<section article="glg" article_name="Local Government" number="31-101" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <level label="a"> <text>In this title the following words have the meanings indicated.</text> </level> <level label="b"> <text>“Aggregate” means to correlate, link, or associate personally identifiable information from one provider with personally identifiable information from any other provider inside the Baltimore City Youth Data Hub.</text> </level> <level label="c"> <text>“Authorized purpose” means an evidence–based, testable inquiry that is intended to yield results that further the purpose of the Baltimore City Youth Data Hub.</text> </level> <level label="d"> <text>“Baltimore City Youth Data Hub” means an integrated, electronic data management system that links data about youth from any provider.</text> </level> <level label="e"> <level label="1"> <text>“Data” means any information about a youth.</text> </level> <level label="2"> <text>“Data” includes names, addresses, telephone numbers, dates of birth, information on gender, ethnicity, and English language proficiency, family or personal incomes, other family data, Social Security numbers, student or employee identification numbers, enrollment and attendance dates, performance information in any jobs, internships, schools, or other programs, current and past health information, including birth weights, maternal health at birth, and exposure to lead, and information on the receipt individually or by family of welfare benefits.</text> </level> </level> <level label="f"> <level label="1"> <text>“Data recipient” means any individual, agency, or entity that receives de–identified data from the Baltimore City Youth Data Hub for analysis, research, or evaluation purposes.</text> </level> <level label="2"> <text>“Data recipient” includes the manager or a provider.</text> </level> </level> <level label="g"> <text>“De–identified data” means any personally identifiable information that is permanently removed in a manner that leaves no reasonable basis to believe that the remaining information can be used to successfully link the de–identified data to a particular individual.</text> </level> <level label="h"> <text>“Executive committee” means the body that provides vision, oversight, and leadership for the Baltimore City Youth Data Hub.</text> </level> <level label="i"> <text>“Manager” means the nongovernmental custodian of the Baltimore City Youth Data Hub responsible for its operation, upkeep, and security.</text> </level> <level label="j"> <text>“Personally identifiable information” includes:</text> <level label="1"> <text>an individual’s name;</text> </level> <level label="2"> <text>the name of an individual’s parent or other family members;</text> </level> <level label="3"> <text>the address of an individual or an individual’s family members;</text> </level> <level label="4"> <text>a personal identifier, including an individual’s Social Security number, student identification number, or biometric record;</text> </level> <level label="5"> <text>an indirect identifier, including an individual’s date of birth, place of birth, or mother’s maiden name; and</text> </level> <level label="6"> <text>any data that, either alone or in combination, would tend to associate or link a piece of information with a particular individual in a manner that would allow a reasonable person in the community to identify the particular individual.</text> </level> </level> <level label="k"> <text>“Provider” means:</text> <level label="1"> <text>the Mayor and City Council of Baltimore City;</text> </level> <level label="2"> <text>Baltimore’s Promise; and</text> </level> <level label="3"> <text>the Baltimore City Board of School Commissioners.</text> </level> </level> <level label="l"> <text>“Secure” means to implement a comprehensive data security program to maintain data in strict confidence and protect personally identifiable information and de–identified data aggregated through the Baltimore City Youth Data Hub from unauthorized access, use, modification, or disclosure.</text> </level> <level label="m"> <text>“Youth” means any person under the age of 21 years who:</text> <level label="1"> <text>resides in Baltimore City;</text> </level> <level label="2"> <text>attends or graduated from an elementary or secondary school in Baltimore City; or</text> </level> <level label="3"> <text>participates in or graduated from any youth program in Baltimore City.</text> </level> </level> </section> <section article="glg" article_name="Local Government" number="31-102" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <level label="a"> <text>There is a Baltimore City Youth Data Hub in Baltimore City.</text> </level> <level label="b"> <text>The purpose of the Baltimore City Youth Data Hub is:</text> <level label="1"> <text>to promote the health, safety, security, and well–being of youth; and</text> </level> <level label="2"> <text>to improve equitable access to and the overall cost–efficiency of programs serving youth.</text> </level> </level> </section> <section article="glg" article_name="Local Government" number="31-103" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <level label="a"> <text>The executive committee consists of:</text> <level label="1"> <text>the Mayor of Baltimore City, or the Mayor’s designee;</text> </level> <level label="2"> <text>the Chief Executive Officer of the Baltimore City Public School System, or the Chief Executive Officer’s designee; and</text> </level> <level label="3"> <text>any other individuals selected by the Mayor.