(a) Unless the Commissioner grants an exemption in accordance with subsection (b)(9) of this section and except as provided in subsection (c) of this section, with a new or renewal registration filed on or after June 1, 2019, a consumer reporting agency shall file a surety bond or irrevocable letter of credit with the Commissioner.

(b) (1) The bond shall run to the Commissioner, as obligee, for the benefit of:

(i) The State;

(ii) Any consumer who is injured by a violation of this subtitle committed by a consumer reporting agency; and

(iii) Any consumer who suffers actual damages as a result of the breach of the security of a system experienced by a consumer reporting agency.

(2) The bond shall be:

(i) In an amount not exceeding $1,000,000, as determined by the Commissioner by regulation;

(ii) Issued by a surety company that:

1. Is authorized to do business in the State; and

2. Holds a certificate of authority issued by the Maryland Insurance Commissioner; and

(iii) Conditioned that the consumer reporting agency shall comply with all State and federal laws and regulations governing consumer reporting agencies.

(3) The liability of the surety:

(i) Shall be continuous;

(ii) May not be aggregated or cumulative, whether or not the bond is renewed, continued, replaced, or modified;

(iii) May not be determined by adding together the penal sum of the bond, or any part of the penal sum of the bond, in existence at any two or more points in time;

(iv) Shall be considered to be one continuous obligation, regardless of increases or decreases in the penal sum of the bond;

(v) May not be affected by:

1. The insolvency or bankruptcy of the consumer reporting agency;

2. Any misrepresentation, breach of warranty, failure to pay a premium, or any other act or omission of the consumer reporting agency or an agent of the consumer reporting agency; or

3. The suspension of the consumer reporting agency’s registration;

(vi) May not require an administrative enforcement action by the Commissioner as a prerequisite to liability; and

(vii) Shall continue for 3 years after the later of the date on which:

1. The bond is canceled; or

2. The consumer reporting agency, for any reason, ceases to be registered.

(4) (i) A bond may be canceled by the surety or the consumer reporting agency by giving notice of cancellation to the Commissioner.

(ii) Notice under subparagraph (i) of this paragraph shall:

1. Be in writing; and

2. Be sent by certified mail, return receipt requested.

(iii) A cancellation of a bond under this paragraph is not effective until 90 days after receipt of a notice of cancellation by the Commissioner.

(5) A claim against the bond may be filed with the surety by:

(i) A claimant; or

(ii) The Commissioner for the benefit of a claimant or the State.

(6) If the amount of claims against a bond exceeds the amount of the bond, the surety:

(i) Shall pay the amount of the bond to the Commissioner for pro rata distribution to claimants; and

(ii) Is relieved of liability under the bond.

(7) If the penal amount of a bond is reduced by payment of a claim or judgment, the consumer reporting agency shall file a new or additional bond with the Commissioner.

(8) A penalty imposed against a consumer reporting agency under § 14-1226 of this subtitle may be collected and paid from the proceeds of a bond required under this section.

(9) In granting an exemption from the bonding requirement under subsection (a) of this section, the Commissioner shall consider the conditions the Commissioner establishes by regulation.

(10) In determining the amount of the bond under paragraph (2)(i) of this subsection, the Commissioner shall consider the factors the Commissioner establishes by regulation.

(c) (1) In lieu of the bonding requirement under subsection (a) of this section, a consumer reporting agency may file an irrevocable letter of credit from a financial institution insured by the Federal Deposit Insurance Corporation with the Commissioner.

(2) The irrevocable letter of credit shall be in an amount equal to the bond required under subsection (b) of this section.

(d) The Commissioner shall adopt regulations establishing:

(1) The conditions under which the Commissioner may grant to a consumer reporting agency an exemption from the bonding requirement under subsection (a) of this section; and

(2) The factors the Commissioner shall consider in determining the amount of the bond under subsection (b)(2)(i) of this section.