Bill > HB264

This bill, the Maryland Data Privacy and Protection Act of 2026, aims to strengthen privacy protections for Maryland residents by updating existing laws regarding the collection and use of personal information by state government entities. Key provisions include defining "sensitive data" to encompass a broader range of personal information, such as racial origin, health data, sexual orientation, and precise geolocation, and requiring government units to collect only the minimum personal information necessary for a "legitimate government purpose," which is defined as a purpose that is necessary and directly related to the statutory authority of the unit. The bill mandates that government entities establish and post privacy notices and policies online, detailing the purpose of data collection, consequences of refusal to provide information, and rights to inspect or amend records. It also introduces new requirements for contracts involving third-party contractors who access or process state information technology or personal data, ensuring they adhere to specific security and privacy standards, including those from the National Institute of Standards and Technology (NIST). Furthermore, by July 1, 2026, all governmental entities must develop and publish procedures to prevent the sale and redisclosure of personal records and geolocation data in a way that harms resident privacy, with a focus on discouraging secondary commercial markets for this data. The bill also clarifies the definition of "personal information" to include usernames and email addresses combined with passwords, as well as genetic and health-related data.

Government Affairs

Government, Labor, and Elections (House)

https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/HB0264?ys=2026RS