</text> </level> </level> <level label="b"> <text>The executive committee shall:</text> <level label="1"> <text>oversee the Baltimore City Youth Data Hub; and</text> </level> <level label="2"> <text>appoint and oversee the manager of the Baltimore City Youth Data Hub.</text> </level> </level> <level label="c"> <level label="1"> <text>The executive committee shall establish an advisory committee of community stakeholders, including representatives from nonprofit organizations, faith–based institutions, community resident associations, and members from the larger community.</text> </level> <level label="2"> <text>The purpose of the advisory committee is to increase awareness of and provide feedback on the Baltimore City Youth Data Hub.</text> </level> </level> </section> <section article="glg" article_name="Local Government" number="31-104" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <level label="a"> <text>The manager shall operate the Baltimore City Youth Data Hub.</text> </level> <level label="b"> <text>The manager shall be a citywide entity that aims to improve outcomes for youth, with a specific focus on youth from historically marginalized communities.</text> </level> <level label="c"> <text>The manager shall aggregate promptly and properly personally identifiable information received from providers.</text> </level> <level label="d"> <level label="1"> <text>Subject to paragraph (2) of this subsection, the manager may contract with a technology vendor or other professional.</text> </level> <level label="2"> <text>If the manager contracts with a technology vendor or other professional to code, create, or assist with the operation of the Baltimore City Youth Data Hub, the technology vendor or professional is subject to the requirements of this title related to the manager.</text> </level> </level> <level label="e"> <level label="1"> <text>The manager is not subject to the Public Information Act or the Open Meetings Act.</text> </level> <level label="2"> <text>The records for which the manager is a custodian are not subject to the Public Information Act.</text> </level> </level> </section> <section article="glg" article_name="Local Government" number="31-105" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <level label="a"> <text>Notwithstanding any other provision of law, any local governmental entity and the Baltimore City Board of School Commissioners may provide personally identifiable information and data for the Baltimore City Youth Data Hub.</text> </level> <level label="b"> <text>On request of the manager, a provider may submit and update personally identifiable information related to the Baltimore City Youth Data Hub’s purpose on a rolling or real–time basis.</text> </level> <level label="c"> <text>Each provider and its clients, students, or participants, as appropriate, shall retain ownership of:</text> <level label="1"> <text>the data provided by the provider; and</text> </level> <level label="2"> <text>the de–identified data and any new data element, including derivative files generated as a result of the data provided by the provider to the Baltimore City Youth Data Hub.</text> </level> </level> </section> <section article="glg" article_name="Local Government" number="31-106" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <level label="a"> <text>The Baltimore City Youth Data Hub and manager may use only aggregated, de–identified data for conducting any analysis, research, and reporting to the executive committee, the public, or otherwise.</text> </level> <level label="b"> <text>Direct access to personally identifiable information in the Baltimore City Youth Data Hub shall be restricted to the manager and the manager’s authorized staff or contractors only for authorized purposes and lawful quality control.</text> </level> <level label="c"> <text>On the receipt of data, the manager or its designated technology vendor shall work with providers to promptly extract and upload the data into the Baltimore City Youth Data Hub’s data management system for aggregation and de–identification.</text> </level> <level label="d"> <text>Immediately after aggregating personally identifiable information in the data management system, the manager shall destroy any copies of the personally identifiable information existing outside the data management system in a manner such that, after aggregation, the manager does not possess or retain any personally identifiable information outside the data management system.</text> </level> <level label="e"> <text>The Baltimore City Youth Data Hub may not use its data management system for queries to produce any personally identifiable information or reports that contain any personally identifiable information.</text> </level> </section> <section article="glg" article_name="Local Government" number="31-107" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <level label="a"> <level label="1"> <text>The manager shall promptly review any query requested by a provider.</text> </level> <level label="2"> <text>The manager may run queries for individuals or entities that are not providers.</text> </level> </level> <level label="b"> <text>Before approving a query, the manager, with assistance from technical experts identified by the executive committee, shall conduct an in–depth review of the proposed query for consistency with authorized purposes, alignment with evidence–based standards for equitable, ethical, and methodologically appropriate inquiries, and assessment of the benefits for and impact on the greater Baltimore City community.