1. What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

Maryland has legalized the use of medical marijuana and CBD oils and products to alleviate symptoms of specific diseases, chronic illnesses, and other conditions. MD. CODE HEALTH GEN. ART. §13-33. Dispensaries in Maryland are therefore permitted to sell products such as food, aerosols, oils, or ointments that contain CBD or cannabis to people with a valid medical marijuana card. Id. at §13-3301(e). Under this Maryland law, a qualifying patient for a medical marijuana card needs to be over the age of 18 and needs to have written certification by a certified provider. Id. at §13-3301(m). A certified provider is an individual who has an active and unrestricted license issued by the State Board of Physicians, Dental Examiners, Podiatric Medical Examiners, or Nursing, and is in good standing with that State Board. Id. at §13-3301(c). The certifying providers write a proposal to the Medical Cannabis Commission that is encouraged to approve medical marijuana applications for people with a chronic or debilitating disease that, results in them being admitted into hospice, or produces eating disorders, severe or chronic pain, nausea, seizures, or muscle spasms. Id. at §13-3304(d).

Maryland also follows the Agriculture Improvement Act of 2018, also known as the 2018 Farm Bill. H.R. 2, 115th Cong. (2018) (enacted). This bill differentiates hemp from other cannabis plants by defining hemp as not having more than 0.3 percent of tetrahydrocannabinol (“THC”). Id. Hemp-derived CBD oil, otherwise known as cannabidoil falls under this definition. See id. In fact, the bill specifically states that under the Controlled Substances Act, Schedule I status, marijuana does not include hemp-derived products. Id. at § 12619. This bill also expands on the industrial hemp programs and research efforts that initiated years ago. See id at § 7605. Industrial hemp is defined as “the plant Cannabis sativa L. and any part of such plant . . . with a delta-9 tetrahydrocannabinol concentration of not more than 0.3 percent on a dry weight basis.” 7 U.S.C. § 5940(a)(2)(2018). Similarly, Maryland laws also promote industrial hemp farming, and state that as long as a grower of industrial hemp registers with the Department of Agriculture, they can plant, grow, harvest, possess, process, sell, or buy industrial hemp. MD. CODE ANN., AGRIC. § 14-101 (LexisNexis 2018). In Maryland, an Industrial Hemp Research Pilot Program was formed to authorize and facilitate the use of industrial hemp for agricultural, industrial, or commercial purposes, while Department of Agriculture in Maryland collects the research on industrial hemp, including products derived from industrial hemp. H.B. 698 Gen. Assemb. (Md. 2018) (enacted).

However, while there is much case law on the possession and selling of marijuana, the use of CBD oil in consumer products is a contemporary issue; therefore, there is no case law to clarify, expand, or restrict the use of CBD oil in products to be sold to the public or the advertisement and sale thereof. There are also no applicable laws specifically governing and/or regulating the use of CBD oils in consumer products.

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

In early 2019, a bill titled the Online Consumer Protection Act was introduced in Maryland, and will take effect in January 2021. S.B. 613 Gen. Assemb. (Md. 2019). This Act mirrors most of the rights and requirements found in the General Data Protection Regulation (“GDPR”). Amongst other things, the Act will require businesses that collect consumers’ personal information, give notice to the consumer at or before the time the information is collected, and businesses must disclose, to the consumers, the third parties to whom they disclose the consumers’ information. Id. § 14-4202. It will also allow consumers to request that a business delete their personal information, with which businesses are required to comply. Id. § 14-4205. The Act even authorizes the Office of the Attorney General to seek a temporary restraining order, preliminary or permanent injunction, or certain civil penalties against a party for violating a consumer’s personal information privacy. Id. § 14-4210. However, the Act does not create a private right of action. See S.B. 613 Gen. Assemb. (Md. 2019).

Recently, Maryland amended the Personal Information Protection Act (“PIPA”) to improve protection of consumers. See MD. CODE ANN. COM. LAW § 14-35 (LexisNexis 2018); H.B. 974 Gen. Assemb. (Md. 2017). PIPA requires businesses follow reasonable security procedures and practices to protect consumers’ personal information and to notify consumers upon a security breach of their system. See COM. LAW § 14-35. Amongst other changes, the amendments to the PIPA expand the definition of personal information to include passport numbers, state ID cards and numbers, health information covered by HIPPA, health insurance policies, biometric data such as fingerprints, voiceprints, retina images, and a user name or email in combination with a password or security question. Id. at § 14-3501. Also, once a business determines that there is a breach in their system, they must conduct an investigation, and the amended law adds a 45 day timeframe for when a business must notify an individual of the investigation and that their information may have been misused. Id. at § 14-3504. The amendments also change the record destruction requirements for businesses. Id. at § 14-3502. Prior to the amendments, when a business was destroying a customer’s records that contained personal information, they were required to take reasonable steps to protect the unauthorized access of that information. Id. at § 14-3502. The amended law now requires a business to take the same steps when destroying an employee or former employee’s records that contain personal information. Id. Maryland and other states alike are becoming more aware of all of the new privacy issues with the growth of technology and hacking abilities, and are moving toward taking more steps to protect consumer and their personal information.