§3–711.

    (a)    This section does not apply to an employer that is:

        (1)    required to inquire into an applicant’s or employee’s credit report or credit history under federal law or any provision of State law for the purpose of employment;

        (2)    a financial institution that accepts deposits that are insured by a federal agency, or an affiliate or subsidiary of the financial institution;

        (3)    a credit union share guaranty corporation that is approved by the Maryland Commissioner of Financial Regulation; or

        (4)    an entity, or an affiliate of the entity, that is registered as an investment advisor with the United States Securities and Exchange Commission.

    (b)    Except as provided in subsection (c) of this section, an employer may not use an applicant’s or employee’s credit report or credit history in determining whether to:

        (1)    deny employment to the applicant;

        (2)    discharge the employee; or

        (3)    determine compensation or the terms, conditions, or privileges of employment.

    (c)    (1)    An employer may request or use an applicant’s or employee’s credit report or credit history if:

            (i)    1.    the applicant has received an offer of employment; and

                2.    the credit report or credit history will be used for a purpose other than a purpose prohibited by subsection (b) of this section; or

            (ii)    the employer has a bona fide purpose for requesting or using information in the credit report or credit history that is:

                1.    substantially job–related; and

                2.    disclosed in writing to the employee or applicant.

        (2)    For the purposes of this subsection, a position for which an employer has a bona fide purpose that is substantially job–related for requesting or using information in a credit report or credit history includes a position that:

            (i)    is managerial and involves setting the direction or control of a business, or a department, division, unit, or agency of a business;

            (ii)    involves access to personal information, as defined in § 14–3501 of the Commercial Law Article, of a customer, employee, or employer, except for personal information customarily provided in a retail transaction;

            (iii)    involves a fiduciary responsibility to the employer, including the authority to issue payments, collect debts, transfer money, or enter into contracts;

            (iv)    is provided an expense account or a corporate debit or credit card; or

            (v)    has access to:

                1.    information, including a formula, pattern, compilation, program, device, method, technique, or process, that:

                A.    derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from the disclosure or use of the information; and

                B.    is the subject of efforts that are reasonable under the circumstances to maintain its secrecy; or

                2.    other confidential business information.

    (d)    (1)    If an employer violates subsection (b) of this section, the applicant or employee may file a written complaint with the Commissioner.

        (2)    If the Commissioner receives a written complaint under paragraph (1) of this subsection, the Commissioner shall investigate the matter promptly.

        (3)    If the Commissioner determines that the employer has willfully or negligently violated subsection (b) or (c) of this section, the Commissioner shall try to resolve the matter informally.

        (4)    If the Commissioner is unable to resolve the matter informally, the Commissioner may:

            (i)    assess a civil penalty of:

                1.    up to $500 for an initial violation of subsection (b) or (c) of this section; or

                2.    up to $2,500 for a repeat violation of subsection (b) or (c) of this section; and

            (ii)    send an order to pay the civil penalty to the complainant and the employer.

        (5)    (i)    Within 30 days after an employer receives an order to pay a civil penalty under paragraph (4) of this section, the employer may request a de novo administrative hearing, subject to the requirements of Title 10, Subtitle 2 of the State Government Article.

            (ii)    On receipt of a request for a hearing under subparagraph (i) of this paragraph, the Commissioner shall schedule a hearing.

            (iii)    If a hearing is not requested under subparagraph (i) of this paragraph, the order to pay a civil penalty becomes a final order of the Commissioner.

        (6)    If an employer fails to comply with a final order to pay a civil penalty, the Commissioner or the complainant may bring an action to enforce the order to pay a civil penalty in the circuit court in the county where the employer or the complainant is located.

    (e)    This section may not be construed to prohibit an employer from performing an employment–related background investigation that:

        (1)    includes use of a consumer report or investigative consumer report;

        (2)    is authorized under the federal Fair Credit Reporting Act; and

        (3)    does not involve investigation of credit information.