</text> </level> <level label="c"> <text>Before providing any data in response to a query, the manager shall obtain written approval from any provider of data to confirm that there is no reasonable basis to believe that de–identified data provided in response to a query could be used by a data recipient to successfully link de–identified data to a particular individual, based on the size or uniqueness of the population under consideration in the query, or otherwise.</text> </level> <level label="d"> <text>The manager shall ensure that the data management system and provided data are secure using security standards and protocols that address, at a minimum, data security and access, security incident and disaster recovery procedures, and recording and monitoring of system activity.</text> </level> <level label="e"> <text>The manager shall maintain appropriate administrative, physical, and technical safeguards that protect privacy, confidentiality, integrity, and availability of any data in compliance with the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies, including:</text> <level label="1"> <text>the required use of de–identified data in data research and reporting;</text> </level> <level label="2"> <text>the required disposition of data that is no longer needed;</text> </level> <level label="3"> <text>providing data security, including the capacity for audit trails;</text> </level> <level label="4"> <text>providing for the performance of regular audits for compliance with data privacy and security standards; and</text> </level> <level label="5"> <text>implementing guidelines and policies that prevent the reporting of other potentially personally identifiable information.</text> </level> </level> <level label="f"> <text>The manager shall ensure that a query of the data management system:</text> <level label="1"> <text>results in disclosure of only aggregated de–identified data or aggregated de–identified data reports to a data recipient; and</text> </level> <level label="2"> <text>does not reveal personally identifiable information to a data recipient.</text> </level> </level> <level label="g"> <text>On request, the manager may provide technical assistance to data recipients regarding data received from the Baltimore City Youth Data Hub.</text> </level> <level label="h"> <level label="1"> <text>The manager and any data recipients may not:</text> <level label="i"> <text>attempt to re–identify de–identified data; or</text> </level> <level label="ii"> <text>disclose, release, or report data in any form that may result in the re–identification of de–identified data.</text> </level> </level> <level label="2"> <text>This subsection may not be construed to interfere with a data recipient’s continued use of or reliance on personally identifiable information provided to the Baltimore City Youth Data Hub.</text> </level> </level> </section> <section article="glg" article_name="Local Government" number="31-108" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <text>Each year, the Baltimore City Youth Data Hub shall publish a report that is available and accessible to the public on:</text> <level label="1"> <text>the implementation of the data management system, including identification of the sources and types of data received by the Baltimore City Youth Data Hub from each provider during the immediately preceding 12 months;</text> </level> <level label="2"> <text>a description of each approved disclosure of data by the Baltimore City Youth Data Hub;</text> </level> <level label="3"> <text>a list of publications and other reports based on the Baltimore City Youth Data Hub data;</text> </level> <level label="4"> <text>recommendations and best practices for enhancement and alignment of data collection and maintenance by providers; and</text> </level> <level label="5"> <text>any other information considered appropriate by the executive committee.</text> </level> </section> <section article="glg" article_name="Local Government" number="31-109" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <level label="a"> <text>A person, whether acting on behalf of the manager or a provider, who obtains, discloses, or uses, or attempts to obtain, disclose, or use identifiable data for a purpose other than aggregation in the Baltimore City Youth Data Hub is guilty of a misdemeanor and on conviction is subject to imprisonment not exceeding 1 year or a fine not exceeding $1,000 or both.</text> </level> <level label="b"> <text>A person, whether acting on behalf of the manager or a provider, is civilly liable to an individual for actual damages, including attorney’s fees and litigation costs, that the court considers appropriate if the court finds by clear and convincing evidence that the person committed a violation of any provision of this title that caused any damage to the individual.</text> </level> </section> <section article="glg" article_name="Local Government" number="31-110" title_number="31" title_name="Baltimore City Youth Data Hub" subtitle_number="1"> <text>Notwithstanding any other provision of law, and except as provided in § 31–109 of this title, a provider may not be civilly or criminally liable for providing identifiable data to the manager for the sole purpose of inclusion in the Baltimore City Youth Data Hub. </text> </section>