HB 1356, the Maryland Employee Civic Activity and Lawful Expression Protection Act, prohibits employers from taking adverse actions against employees for engaging in off-duty civic activities, political expression, or lawful online speech. It protects all employees - including interns, part-timers, and temporary workers - from retaliation such as termination, demotion, or denial of promotion for activities like protesting, volunteering, or sharing opinions online outside work hours. The law bans employers from coercing political contributions, forcing attendance at political events, or maintaining policies that restrict protected activities, with exceptions only for conduct that disrupts job duties or reveals trade secrets. Employees can pursue civil lawsuits for violations without exhausting administrative remedies first.
SB 564 creates a new Division of Data Protection within Maryland’s Office of the Attorney General. This division will investigate and enforce civil actions for violations of existing data privacy laws affecting businesses and consumers. It also establishes a Maryland Data Privacy Implementation and Innovation Workgroup, composed of state officials, consumer advocates, business representatives, and industry experts, to study implementation challenges and recommend improvements. The Workgroup must report its findings to the governor and legislature by January 1, 2027, and the bill’s provisions take effect on July 1, 2026, with the Workgroup structure expiring June 30, 2027.
HB 1335 requires Maryland's Department of Information Technology to hire an outside expert to conduct a study on state IT and cybersecurity workforce compensation. The study must compare salaries of state IT professionals with federal, local, and private-sector roles, evaluate the impact of current pay adjustments and benefits, and provide recommendations to improve recruitment and retention. The department must submit the findings to the Governor and legislature by November 1, 2027, and the law expires automatically on June 30, 2028. This bill does not change pay rates but mandates research to inform future decisions affecting state IT and cybersecurity staff.
HB 1341 prohibits public school security personnel - including school resource officers, security employees, and certain law enforcement officers - from engaging in federal immigration enforcement or sharing student/employee records for immigration purposes. The bill requires security staff to immediately contact school officials if presented with a valid judicial warrant, subpoena, or legal order for immigration-related information. It amends Maryland's Education Code to clarify that school security cannot be used for immigration investigations under federal §287(G) and must comply with state privacy laws. This directly affects school security staff and protects students, employees, and their families from immigration enforcement activities within public schools.
HB 1045 modifies Maryland’s Prescription Drug Monitoring Program (PDMP) by adding a restriction on sharing prescription data with federal law enforcement. Specifically, it amends Section 21-2A-06(b)(4) of the Maryland Annotated Code to prohibit disclosure to federal agencies unless the data does not involve "sensitive health services" designated by the new Protected Health Care Commission. This Commission, established under Section 4-310, will identify health services (like reproductive care) where data sharing could risk patient safety or privacy. The bill directly affects healthcare providers and patients whose data might be monitored, particularly for sensitive health services, by requiring a review before federal disclosure.
SB 571 requires large broadband providers (serving 10,000+ customers) in Maryland to establish a low-cost broadband program for eligible low-income residents by December 1, 2026. The program must offer at least 100 Mbps download speed (200 Mbps for households of three or more), 1.2 terabytes of data, and limit annual network outages to an average of 48 hours. Eligibility is defined by income (at or below 350% of federal poverty guidelines) or participation in programs like SNAP, Medicaid, or free school meals. Providers may adjust prices every three years by up to 2% or the Consumer Price Index change, with 30 days' notice to customers.
SB 569 limits how businesses (called "controllers") in Maryland can collect, process, or share personal data. It specifically prohibits selling or collecting sensitive data unless strictly necessary for a requested service, bans using precise geolocation data for targeted ads without consent, and forbids processing data for targeted advertising or selling data of consumers under 18. The bill also prohibits discrimination based on protected characteristics when handling data and bans denying services to consumers who exercise privacy rights. These changes directly affect businesses that collect personal data in Maryland, requiring them to adjust data practices to comply with the new restrictions starting October 1, 2026.
SB 616 creates a Maryland registry requiring businesses that collect and sell personal data (like names, addresses, biometric information, or Social Security numbers) to register annually with the state Comptroller. It defines "data brokers" as entities selling "brokered personal data" but excludes credit bureaus, banks under federal law, and nonprofits assisting law enforcement. The law mandates registration for qualifying businesses to operate, focusing on transparency around how personal data is collected and sold. It specifically covers sensitive data types (e.g., facial recognition, DNA sequences) while clarifying exclusions to avoid overlapping with federal regulations.
SB 827 regulates chatbot design, operation, and safety in Maryland, directly affecting chatbot developers, operators (like companies offering AI assistants), and all users - including minors. Key provisions require clear warnings before use, enhanced privacy protections for minors, strict rules for handling user data (including de-identifying personal information), and treating chatbots as "products" for liability claims. Violations are enforced as unfair trade practices under Maryland’s Consumer Protection Act, with additional penalties. The bill also mandates the Behavioral Health Administration to create educational materials about behavioral health services.
SB 504 prohibits businesses from selling consumer personal data to buyers who intend to use it for immigration enforcement. It defines "sensitive data" to include immigration status, racial origin, health information, and sexual orientation, requiring businesses to handle such data more carefully. The bill also mandates public record custodians to prevent unauthorized disclosure - especially for immigration enforcement - and requires message switching systems to implement access controls. These changes aim to strengthen privacy protections for Maryland residents while modifying existing data privacy laws in the state code.
