Read the full stored bill text
EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW.
[Brackets] indicate matter deleted from existing law.
Underlining indicates amendments to bill.
Strike out indicates matter stricken from the bill by amendment or deleted from the law by
amendment.
*hb0711*
HOUSE BILL 711
I3, S2, E4 6lr1978
CF SB 504
By: Delegates Charkoudian, Solomon, and Wolek
Introduced and read first time: February 2, 2026
Assigned to: Economic Matters
Committee Report: Favorable with amendments
House action: Adopted
Read second time: March 7, 2026
CHAPTER ______
AN ACT concerning 1
Data Privacy – Consumer Data, Public Records, and Message Switching System 2
(Data Privacy Act) 3
FOR the purpose of prohibiting a certain controller from knowingly selling the personal 4
data of a consumer if the controller knew or should have known that the purchaser 5
seeks to use the data for immigration enforcement to a certain governmental unit 6
that has engaged in or supported civil immigration enforcement under certain 7
circumstances; altering the manner in which certain provisions of law may be 8
construed with respect to a controller’s or processor’s compliance with governmental 9
actions; requiring a c ustodian of a public record to adopt reasonable rules and 10
regulations that prevent unauthorized disclosure or inspection of a public record, 11
and to take reasonable steps to determine whether a public record is accessed for 12
enforcing immigration law; alteri ng the reasons for which a public record may be 13
denied from being disclosed or inspected; requiring an entity that operates a certain 14
message switching system to take certain actions regarding system access; requiring 15
certain procedures developed and publi shed by certain governmental entities to 16
account for certain sensitive data containing certain sensitive attributes ; and 17
generally relating to data privacy of individuals in the State. 18
BY repealing and reenacting, without amendments, 19
Article – Commercial Law 20
Section 14–4701(a), (w), and (y) and (w) 21
Annotated Code of Maryland 22
(2025 Replacement Volume) 23
2 HOUSE BILL 711
BY adding to 1
Article – Commercial Law 2
Section 14–4701(p–1) 3
Annotated Code of Maryland 4
(2025 Replacement Volume) 5
BY repealing and reenacting, with amendments, 6
Article – Commercial Law 7
Section 14–4701(x), (cc), and (gg), and (hh) through (jj), 14–4703(b)(8), 14–4707(a), 8
and 14–4712(a) 9
Annotated Code of Maryland 10
(2025 Replacement Volume) 11
BY adding to 12
Article – Commercial Law 13
Section 14–4701(hh) 14
Annotated Code of Maryland 15
(2025 Replacement Volume) 16
BY repealing and reenacting, with amendments, 17
Article – General Provisions 18
Section 4–201, 4–320(b) and (g)(2), and 4–320.1 19
Annotated Code of Maryland 20
(2019 Replacement Volume and 2025 Supplement) 21
BY repealing and reenacting, with amendments, 22
Article – Public Safety 23
Section 3–529 24
Annotated Code of Maryland 25
(2022 Replacement Volume and 2025 Supplement) 26
BY repealing and reenacting, with amendments, 27
Article – State Government 28
Section 10–1702 29
Annotated Code of Maryland 30
(2021 Replacement Volume and 2025 Supplement) 31
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 32
That the Laws of Maryland read as follows: 33
Article – Commercial Law 34
14–4701. 35
(a) In this subtitle the following words have the meanings indicated. 36
(P–1) “DIVISION” HAS THE MEANING STATED IN § 13–101 OF THIS ARTICLE. 37
HOUSE BILL 711 3
(w) (1) “Personal data” means any information that is linked or can be 1
reasonably linked to an identified or identifiable consumer. 2
(2) “Personal data” does not include: 3
(i) De–identified data; or 4
(ii) Publicly available information. 5
(x) (1) “Precise geolocation data” means information derived from technology 6
that can precisely and accurately identify, WITHIN A RADIUS OF 1,750 FEET, the specific 7
