In this subtitle the following words have the meanings indicated. “Encryption” means the protection of data in electronic or optical form, in storage or in transit, using a technology that: is certified to meet or exceed the level that has been adopted by the Federal Information Processing Standards issued by the National Institute of Standards and Technology; and renders such data indecipherable without an associated cryptographic key necessary to enable decryption of such data. “Personal information” means an individual’s first name or first initial and last name, personal mark, or unique biometric or genetic print or image, in combination with one or more of the following data elements: a Social Security number, an Individual Taxpayer Identification Number, a passport number, or other identification number issued by the United States Government; a driver’s license number, state identification card number, or other individual identification number issued by a unit; a financial or other account number, a credit card number, or a debit card number that, in combination with any required security code, access code, or password, would permit access to an individual’s account; a username or e–mail address in combination with a password or security question and answer that permits access to an individual’s email account; genetic and health–related data, including mental health, substance use disorder, and disability; or sensitive data, as defined in § 14–4701 of the Commercial Law Article. “Personal information” does not include a voter registration number. “Reasonable security procedures and practices” means data security procedures and practices developed, in good faith, and set forth in a written information security policy. “Records” means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form. “Unit” means: an executive agency, or a department, a board, a commission, an authority, a unit, or an instrumentality of the State; or a county, municipality, bi–county, regional, or multicounty agency, county board of education, public corporation or authority, or any other political subdivision of the State. “Unit” does not include a public institution of higher education.