Maryland law restricts data sales and access for immigration enforcement

Controllers may not sell personal data for certain immigration-enforcement purposes, and they may not comply with some immigration-related subpoenas or cooperation requests. These rules cover controllers and processors handling consumers’ personal data, including sales to government units and requests involving immigration enforcement. A sale is barred when the controller knows or should know that the purchaser seeks the data for immigration enforcement. A controller may not knowingly sell data to a government unit that engaged in or supported civil immigration enforcement during the six months before the sale. The limits on subpoenas and cooperation requests do not apply when a federal or state court issues a valid warrant that clearly describes the data to be accessed. The limits also apply to certain requests from government units or law enforcement agencies that recently engaged in or supported civil immigration enforcement. These rules take effect July 1, 2026.

Public-record custodians must take reasonable steps to identify immigration-enforcement requests and deny covered access unless the requester presents a valid, specific court warrant. The rule covers personal information, individual photographs, and facial-recognition searches of public records, including records held by state agencies and political subdivisions. A warrant must be issued by a federal or State court and must clearly describe the record to be accessed. Custodians must adopt reasonable rules to prevent unauthorized disclosure or inspection of public records. Certain people who receive Motor Vehicle Administration personal information may not disclose it for immigration enforcement without a valid federal or State court warrant. Specified agencies must adopt procedures to carry out and enforce these requirements. These requirements take effect July 1, 2026; the required annual agency reports continue to cover the preceding calendar year.

Database and message-switching-system operators must verify users, deny certain immigration-enforcement access without a warrant, and adopt implementation rules; governmental entities must publish privacy procedures for sensitive data. The access rules cover law-enforcement databases and platforms that route electronic queries and responses between agencies and databases. The procedure rules cover Maryland State and local governmental entities handling personal records and data containing sensitive attributes. A person seeking access for immigration enforcement must present a valid federal or State court warrant. Without such a warrant, the user must provide identifying and contact information and swear that the access is not for immigration enforcement. By July 1, 2026, governmental entities must develop procedures to prevent harmful sale or redisclosure of covered records and sensitive data. Those procedures must address contract limits, privacy risks, improper secondary uses, and limits on resale or redisclosure, and entities must send them to the General Assembly. The access and rulemaking requirements take effect July 1, 2026. Governmental entities must develop and submit the required procedures by July 1, 2026.