location of a consumer [within a radius of 1,750 feet], A MOBILE DEVICE, OR A VEHICLE. 8
(2) “Precise geolocation data” includes global positioning system level 9
latitude and longitude coordinates or other similar mechanisms. 10
(3) “Precise geolocation data” does not include: 11
(i) The content of communications; 12
(ii) Data generated by or connected to an advanced utility metering 13
infrastructure system; or 14
(iii) Data generated by equipment used by a utility company. 15
(y) (1) “Process” means an operation or set of operations performed by manual 16
or automated means on personal data. 17
(2) “Process” includes collecting, using, storing, disclosing, analyzing, 18
deleting, or modifying personal data. 19
(cc) (1) “Publicly available information” means information that a person: 20
(i) Lawfully obtains from a record of a governmental entity, IF THE 21
PERSON PROCESSES THE INFORM ATION IN ACCORDANCE COMPLIES WITH EACH 22
RESTRICTION OR TERM OF USE PLACED ON THE INFORM ATION BY THAT THE 23
GOVERNMENTAL ENTITY IMPOSES AS A CONDITI ON FOR PROVIDING THE 24
INFORMATION TO THE PERSON; 25
(ii) Reasonably believes a consumer or widely distributed media 26
have lawfully made available to the general public; or 27
(iii) If the consumer has not restri cted the information to a specific 28
audience, obtains from a person to whom the consumer disclosed the information. 29
4 HOUSE BILL 711
(2) “Publicly available information” does not include biometric data 1
collected by a business about a consumer without the consumer’s knowledge. 2
(gg) (1) “Sensitive [data” means personal data that includes ] ATTRIBUTE” 3
MEANS: 4
(1) (I) Data revealing: 5
(i) 1. Racial or ethnic origin; 6
(ii) 2. Religious beliefs; 7
(iii) 3. Consumer health data; 8
(iv) 4. Sex life; 9
(v) 5. Sexual orientation; 10
(vi) 6. Status as transgender or nonbinary; 11
(vii) 7. National origin; or 12
(viii) 8. Citizenship or immigration status; 13
(2) (II) Genetic data or biometric data; 14
(3) (III) Personal data of a consumer that the controller k nows or has 15
reason to know is a child; or 16
(4) (IV) Precise geolocation data. 17
(2) “SENSITIVE DATA” INCLUDES DATA INFERRED BY A CONTROLLER 18
BASED ON PERSONAL DA TA THAT, ALONE OR IN COMBINAT ION WITH OTHER DATA , 19
IS USED TO INDICATE ANY DATA DESCRIBED UNDER PARAGRAPH (1)(I) THROUGH 20
(IV) OF THIS SUBSECTION. 21
(HH) “SENSITIVE DATA ” MEANS PERSONAL DATA THAT INCLUDES A 22
SENSITIVE ATTRIBUTE OR ANY OTHER PERSONA L DATA PROCESSED FOR THE 23
PURPOSE OF IDENTIFYING A SENSITIVE ATTRIBUTE. 24
[(hh)] (II) (1) “Targeted advertising” means displaying advertisements to a 25
consumer or on a device identified by a unique identifier, where the advertisement is 26
selected based on personal data obtained or inferred from the consumer’s activities over 27
time and across nonaffiliated websites or online applications that are unaffiliated with each 28
other, in order to predict the consumer’s preferences or interests. 29
HOUSE BILL 711 5
(2) “Targeted advertising” does not include: 1
(i) Advertisements based on the context of a consumer’s current 2
search query, visit to a website, or online application; 3
(ii) Advertisements based on a consumer’s activities within a 4
controller’s websites or online applications; 5
(iii) Advertisements directed to a consumer in response to the 6
consumer’s request for information or feedback; or 7
(iv) Processing personal data solely to measure or report advertising 8
frequency, performance, or reach. 9
[(ii)] (JJ) “Third party” means a person other than the relevant consumer, 10
controller, processor, or affiliate of the controller or processor of relevant personal data. 11
[(jj)] (KK) “Trade secret” has the meaning stated in § 11–1201 of this article. 12
14–4703. 13
(b) The following information and data are exempt from this subtitle: 14
(8) Personal data collected, processed, sold, or disclosed [in compliance] TO 15
THE EXTENT NECESSARY TO COMPLY with AS REQUIRED BY the federal Driver’s 16
