§ 8-214

(a) A person may not use or disclose any credit card number or other payment device number or holder’s signature unless:

(1) the person is the holder of the credit card number or payment device number;

(2) the disclosure is made to the holder or issuer of the credit card number or payment device number;

(3) the use or disclosure is:

(i) required under federal or State law;

(ii) at the direction of a governmental unit in accordance with law; or

(iii) in response to the order of a court having jurisdiction to issue the order;

(4) the disclosure is in connection with an authorization, processing, billing, collection, chargeback, insurance collection, fraud prevention, or credit card or payment device recovery that relates to the credit card number or payment device number, an account accessed by the credit card number or payment account number, a debt for which the holder or a person authorized by the holder gave the credit card number or payment device number for purposes of identification, or a debt or obligation arising, alone or in conjunction with another means of payment, from the use of the credit card number or payment device number;

(5) except as provided in subsection (b) of this section, the disclosure is reasonably necessary in connection with:

(i) the sale or pledge, or negotiation of the sale or pledge, of any portion of a business or the assets of a business;

(ii) the management, operation, or other activities involving the internal functioning of the person making the disclosure; or

(iii) the management, operation, or other activities involving disclosures between a corporation and its subsidiaries or controlled affiliates or between the subsidiaries or the controlled affiliates;

(6) the disclosure is made to a consumer reporting agency, as defined in § 14–1201 of the Commercial Law Article;

(7) subject to subsection (d) of this section, whether or not the person is a consumer reporting agency and whether or not the disclosure is a consumer report, the disclosure is made under a circumstance specified in the credit reporting provisions of § 14–1202(a)(3)(i), (ii), (iii), or (iv) of the Commercial Law Article; or

(8) the disclosure is allowed under § 1–303 of the Financial Institutions Article.

(b) A disclosure for marketing purposes may not be made if the holder of an active credit card number or payment device number has prohibited the issuer in writing at the issuer’s address from using the card or number for marketing purposes.

(c) (1) Notwithstanding subsection (a)(5)(iii) of this section, a disclosure for marketing purposes may not be made if the holder of an active credit card number or payment device number, other than an encoded credit card number or encoded payment device number, has notified the issuer in writing at an address specified by the issuer, that disclosure for marketing purposes is not allowed.

(2) The issuer shall notify each holder of an active credit card number or payment device number of the nondisclosure option and the specified address on a periodic basis at the issuer’s discretion at least once each year.

(3) The issuer shall comply with the holder’s election within 45 days after receiving the holder’s response.

(4) The election shall remain in effect until the holder rescinds the election or until there have been no debits or credits to the credit card number or payment device number for a 12–month period.

(d) Notwithstanding subsection (a)(7) of this section, and except as provided in § 14–1202(a)(3)(i) of the Commercial Law Article, a person may not furnish a report containing a credit card number or payment device number before receiving an individual written, electronic, or other tangible record of a certification from the requestor:

(1) containing the reason that the credit card number or payment device number is required; and

(2) stating that the credit card number or payment device number:

(i) cannot be obtained under a circumstance specified under this part or Title 14 of the Commercial Law Article; or

(ii) is needed for security, or loss or fraud prevention purposes.