SB 504 prohibits businesses from selling consumer personal data to buyers who intend to use it for immigration enforcement. It defines "sensitive data" to include immigration status, racial origin, health information, and sexual orientation, requiring businesses to handle such data more carefully. The bill also mandates public record custodians to prevent unauthorized disclosure - especially for immigration enforcement - and requires message switching systems to implement access controls. These changes aim to strengthen privacy protections for Maryland residents while modifying existing data privacy laws in the state code.
SB 247 converts Maryland's Biotechnology Investment Incentive Tax Credit into a direct grant program administered by the Department of Commerce. It replaces tax credits with cash grants for qualifying biotechnology companies engaged in research, development, or commercialization of biological technologies. The bill requires the Department to disburse grants within a specified timeframe and allows recipients to deduct these grants from their Maryland income tax for the same year. This change shifts the incentive from tax savings to immediate funding, directly affecting eligible biotech firms in Maryland.
HB 195 requires Maryland's State Lottery and Gaming Control Commission to study emerging technologies to improve safety and transparency in gambling. Specifically, it mandates the Commission analyze security tools (like encryption and blockchain), monitor customer behavior for responsible gaming, and verify age/identity to prevent fraud. The bill also obligates the Commission to collaborate with Maryland colleges, foundations, or private entities for these studies and requires the Commission Director to participate in them. This law updates reporting requirements for the Commission to detail lottery revenues, expenses, and any needed legal changes. It directly affects the Commission's operations and the state's gambling regulatory framework, without altering existing gambling laws.
SB 564 creates a new Division of Data Protection within Maryland’s Office of the Attorney General. This division will investigate and enforce civil actions for violations of existing data privacy laws affecting businesses and consumers. It also establishes a Maryland Data Privacy Implementation and Innovation Workgroup, composed of state officials, consumer advocates, business representatives, and industry experts, to study implementation challenges and recommend improvements. The Workgroup must report its findings to the governor and legislature by January 1, 2027, and the bill’s provisions take effect on July 1, 2026, with the Workgroup structure expiring June 30, 2027.
SB 629 requires all Maryland state government units and public higher education institutions (excluding Morgan State University, the University System of Maryland, St. Mary’s College, and Baltimore City Community College) to implement email security policies. It mandates automatic filtering of spam emails (defined as unsolicited, non-state-business emails like phishing or bulk solicitations unrelated to official duties) and prohibits using state email systems as public forums. The bill also permits minimal personal email use that has no significant impact on resources and aligns with professional business standards. These requirements must be included in institutional IT policies, plans, and standards, effective October 1, 2026.
SB 661 modifies Maryland law to clarify when intercepted communications (like phone calls or texts) can be used as evidence in criminal court. It allows such evidence if: (1) at least one party was outside Maryland during the communication, (2) the interception wasn’t done by Maryland law enforcement, and (3) all parties were co-conspirators in a violent crime. For other cases, it sets strict conditions for admissibility, including requiring prosecutors to notify defendants 14 days in advance and proving the evidence is more relevant than alternatives. The bill directly affects criminal defendants, prosecutors, and law enforcement handling wiretap evidence in Maryland courts. It takes effect October 1, 2026.
SB 632 creates a new Office of State Elected Officials Information Privacy within Maryland’s Department of Legislative Services. It allows state elected officials (the "protected individuals") to request that their personal details - such as addresses, phone numbers, and email - be removed from public online sources like government websites, social media, or social networks. The bill also establishes criminal penalties for intentionally posting an official’s personal information online under certain circumstances. This replaces the existing Address Confidentiality Program for domestic violence survivors with a dedicated system specifically for protecting state elected officials’ privacy.
SB 310 prohibits the Maryland Judiciary Case Search system from referencing records of traffic violations committed by minors (under 18) under the Maryland Vehicle Law or other traffic laws. It directly affects minors who receive traffic citations, ensuring these records are not displayed in public online searches. The bill amends Maryland's Criminal Procedure law to require the case search system to omit all references to such minor traffic violations. This change takes effect October 1, 2026, and does not alter the existence of the underlying records.
SB 351 requires Maryland auto insurers to disclose when they use programs that track driving behavior (like speed or braking) and establish clear processes for policyholders to correct errors in that data. It limits the types and amount of driving data insurers can collect, bans using such data to cancel policies or refuse renewals, and prohibits insurers from raising premiums in increments of less than six months after a policy starts. The law also mandates insurers to adopt governance plans to prevent unfair discrimination in how driving data affects rates. These changes apply to all private passenger vehicle insurance policies in Maryland, taking effect October 1, 2026.
SB 932 requires social media platforms operating in Maryland to display the city and country (derived from IP address) of each adult user whose account is visible to a Maryland user. It applies to platforms like Facebook or Instagram, directly affecting both the platforms (which must implement this display) and Maryland users (who gain visibility into the general location of other users they interact with). The law explicitly excludes minors' locations from display and defines "general geographical location" to exclude precise GPS data. This is a consumer protection measure focused on transparency, not data collection or sharing.