Privacy Protection Act of 1994; 17
14–4707. 18
(a) A controller may not: 19
(1) Except where the collection or processing is strictly necessary to provide 20
or maintain a specific product or service requested by the consumer to whom the personal 21
data pertains, collect, process, or share sensitive data concerning a consumer; 22
(2) Sell sensitive data; 23
(3) Process personal data in violation of State or federal laws that prohibit 24
unlawful discrimination; 25
(4) Process the personal data of a consumer for the purposes of targeted 26
advertising if the controller knew or should have known that the consumer is under the age 27
of 18 years; 28
(5) Sell the personal data of a consumer if the controller knew or should 29
have known that [the]: 30
6 HOUSE BILL 711
(I) THE consumer is under the age of 18 years; OR 1
(II) THE PURCHASER SEEKS T O USE THE PERSONAL D ATA FOR 2
THE PURPOSE OF IMMIGRATION ENFORCEMENT; 3
(6) KNOWINGLY SELL THE PE RSONAL DATA OF A CON SUMER TO A 4
FEDERAL, STATE, OR LOCAL GOVERNMENTA L UNIT THAT , WITHIN THE 6 MONTHS 5
THAT IMMEDIATELY PRECEDE THE SALE OF THE PERSONAL DATA, HAS ENGAGED IN 6
OR SUPPORTED CIVIL I MMIGRATION ENFORCEMENT THROUGH THE PROVISION OF 7
PERSONNEL OR MATERIAL RESOURCES. 8
(7) Discriminate against a consumer for exercising a consumer right 9
contained in this subtitle, including denying goods or services, charging different prices or 10
rates for goods or services, or pr oviding a different level of quality of goods or services to 11
the consumer; 12
(7) (8) Collect, process, or transfer personal data or publicly available 13
data in a manner that unlawfully discriminates in or otherwise unlawfully makes 14
unavailable the equal enjoyment of goods or services on the basis of race, color, religion, 15
national origin, sex, sexual orientation, gender identity, or disability, unless the collection, 16
processing, or transfer of personal data is for: 17
(i) The controller’s self –testing to prevent or mitigate unlawful 18
discrimination; 19
(ii) The controller’s diversifying of an applicant, participant, or 20
customer pool; or 21
(iii) A private club or group not open to the public, as described in § 22
201(e) of the Civil Rights Act of 1964; or 23
(8) (9) Unless the controller obtains the consumer’s consent, process 24
personal data for a purpose that is neither reasonably necessary to, nor compatible with, 25
the disclosed purposes for which the personal data is processed, as disclosed to the 26
consumer. 27
14–4712. 28
(a) (1) Nothing in this subtitle may be construed to restrict a controller’s or 29
processor’s ability to: 30
(1) (I) Comply with federal, State, or local laws or regulations; 31
(2) (II) Comply EXCEPT AS PROVIDED IN PARAGRAPH (2) OF THIS 32
SUBSECTION, COMPLY with a civil, criminal, or regulatory inquiry, investigation, 33
HOUSE BILL 711 7
subpoena, or summons by a federal, State, local, or other governmental authority, EXCEPT 1
TO THE EXTENT THAT AN INQUIRY, AN INVESTIGATION, A SUBPOENA, OR A SUMMONS 2
PERTAINS SOLELY TO IMMIGRATION ENFORCEMENT; 3
(3) (III) Cooperate EXCEPT AS PROVIDED IN PARAGRAPH (2) OF THIS 4
SUBSECTION, COOPERATE with law enforcement agencies concerning conduct or activity 5
that the controller or processor reasonably and in good faith believes may violate federal, 6
State, or local laws or regulations; 7
(4) (IV) Investigate, establish, exercise, prepare for, or def end a legal 8
claim; 9
(5) (V) Provide a product or service specifically requested by a consumer; 10
(6) (VI) Perform under a contract to which a consumer is a party, 11
including fulfilling the terms of a written warranty; 12
(7) (VII) Take steps at the reque st of a consumer before entering into a 13
contract; 14
(8) (VIII) Take immediate steps to protect an interest that is essential for 15
the life or physical safety of a consumer or another individual and when the processing 16
