§ 3-2303

(a) A protected individual, or the Office of Information Privacy on behalf of a protected individual, may request that a person who has published the protected individual’s personal information remove the protected individual’s personal information from publication.

(b) A request made under this section shall:

(1) Be in writing;

(2) Be sent by certified mail or by e–mail;

(3) Except as provided in subsection (c) of this section, provide sufficient information to confirm that the requester is a protected individual; and

(4) Adequately identify the document, posting, or other publication containing the personal information.

(c) A request made by the Office of Information Privacy certifies that a requester is a protected individual and no further information may be required to confirm that the requester is a protected individual.

(d) The person to whom the request is made shall:

(1) Provide for the removal of the personal information within 72 hours after receipt of the request; and

(2) Notify the protected individual or the Office of Information Privacy by certified mail or by e–mail of the removal.

(e) (1) A protected individual or the Office of Information Privacy may bring an action for a violation of this section against a person for:

(i) Declaratory relief;

(ii) Injunctive relief;

(iii) Damages incurred as the result of a violation of this section; or

(iv) Reasonable attorney’s fees.

(2) In addition to the relief provided under paragraph (1) of this subsection, if a court finds that a person willfully refused to provide for the removal of personal information knowing that the individual on behalf of whom the request was made was a protected individual, the court may award punitive damages.