Technology (Privacy)

SB 504 prohibits businesses from selling consumer personal data to buyers who intend to use it for immigration enforcement. It defines "sensitive data" to include immigration status, racial origin, health information, and sexual orientation, requiring businesses to handle such data more carefully. The bill also mandates public record custodians to prevent unauthorized disclosure - especially for immigration enforcement - and requires message switching systems to implement access controls. These changes aim to strengthen privacy protections for Maryland residents while modifying existing data privacy laws in the state code.

SB 659 requires all public and nonpublic primary and secondary schools to adopt written policies protecting student record privacy, including parent access rights and restrictions on sharing personal information without consent. Nonpublic prekindergarten and K-12 schools must annually report the number of alleged discrimination incidents based on protected categories like race, religion, sexual orientation, and disability. The reports must include incidents against students and be submitted starting September 1, 2027. Policies must comply with existing federal and state privacy laws and cannot override those protections. This bill directly affects nonpublic schools through new reporting requirements while expanding privacy safeguards for all schools.

HB 264, the Maryland Data Privacy and Protection Act of 2026, sets new rules for how Maryland state government agencies collect, store, and handle personal information. It requires agencies to only collect personal data that is necessary for a legitimate government purpose, delete or remove identifying details when no longer needed, and post clear privacy notices on their websites. The bill specifically defines "sensitive data" (like racial origin, health information, biometric data, and location tracking) and mandates that agencies designate a Privacy Officer to oversee compliance. This law directly affects all Maryland state government units, including departments and agencies, by requiring them to update their data practices to protect residents' privacy.

HB 711, the Data Privacy Act, prohibits businesses from selling consumer data they know or should know will be used for immigration enforcement. It requires public record custodians to prevent unauthorized access to records, especially for immigration purposes, and mandates reasonable rules to block such access. The bill also defines "sensitive data" to include immigration status, health information, racial background, and biometric data, requiring entities to handle this data carefully. Additionally, it sets new rules for message switching systems (like messaging apps) to prevent misuse of user data. These changes directly affect businesses handling consumer data, government record keepers, and digital service providers in Maryland.