§ 24–703.4
Statutes in effect as of October 1, 2026.
Md. Code Ann., Educ. § 24-703.4 (2026)
Title 24. Miscellaneous Education Agencies
Subtitle 7. Maryland Longitudinal Data System
§ 24–703.4LinkCopy Citation
(a)
(1)
In this section the following words have the meanings indicated.
(2)
“FedRAMP” means the Federal Risk and Authorization Management Program managed by the U.S. General Services Administration.
(3)
“Third–party data center” means a secure computational research platform managed by a person other than a state agency that allows states to securely share data for purposes of data matching and multistate reporting.
(b)
(1)
Subject to the requirements of this section, the Governing Board may authorize the Center to provide individual–level student data and individual–level workforce data to a third–party data center only for the purpose of facilitating multistate research and reporting on student outcomes.
(2)
The Governing Board may authorize the sharing of data under paragraph (1) of this subsection only with one third–party data center at a time.
(c)
(1)
Before authorizing the Center to provide data to a third–party data center, the Governing Board shall ensure that the third–party data center:
(i)
Has data handling and security standards that are at least as rigorous as those employed by the Center;
(ii)
Is a FedRAMP–authorized and –certified platform;
(iii)
Uses personally identifiable information only to the extent that is necessary for matching student data and workforce data with data from other states;
(iv)
Employs privacy–enhancing techniques, including data hashing, in place of personally identifiable data whenever appropriate;
(v)
Uses only de–identified data for analytic purposes;
(vi)
Releases only aggregate data in reports and other output; and
(vii)
Does not report data in any form that may be used to identify individuals based on the size or uniqueness of the population under consideration.
(2)
Before providing any data to a third–party data center, the Center shall enter into a written data sharing agreement with a third–party data center, in which the third–party data center agrees to comply with:
(i)
The conditions listed under paragraph (1) of this subsection;
(ii)
State and federal laws relating to data privacy; and
(iii)
Any other criteria the Governing Board determines are appropriate.
(3)
Each year, the Governing Board shall review an authorized data sharing agreement to ensure that the use of student data and workforce data by the third–party data center remains compliant with the terms of the agreement.
(d)
Before providing any data to a third–party data center, the Governing Board shall affirmatively approve:
(1)
The sharing of the data elements that constitute each data set;
(2)
The sharing of each data set; and
(3)
Each proposed research or reporting project that seeks to use Maryland data.
(e)
(1)
Within 30 days after entering into a written data sharing agreement with a third–party data center in accordance with this section, the Center shall submit a report to the Senate Committee on Education, Energy, and the Environment and the House Ways and Means Committee, in accordance with § 2–1257 of the State Government Article, that includes:
(i)
The name of the third–party data center;
(ii)
A summary of the data to be shared; and
(iii)
The purpose of and value to the State for entering into the data sharing agreement.
(2)
Within 1 year of the date the report under paragraph (1) of this subsection was submitted and each year thereafter until the data sharing agreement is no longer in effect, the Center shall submit a report to the Senate Committee on Education, Energy, and the Environment and the House Ways and Means Committee, in accordance with § 2–1257 of the State Government Article, that describes:
(i)
The status of the data sharing agreement;
(ii)
How the data is being used to further the purposes and stated value of the data sharing agreement; and
(iii)
Any violations of the data sharing agreement, if any, and steps taken to remedy the violations.