In this section, “personal record” means a public record that names or, with reasonable certainty, otherwise identifies an individual by an identifying factor such as: an address; a description; a fingerprint or voice print; a number; or a picture. Personal records may not be created unless the need for the information has been clearly established by the unit collecting the records. Personal information collected for personal records: shall be appropriate and relevant to the legitimate government purpose for which it is collected; shall be limited to the minimum amount of personal information necessary to accomplish the legitimate government purpose for which it was collected; shall be accurate and current to the greatest extent practicable; shall not be retained for longer than is reasonably necessary to fulfill the legitimate government purpose for which it was collected; in accordance with the unit’s retention schedule or as allowed by law, shall be securely deleted or de–identified when no longer needed to fulfill the legitimate government purpose for which it was collected; and may not be obtained by fraudulent means. This subsection applies only to units of the State. Except as otherwise provided by law, an official custodian who keeps personal records shall collect, to the greatest extent practicable, personal information from the person in interest. An official custodian who requests personal information for personal records shall provide the following information to each person in interest from whom personal information is collected: the legitimate government purpose for which the personal information is collected; any specific consequences to the person for refusal to provide the personal information; the person’s right to inspect, amend, or correct personal records, if any; whether the personal information is generally available for public inspection; and whether the personal information is made available or transferred to or shared with any entity other than the official custodian. Each unit of the State shall post a privacy notice and its privacy policies on the collection of personal information, including the policies specified in this subsection, on its Internet website. The privacy notice and privacy policies posted under subparagraph (i) of this paragraph shall be consistent with the guidelines, standards, and policies issued by the Department of Information Technology under § 3.5–319 of the State Finance and Procurement Article. The following personal records are exempt from the requirements of this subsection: information concerning the enforcement of criminal laws or the administration of the penal system; information contained in investigative materials kept for the purpose of investigating a specific violation of State law and maintained by a State agency whose principal function may be other than law enforcement; information contained in public records that are accepted by the State Archivist for deposit in the Maryland Hall of Records; information gathered as part of formal research projects previously reviewed and approved by federally mandated institutional review boards; information contained in application or renewal materials relating to the licensing, registration, or certification of an individual for an occupation or profession; and any other personal records exempted by regulations adopted by the Secretary of Budget and Management, based on the recommendation of the Secretary of Information Technology. This subsection does not apply to: a unit in the Legislative Branch of the State government; a unit in the Judicial Branch of the State government; or a board of license commissioners. If a unit or an instrumentality of the State keeps personal records, the unit or instrumentality shall submit an annual report to the Secretary of General Services. An annual report shall state: the name of the unit or instrumentality; for each set of personal records: the name of the set; the location of the set; and if a subunit keeps the set, the name of the subunit; for each set of personal records that has not been previously reported: the category of individuals to whom the set applies; a brief description of the types of information that the set contains; the major uses and purposes of the information; by category, the source of information for the set; and the policies and procedures of the unit or instrumentality as to: access and challenges to the personal record by the person in interest; and storage, retrieval, retention, disposal, and security, including controls on access; and for each set of personal records that has been disposed of or changed significantly since the unit or instrumentality last submitted a report, the information required under item (iii) of this paragraph. A unit or an instrumentality that has two or more sets of personal records may combine the personal records in the report only if the character of the personal records is highly similar. The Secretary of General Services shall adopt regulations that govern the form and method of reporting under this subsection. The annual report shall be available for public inspection. The official custodian may allow inspection of personal records for which inspection otherwise is not authorized by a person who is engaged in a research project if: the researcher submits to the official custodian a written request that: describes the purpose of the research project; describes the intent, if any, to publish the findings; describes the nature of the requested personal records; describes the safeguards that the researcher would take to protect the identity of the persons in interest; and states that persons in interest will not be contacted unless the official custodian approves and monitors the contact; the official custodian is satisfied that the proposed safeguards will prevent the disclosure of the identity of persons in interest; and the researcher makes an agreement with the unit or instrumentality that: defines the scope of the research project; sets out the safeguards for protecting the identity of the persons in interest; and states that a breach of any condition of the agreement is a breach of contract.

A person in interest may request a unit of the State to correct inaccurate or incomplete information in a public record that: the unit keeps; and the person in interest is authorized to inspect. A request under this section shall: be in writing; describe the requested change precisely; and state the reasons for the change. Within 30 days after receiving a request under this section, a unit shall: make or refuse to make the requested change; and give the person in interest written notice of the action taken. A notice of refusal shall contain the unit’s reasons for the refusal. If the unit finally refuses a request under this section, the person in interest may submit to the unit a concise statement that, in five pages or less, states the reasons for the request and for disagreement with the refusal. If the unit provides the disputed information to a third party, the unit shall provide to that party a copy of the statement submitted to the unit by the person in interest. If a unit is subject to Title 10, Subtitle 2 of the State Government Article, a person or governmental unit may seek administrative and judicial review in accordance with that subtitle of: a decision of the unit to deny: a request to change a public record; or a right to submit a statement of disagreement; or the failure of the unit to provide the statement to a third party.

Each governmental unit that maintains public records shall: identify a representative who a member of the public should contact to request a public record from the governmental unit; maintain contact information for the governmental unit’s representative that includes: the representative’s name; the representative’s business address; the representative’s business phone number; the representative’s business electronic mail address; and the Internet address of the governmental unit; post the contact information maintained under item (2) of this subsection in a user–friendly format on the website of the governmental unit; or if the governmental unit does not have a website, keep the contact information maintained under item (2) of this subsection at a place easily accessible by the public; annually update the contact information maintained under item (2) of this subsection; and annually submit the contact information maintained under item (2) of this subsection to the Office of the Attorney General. The Office of the Attorney General shall: post the contact information submitted under subsection (a)(5) of this section in a user–friendly format on the website of the Office of the Attorney General; and include the contact information submitted under subsection (a)(5) of this section in any Public Information Act manual published by the Office of the Attorney General.