Bill > HB264

This bill, the Maryland Data Privacy and Protection Act of 2026, aims to strengthen privacy protections for Maryland residents by imposing new requirements on state government units regarding the collection, use, and retention of personal information. Key provisions include defining "sensitive data" to encompass a broad range of personal details like health, genetic, biometric, and precise geolocation information, as well as data pertaining to children. State government units will be required to limit the collection of personal information to only what is necessary for a "legitimate government purpose" (a clearly established need for official government functions), ensure it is accurate and current, and retain it only as long as reasonably needed, after which it must be securely deleted or de-identified. Furthermore, each state government unit must designate a Privacy Officer to oversee compliance and post a clear privacy notice on its website detailing what information is collected, why, and how it is used, along with their privacy policies. The bill also mandates that state government entities develop and publish procedures to prevent the sale and redisclosure of personal records and geolocation data, particularly addressing concerns about data brokers and the potential misuse of sensitive information, with these procedures to be submitted to the General Assembly by July 1, 2026, and the act taking effect on October 1, 2026.