In this subtitle the following words have the meanings indicated. “Breach of the security of a system” means the unauthorized acquisition of personally identifiable information maintained by a public institution of higher education that creates a reasonable risk of harm to the individual whose personally identifiable information was subject to unauthorized acquisition. “Breach of the security of a system” does not include: the good faith acquisition of personally identifiable information by an employee or agent of a public institution of higher education for the purposes of the public institution of higher education, provided that the personally identifiable information is not used or subject to further unauthorized disclosure; or personally identifiable information that was secured by encryption or redacted and for which the encryption key has not been compromised or disclosed. “Encryption” means the protection of data in electronic or optical form, in storage or in transit, using a technology that: is certified to meet or exceed the level that has been adopted by the Federal Information Processing Standards issued by the National Institute of Standards and Technology; and renders such data indecipherable without an associated cryptographic key necessary to enable decryption of such data. “Individual” means a natural person. “Legitimate basis” means a public institution of higher education has a contractual need, public interest purpose, business purpose, or legal obligation for processing or that the individual has consented to the processing of the individual’s personally identifiable information by the public institution of higher education. “Personally identifiable information” means any information that, taken alone or in combination with other information, enables the identification of an individual, including: a full name; a Social Security number; a driver’s license number, state identification card number, or other individual identification number; a passport number; biometric information including an individual’s physiological, biological, or behavioral characteristics, including an individual’s deoxyribonucleic acid (DNA), that can be used, singly or in combination with each other or with other identifying data, to establish individual identity; geolocation data; Internet or other electronic network activity information, including browsing history, search history, and information regarding an individual’s interaction with an Internet website, application, or advertisement; and a financial or other account number, a credit card number, or a debit card number that, in combination with any required security code, access code, or password, would permit access to an individual’s account. “Personally identifiable information” does not include data rendered anonymous through the use of techniques, including obfuscation, delegation and redaction, and encryption, so that the individual is no longer identifiable. “Processing” means any operation or set of operations that is performed on personally identifiable information or on a set of personally identifiable information, whether or not by automated means, including collection, recording, organization, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction. “Public institution of higher education” means: the constituent institutions of the University System of Maryland and the University of Maryland Center for Environmental Science; Morgan State University; St. Mary’s College of Maryland; and a community college established under Title 16 of the Education Article. “Reasonable security procedures and practices” means security protections that align with the current standard of care within similar commercial environments and with applicable State and federal laws. “Records” means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form. “System” means an electronic or other physical medium maintained or administered by a public institution of higher education and used on a procedural basis to store information in the ordinary course of the business of the public institution of higher education.

This subtitle does not apply to personally identifiable information that: is publicly available information that is lawfully made available to the general public from federal, State, or local government records; an individual has consented to have publicly disseminated or listed; except for a medical record that a person is prohibited from redisclosing under § 4–302(d) of the Health – General Article, is disclosed in accordance with the federal Health Insurance Portability and Accountability Act; is disclosed in accordance with the federal Family Educational Rights and Privacy Act; is clinical information; or is information related to sponsored research. Compliance with this subtitle does not authorize a public institution of higher education to fail to comply with any other requirements of State or federal law relating to the protection and privacy of personally identifiable information.

