(1) data security; and

(2) the investigation of and notification to the Commissioner of a cybersecurity event applicable to carriers.

(b) This title may not be construed to:

(1) create or imply a private cause of action for violation of its provisions; or

(2) curtail a private cause of action which would otherwise exist in the absence of this title.

(c) Compliance with this title does not relieve a carrier from a duty to comply with any other requirements of federal law or Title 14 of the Commercial Law Article relating to the protection and privacy of personal information.