In this section the following words have the meanings indicated. “Governmental entity” means a unit or instrumentality of State or local government. “Personal record” has the meaning stated in § 4–501 of the General Provisions Article. “Sensitive data” has the meaning stated in § 14–4701 of the Commercial Law Article. Subject to paragraph (2) of this subsection, on or before July 1, 2026, each governmental entity, in consultation with the Department of Information Technology, shall develop and publish procedures that prevent the sale and redisclosure of personal records and sensitive data provided or made available by the governmental entity in a way that harms the privacy of residents of the State. The procedures required and published under paragraph (1) of this subsection shall address: any possible contractual limitations on the sale or redisclosure of personal records or sensitive data that a governmental entity may place on a person who receives personal records or sensitive data that are provided or made available by the governmental entity; considerations regarding: the threat to privacy posed by data brokers who utilize personal records or sensitive data for commercial purposes; and the risk that personal records or sensitive data may be used for purposes other than the purposes for which the personal records or sensitive data were developed or collected; and any other considerations necessary to: protect the privacy of residents of the State; discourage the development of a secondary commercial market for personal records or sensitive data that are provided or made available by a governmental entity; and limit a person who receives personal records or sensitive data that are provided or made available by a governmental entity from selling or redisclosing the data with other persons. On or before July 1, 2026, each governmental entity shall, in accordance with § 2–1257 of this article, submit to the General Assembly a copy of the procedures developed under subsection (b) of this section.