Each public institution of higher education shall review and designate systems within the public institution of higher education as systems of record based on the following criteria: the risk posed to individuals by the personally identifiable information processed and stored on the systems; the relationship of the systems to the overall function of the public institution of higher education; and the technical and financial feasibility of implementing privacy controls and services within the system. Each public institution of higher education shall develop and adopt a privacy governance program to govern each system of record that: identifies and documents the purpose of the public institution of higher education in processing personally identifiable information; prohibits the disclosure of personally identifiable information to third parties, other than those third parties processing personally identifiable information on behalf of the public institution of higher education, unless: the individual consents to disclosure of the information; or the public institution of higher education determines that disclosure of the information is in the best interest of the public institution of higher education; requires all agreements entered into with third parties on or after October 1, 2024, to include language requiring the third party to support the privacy governance program of the public institution of higher education; ensures that a third party processing personally identifiable information on behalf of the public institution of higher education acts in accordance with the privacy governance program of the public institution of higher education; takes reasonable steps to ensure that personally identifiable information processed by the public institution of higher education is accurate, relevant, timely, and complete; takes reasonable steps to ensure that requests to access, modify, or delete information and requests to opt out of the sharing of information with third parties are made by the subject of the personally identifiable information or the subject’s agent; takes reasonable steps to limit the personally identifiable information collected to that information necessary to address the purpose of the collection; implements a process to provide individuals with access to the personally identifiable information relating to the individual held and processed by the public institution of higher education; provides individuals with a process to request a correction to personally identifiable information relating to the individual; in the case of a disagreement between the public institution of higher education and an individual over the accuracy of personally identifiable information relating to the individual, provides a means for the individual to document the disagreement and produce the documentation of the disagreement whenever the disputed information is produced; provides a process for individuals to request the deletion of personally identifiable information relating to the individual that the public institution of higher education does not have a legitimate basis to process; provides a process for individuals to opt out of sharing personally identifiable information relating to the individual with third parties, if the public institution of higher education would not have a legitimate basis to process the information; and provides a process for the public institution of higher education to consider requests made under this subsection that allows the public institution of higher education to deny a request if the public institution of higher education reasonably concludes it has a legitimate basis for processing the personally identifiable information or if the request is not technically or financially feasible. Each public institution of higher education shall develop and adopt an information security and risk management program for the protection of personally identifiable information that shall: implement reasonable security procedures and practices, compatible with applicable federal and State standards and guidelines, to ensure that the risk to the confidentiality, integrity, and availability of all personally identifiable information is properly managed; be periodically assessed by a third party assessor with expertise in information security; be approved by an appropriate senior official of the public institution of higher education with authority to accept risk for the public institution of higher education; require that contracts with third parties include provisions to ensure that third parties that process personally identifiable information on behalf of the public institution of higher education maintain appropriate security controls commensurate with the risk posed to the individuals by the personally identifiable information; and ensure that any breaches by the public institution of higher education or a third party acting on behalf of the public institution of higher education are properly documented, investigated, and reported to appropriate authorities within the public institution of higher education. Each public institution of higher education shall publish a privacy notice on the website of the public institution of higher education that is: written in plain language; and directly accessible from the homepage and any of the webpages of the public institution of higher education that are used to collect personally identifiable information. The notice published under paragraph (1) of this subsection shall include: the types of personally identifiable information collected by the public institution of higher education; the purpose of the collection, use, and sharing of personally identifiable information by the public institution of higher education; and the processes by which an individual may request: to have personally identifiable information related to the individual corrected; to have personally identifiable information related to the individual deleted; information on the sharing of personally identifiable information by the public institution of higher education with third parties, including a listing of the third parties, a listing of the information shared, and the purpose of sharing the information; and to opt out of the sharing of personally identifiable information with a third party. Each public institution of higher education shall ensure access controls are in place to address any security risks posed by providing the notice required under this subsection. When a public institution of higher education is destroying records of an individual that contain personally identifiable information of the individual, the public institution of higher education shall take reasonable steps to protect against unauthorized access to or use of the personally identifiable information, taking into account: the sensitivity of the records; the nature of the public institution of higher education and its operations; the costs and benefits of different destruction methods; and available technology. Each public institution of higher education shall develop and adopt a policy establishing an appropriate remedy for individuals whose personally identifiable information has been affected by a breach.

If a public institution of higher education collects personally identifiable information of an individual and discovers or is notified of a breach of the security of a system, the public institution of higher education shall conduct in good faith a reasonable and prompt investigation to determine whether the unauthorized acquisition of personally identifiable information of the individual has occurred. If, after the investigation is concluded, the public institution of higher education determines that a breach of the security of the system has occurred, the public institution of higher education or a third party, if authorized under a written contract or agreement with the public institution of higher education, shall: notify the individual of the breach; and notify the Chief Information Officer of the public institution of higher education of the breach. A notification required under paragraph (1) of this subsection shall include, to the extent possible, a description of the categories of personally identifiable information that were, or are reasonably believed to have been, acquired by an unauthorized person, including which of the elements of personally identifiable information were, or are reasonably believed to have been, acquired. If the public institution of higher education determines that a breach of the security of the system has occurred involving the personally identifiable information of 1,000 or more individuals, the public institution of higher education shall post a notice on the same webpage as the privacy notice website of the public institution of higher education: describing the breach; and that remains publicly available on the website for at least 1 year from the date on which notice was sent to individuals affected by the breach.