MD SB564

Establishes a Division of Data Protection within the Office of the Attorney General, staffed by a full-time Chief Counsel of Data Protection along with assistant attorneys general, investigators, and administrators as provided in the state budget.

Authorizes the Division to investigate and bring civil actions for violations of specific Commercial Law Article provisions: Section 13–310.1 (data breach notification), Title 14 Subtitle 47 (Maryland Online Data Privacy Act), and Title 14 Subtitle 48.

Creates the Maryland Data Privacy Implementation and Innovation Workgroup, composed of legislators, executive branch officials, consumer advocates, civil rights experts, small business and industry representatives, and technical experts — totaling approximately 15 members.

Directs the Workgroup to study Maryland's consumer data privacy framework, including data minimization, business compliance challenges, other states' privacy law updates, enforcement capacity and funding needs, and the intersection of artificial intelligence with personal data privacy.

Requires the Workgroup to report findings and recommendations to the Governor and General Assembly by January 1, 2027; the Workgroup provision automatically sunsets on June 30, 2027, and the Act takes effect July 1, 2026.