MD HB264

Limits personal information collection by State government units to the minimum necessary for legitimate government purposes, requires data to be accurate and current, and mandates secure deletion or de-identification when no longer needed

Requires each State government unit to designate a Privacy Officer and post privacy notices and policies on their websites consistent with Department of Information Technology guidelines

Expands the definition of "personal information" to include usernames/emails with passwords, genetic and health-related data (including mental health and substance use disorder information), and sensitive data such as racial origin, religious beliefs, sexual orientation, and immigration status

Requires the Department of Information Technology to establish security, data collection, and privacy requirements for third-party contractors who access State IT systems or collect/process personal information, consistent with NIST privacy standards

Mandates governmental entities develop procedures by July 1, 2026 to prevent harmful sale and redisclosure of personal records and geolocation data, with the Act taking effect October 1, 2026