aware of what is in your contract, it is also important to be aware of what is not in your contract and to be aware of what may not be enforceable in your contract because of the operation of law.
To browse past issues, visit The Wright Toolbox page.