Maryland's new privacy law puts strict limits on how companies use your data