HB264, the Maryland Data Privacy and Protection Act of 2026, expands and modernizes State government privacy rules for personal information and sensitive data. The bill limits what State units may collect, maintain, process, and retain, requiring that personal information be tied to a legitimate government purpose, kept to the minimum necessary, and deleted or de-identified when no longer needed. It also requires State agencies to provide privacy notices and publish their privacy policies on agency websites, and it directs each unit of State government to designate a Privacy Officer to oversee compliance.
The bill also updates several statutory definitions and procurement rules. It broadens the definition of “personal information” to include additional identifiers such as taxpayer identification numbers, passport numbers, email credentials, health-related data, and sensitive data as defined in the Commercial Law Article. It adds a new State Finance and Procurement provision requiring the Department of Information Technology to issue privacy requirements for contracts involving contractors that collect, store, or process personal information, and it requires those requirements to align with recognized privacy frameworks. Finally, it directs governmental entities to adopt procedures to prevent the sale or redisclosure of personal records and geolocation data in ways that could harm resident privacy, and to report those procedures to the General Assembly.
In practical terms, the bill affects State agencies, their contractors, and other governmental entities that handle personal records, geolocation data, or sensitive personal data. It creates new compliance duties around retention, deletion, notice, reporting, and contract drafting, while preserving certain exemptions for criminal law enforcement, investigative materials, archival records, and some licensing materials. The bill also ties agency privacy notices and contract standards to guidance from the Department of Information Technology, increasing statewide coordination over data governance.
The overall sentiment appears strongly favorable and noncontroversial. The bill passed the House and Senate unanimously, with recorded third-reading votes of 123-0 and 43-0, respectively. The committee report was favorable, and there is no transcript evidence of opposition or significant debate in the materials provided.
No major points of contention are reflected in the available record, but the bill’s scope suggests the main policy tension would be between stronger privacy protections and the operational burden on agencies and contractors. The most notable substantive choices are the expanded definition of personal information, the new deletion and de-identification requirements, and the limits on sharing or reselling government-provided data, especially geolocation and sensitive data.
HB264 amends the General Provisions, State Finance and Procurement, and State Government Articles to impose new statewide data privacy obligations on government entities and certain contractors. It narrows and clarifies how State personal records may be collected, retained, disclosed, and disposed of, requires privacy notices and privacy policies on agency websites, mandates Privacy Officers, and authorizes the Department of Information Technology to set privacy standards for relevant contracts. It also expands the statutory definition of personal information and requires procedures to limit the sale and redisclosure of personal records and geolocation data.
The bill was received very positively. It had a favorable committee report and passed both chambers unanimously, indicating broad bipartisan support and little to no recorded opposition. The available materials show no committee testimony or floor debate suggesting controversy.
There is no documented contention in the provided transcripts or voting record. Any potential concerns would likely center on implementation costs, administrative burden, and how broadly the new privacy and retention rules apply to agencies and contractors, but those issues are not reflected as active disputes in the available record. The bill also preserves exemptions for law enforcement, archives, research, and certain licensing records, which may have helped avoid conflict.