Law note · Maryland
Maryland Unauthorized Access to Computers, with a civil private right of action
What it asks of an app
- Do not access, or exceed authorized access to, a Maryland-connected computer network, system, or database intentionally and without authorization; the statute defines only access, never authorization, so whether an unrestricted public page counts as authorized is unsettled rather than resolved by its text.
- A violation exposes you to a civil suit by anyone who suffers a specific and direct injury, with actual damages and attorney's fees recoverable, independent of and in addition to any criminal exposure and independent of MODPA's own enforcement scheme.
When LexLint raises it
crawls_web
What we found
Section 7-302(c)(1) provides that a person may not intentionally, willfully, and without authorization access, attempt to access, cause to be accessed, or exceed the person's authorized access to all or part of a computer network, computer control language, computer, computer software, computer system, computer service, or computer database, or copy, attempt to copy, possess, or attempt to possess the contents of a computer database accessed in violation of that clause.
Reading the section end to end, only access is defined (to instruct, communicate with, store data in, retrieve or intercept data from, or otherwise use the resources of a computer program, system, or network); authorization and without authorization are never defined anywhere in the section, and it carries no publicly-available-data exception and no notice-based revocation clause of any kind, so there is no textual hook either way for how a Maryland court would treat a public, unauthenticated page.
Section 7-302(g) separately creates a civil private right of action: a person who has suffered a specific and direct injury because of a violation of this section may bring a civil action, recover actual damages and reasonable attorney's fees and court costs, and a prior criminal conviction is not a prerequisite to suit.
This civil right of action is independent of MODPA's own Attorney-General-only enforcement scheme and expands a scraper's exposure in Maryland beyond the criminal penalties in subsection (d).