cannot be manifestly based on another legal basis; 17
(9) (IX) Prevent, detect, protect against, investigate, prosecute those 18
responsible, or otherwise respond to a security incident, identity theft, fraud, harassment, 19
malicious or deceptive activity, or any other type of illegal activity; 20
(10) (X) Preserve the integrity or security of systems; or 21
(11) (XI) Assist another controller, processor, or third party with an 22
obligation under this subtitle. 23
(2) (I) THIS PARAGRAPH DOES N OT APPLY IF A CONTRO LLER OR 24
PROCESSOR IS PRESENT ED WITH A V ALID WARRANT ISSUED BY A FEDERAL OR 25
STATE COURT THAT PART ICULARLY DESCRIBES T HE PERSONAL DATA TO BE 26
ACCESSED. 27
(II) PARAGRAPH (1)(II) OF THIS SUBSECTION DOES NOT APPLY 28
TO A CONTROLLER ’S OR PROCESSOR ’S COMPLIANCE WITH A SUBPOENA OR 29
SUMMONS THAT IS DERIVED FROM A FEDERAL, STATE, OR LOCAL GOVERNMENTAL 30
UNIT THAT, WITHIN THE 6 MONTHS THAT IMMEDIATELY PRECEDE THE ISSUANCE OF 31
THE SUBPOENA OR SUMMONS, HAS ENGAGED IN OR SUPPORTED CIVIL IMMIGRATION 32
ENFORCEMENT THROUGH THE PROVISION OF PER SONNEL OR MATERIAL 33
RESOURCES. 34
8 HOUSE BILL 711
(III) PARAGRAPH (1)(III) OF THIS SUBSECTION DOES NOT APPLY 1
TO A CONTROLLER OR P ROCESSOR THAT KNOWS THE LAW ENFORCEMENT AGENCY 2
REQUESTING THE COOPERATION HAS, WITHIN THE 6 MONTHS THAT IMMEDIATELY 3
PRECEDE THE REQUEST FOR COOPERATION , ENGAGED IN OR SUPPORTED CIVIL 4
IMMIGRATION ENFORCEM ENT THROUGH THE PROV ISION OF PERSONNEL O R 5
MATERIAL RESOURCES. 6
(IV) THE DIVISION MAY POST MAT ERIALS ON ITS WEBSIT E TO 7
PROVIDE CONSUMER EDU CATION AND OTHER RES OURCES REGARDING CIV IL 8
IMMIGRATION ENFORCEMENT. 9
Article – General Provisions 10
4–201. 11
(a) (1) Except as otherwise provided by law, a custodian shall allow a person 12
or governmental unit to inspect any public record at any reasonable time. 13
(2) Inspection or copying of a public record may be denied only to the extent 14
provided under this title. 15
(b) To protect public records and to prevent unnecessary interference with official 16
business, each official custodian shall adopt reasonable rules or regulations that, subject to 17
this title[,]: 18
(1) govern timely production and inspection of a public record; AND 19
(2) PREVENT UNAUTHORIZED DISCLOSURE OR INSPEC TION OF A 20
PUBLIC RECORD, INCLUDING IN ACCORDANCE WITH § 4–320.1 OF THIS TITLE. 21
(c) Each official custodian shall: 22
(1) designate types of public records of the governmental unit that are to 23
be made available to any applicant immediately on request; and 24
(2) maintain a current list of the types of public records that have been 25
designated as available to any applicant immediately on request. 26
4–320. 27
(b) Except as provided in subsections (c) through (f) of this section, AND SUBJECT 28
TO § 4–320.1 OF THIS SUBTITLE, a custodian may not knowingly disclose a public record 29
of the Motor Vehicle Administration containing personal information. 30
HOUSE BILL 711 9
(g) (2) A person receiving personal information under subsection (d), (e), or (f) 1
of this section may not disclose the personal information to a [federal agent] PERSON or 2
[federal] GOVERNMENT agency for the purpose of [federal] immigration enforcement 3
unless the person is presented with a valid warrant issued by a federal court or a court of 4
this State. 5
4–320.1. 6
(a) In this section, “facial recognition” means a biometric software application 7
that identifies or verifies a person by comparing and analyzing patterns based on a person’s 8
facial contours. 9
(b) A CUSTODIAN SHALL TAKE REASONABLE STEPS TO DETERMINE 10
WHETHER A PERSON SEEKING ACCESS TO A PUBLIC RECORD IS DOING SO FOR THE 11
PURPOSE OF ENFORCING IMMIGRATION LAW. 12
(C) (1) Notwithstanding any other provision of this title [, an officer, an 13
employee, an agent, or a contractor of the State or a political subdivision ] A CUSTODIAN 14
shall deny inspection of the part of a public record that contains personal information or 15
inspection of a photograph of an individual by any [federal agency] PERSON seeking access 16
for the purpose of enforcing [federal] immigration law, unless the [officer, employee, agent, 17
or contractor] CUSTODIAN is provided with a valid warrant issued by a federal court or a 18
court of this State THAT CLEARLY IDENTIFIES PARTICULARLY DESCRIB ES THE 19
RECORD TO BE ACCESSED. 20
(2) Notwithstanding any other provision of this title [, an officer, an 21
employee, an agent, or a contractor of the State or a political subdivision ] A CUSTODIAN 22
shall deny inspection using a facial recog nition search of a digital photographic image or 23
actual stored data of a digital photographic image by any [federal agency] PERSON seeking 24
access for the purpose of enforcing [federal] immigration law, unless the [officer, employee, 25
agent, or contractor] CUSTODIAN is provided with a valid warrant issued by a federal court 26
or a court of this State THAT CLEARLY IDENTIFIES PARTICULARLY DESCRIBES THE 27
RECORD TO BE ACCESSED. 28
(3) On or before June 1, 2023, and each June 1 thereafter, the Motor 29
Vehicle Administr ation, the Department of State Police, and the Department of Public 30
Safety and Correctional Services shall, with respect to requests from [federal] 31
GOVERNMENT agencies seeking access for the purpose of [federal] immigration 32
enforcement for personal information, a photograph of an individual, or a facial recognition 33
search, whether or not the request was initiated through a State or local law enforcement 34
agency, report to the General Assembly, in accordance with § 2 –1257 of the State 35
Government Article, the following information for the immediately preceding calendar 36
year: 37
10 HOUSE BILL 711
(i) the number of requests received from any [federal] 1
GOVERNMENT agency for personal information, a photograph of an individual, or a facial 2
recognition search; 3
(ii) the number of requests received from any [federal] 4
GOVERNMENT agency for personal information, a photograph of an individual, or a facial 5
recognition search for which a valid warrant issued by a federal court or a court of this 6
State was provided; 7
(iii) the number and purpose of facial recognition searches completed 8
for any [federal] GOVERNMENT agency based on personal information or a photograph of 9
an individual provided to the [federal] GOVERNMENT agency by the Motor Vehicle 10
Administration, the Departme nt of State Police, or the Department of Public Safety and 11
Correctional Services; and 12
(iv) the number of individuals whose personal information or 13
photograph was provided to any [federal] GOVERNMENT agency by, respectively, the 14
Motor Vehicle Administra tion, the Department of State Police, and the Department of 15
Public Safety and Correctional Services. 16
(D) THE MOTOR VEHICLE ADMINISTRATION, THE DEPARTMENT OF STATE 17
POLICE, AND THE DEPARTMENT OF PUBLIC SAFETY AND CORRECTIONAL 18
SERVICES SHALL ADOPT REGULATIONS AND PROCEDURES TO IMPLEMENT, 19
ENFORCE, AND ENSURE COMPLIANCE WITH THIS SECTION. 20
Article – Public Safety 21
3–529. 22
(a) (1) In this section the following words have the meanings indicated. 23
(2) (i) “Database” means any database operated by State and local law 24
enforcement agencies, including databases maintained for a law enforcement agency by a 25
private vendor. 26
(ii) “Database” does not include a registry operated under Title 11, 27
Subtitle 7 of the Criminal Procedure Article. 28
(3) (i) “Law enforcement agency” means a federal, state, or local agency 29
authorized to enforce criminal laws. 30
(ii) “Law enforcement agency” includes the Maryland Department of 31
Public Safety and Correctional Services. 32
(4) “MESSAGE SWITCHING SYS TEM” MEANS A LAW ENFORCEM ENT 33
COMMUNICATIONS PLATFO RM THAT AUTOMATICALL Y ROUTES , FORMATS, AND 34
HOUSE BILL 711 11
DELIVERS ELECTRONIC QUERIES AND RESPONSE S BETWEEN LAW ENFORC EMENT 1
AGENCIES AND DATABASES. 2
(b) An entity operating a database OR A MESSAGE SWITCHING SYSTEM shall: 3
(1) deny access to the database OR MESSAGE SWITCHING SYSTEM to any 4
[individual] PERSON who is seeking access for the purpose of enforcing [federal] 5
immigration law, unless the [individual] PERSON presents a valid warrant issued by a 6
federal court or a court of this State; and 7
(2) require an individual accessing the database OR MESSAGE 8
SWITCHING SYSTEM to provide to the entity: 9
(i) the individual’s name; 10
(ii) the individual’s contact information, including a telephone 11
number, an e–mail address, and a physical address; and 12
(iii) unless the individual presents a valid warrant issued by a federal 13
court or a court of this State, a statement by the individual, under penalty of perjury, that 14
the individual is not accessing the database OR MESSAGE SWITCHI NG SYSTEM for the 15
purpose of enforcing [federal] immigration law. 16
(C) EACH ENTITY OPERATING A DATABASE AND , WITH RESPECT TO A 17
MESSAGE SWITCHING SY STEM, THE DEPARTMENT OF PUBLIC SAFETY AND 18
CORRECTIONAL SERVICES SHALL ADOPT REGULATIONS TO IMPLE MENT THIS 19
SECTION. 20
Article – State Government 21
10–1702. 22
(a) (1) In this section the following words have the meanings indicated. 23
(2) “Governmental entity” means a unit or instrumentality of State or local 24
government. 25
(3) “Personal record” has the meaning stat ed in § 4 –501 of the General 26
Provisions Article. 27
(4) “SENSITIVE ATTRIBUTE DATA” HAS THE MEANING STAT ED IN § 28
14–4701 OF THE COMMERCIAL LAW ARTICLE. 29
(b) (1) Subject to paragraph (2) of this subsection, on or before July 1, 2026, 30
each governmental entity, in consultation with the Department of Information Technology, 31
shall develop and publish procedures that prevent the sale and redisclosure of personal 32
12 HOUSE BILL 711
records and [geolocation] SENSITIVE data CONTAINING SENSITIVE ATTRIBUTES 1
provided or made available by the governmental entity in a way that harms the privacy of 2
residents of the State. 3
(2) The procedures required and published under paragraph (1) of this 4
subsection shall address: 5
(i) any possible contractual limitations on the sale or redisclosure of 6
personal records or [geolocation] SENSITIVE data CONTAINING SENSITIVE ATTRIBUTES 7
that a governmental entity may place on a person who receives personal records or 8
[geolocation] SENSITIVE data CONTAINING SENSITIVE ATTRIBUTES that are provided 9
or made available by the governmental entity; 10
(ii) considerations regarding: 11
1. the t hreat to privacy posed by data brokers who utilize 12
personal records or geolocation SENSITIVE data for commercial purposes; AND 13
2. the risk that personal records or [geolocation] SENSITIVE 14
data CONTAINING SENSITIVE ATTRIBUTES may be used for purposes other than the 15
purposes for which the personal records or [geolocation] SENSITIVE data CONTAINING 16
SENSITIVE ATTRIBUTES were developed or collected; and 17
[3. geolocation, genetic, and other sensitive data; and] 18
(iii) any other considerations necessary to: 19
1. protect the privacy of residents of the State; 20
2. discourage the development of a secondary commercial 21
market for personal records or [geolocation] SENSITIVE data CONTAINING SENSITIVE 22
ATTRIBUTES that are provided or made available by a governmental entity; and 23
3. limit a person who receives personal records or 24
[geolocation] SENSITIVE data CONTAINING SENSITIVE ATTRIBUTES that are provided 25
or made available by a governmental entity from selling or redisclosing the data with other 26
persons. 27
(c) On or before July 1, 2026, each governmental entity shall, in accordance with 28
§ 2–1257 of this article, submit to the General Assembly a copy of the procedures developed 29
under subsection (b) of this section. 30
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect July 31
1, 2026. 32