Law / United States / 
Maryland
Protection of personally identifiable information by public institutions of higher education: privacy governance program, individual requests, security program and privacy notice
Md. Code Ann., State Gov't §§ 10-13A-01 to 10-13A-03(e)
In force since .
A data subject rights rule binding government bodies.
- Obligation class
- Governance, Security, Disclosure
- Audit expectation
- periodic
- Who audits it
- Independent third party
What it requires
- If you are a public institution of higher education, review and designate your systems as systems of record based on the risk posed to individuals by the personally identifiable information they hold, their relationship to your overall function, and the feasibility of implementing privacy controls (State Gov't 10-13A-03(a)).
- Develop and adopt a privacy governance program for each system of record that documents your purpose in processing personally identifiable information, prohibits disclosure to third parties other than those processing it on your behalf unless the individual consents or you determine disclosure is in your best interest, and limits collection to what is necessary for the purpose (State Gov't 10-13A-03(b)(1), (2) and (7)).
- Include in every agreement with a third party entered into on or after language requiring the third party to support your privacy governance program, and ensure a third party processing information for you acts in accordance with it (State Gov't 10-13A-03(b)(3) and (4)).
- Give individuals a process to access, to request correction of, to request deletion of, and to opt out of sharing with third parties, personally identifiable information about them, and a means to document a disagreement over accuracy; you may deny a request if you reasonably conclude you have a legitimate basis for processing or the request is not technically or financially feasible (State Gov't 10-13A-03(b)(8) to (13)).
- Adopt an information security and risk management program that implements reasonable security procedures and practices, is periodically assessed by a third party assessor with expertise in information security, is approved by a senior official with authority to accept risk, requires appropriate security controls in contracts with third parties that process information for you, and ensures breaches are documented, investigated and reported to appropriate authorities within the institution (State Gov't 10-13A-03(c)).
- Publish on your website a plain-language privacy notice, directly accessible from your homepage and from any page used to collect personally identifiable information, that states the types of information collected, the purpose of its collection, use and sharing, and how an individual may request correction, deletion, information about sharing with third parties, or an opt-out, and keep access controls in place for the notice (State Gov't 10-13A-03(d)).
- When you destroy records that contain an individual's personally identifiable information, take reasonable steps to protect against unauthorized access to or use of it, taking into account the sensitivity of the records, the nature of the institution and its operations, the costs and benefits of different destruction methods and available technology (State Gov't 10-13A-03(e)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What record it asks for
Logging duty
Section 10-13A-03(c)(5) requires the information security and risk management program to ensure that any breach by the institution or a third party acting for it is properly documented, investigated and reported to appropriate authorities within the institution. The clause names no content, retention period or outside recipient, so none is coded.
- Kind
- Explicit
- As of
- Provision
- Md. Code Ann., State Gov't § 10-13A-03(c)(5)
- Trigger
- security_incident
What this law does
A public institution of higher education is a constituent institution of the University System of Maryland or the University of Maryland Center for Environmental Science, Morgan State University, Saint Mary's College of Maryland, or a community college established under Title 16 of the Education Article. Personally identifiable information is any information that, taken alone or in combination with other information, enables the identification of an individual.
The subtitle does not apply to personally identifiable information that is publicly available government-record information, that an individual has consented to have publicly disseminated, that is disclosed in accordance with the federal Health Insurance Portability and Accountability Act or the federal Family Educational Rights and Privacy Act, that is clinical information, or that is information related to sponsored research.
Each public institution of higher education must review and designate its systems as systems of record based on the risk to individuals, the relationship of the system to the institution's overall function, and the feasibility of implementing privacy controls. Each must develop and adopt a privacy governance program to govern each system of record.
The program must prohibit disclosure of personally identifiable information to third parties, other than those processing it on the institution's behalf, unless the individual consents or the institution determines that disclosure is in its best interest. Agreements with third parties entered into on or after must include language requiring the third party to support the privacy governance program.
The program must give individuals a process to request deletion of personally identifiable information that the institution does not have a legitimate basis to process. The institution may deny a request if it reasonably concludes it has a legitimate basis for processing the information or the request is not technically or financially feasible.
Each institution must also adopt an information security and risk management program that is periodically assessed by a third party assessor with expertise in information security. Each institution must publish a plain-language privacy notice on its website that is directly accessible from its homepage and from any webpage used to collect personally identifiable information.
When destroying records that contain an individual's personally identifiable information, the institution must take reasonable steps to protect against unauthorized access to or use of the information. House Bill 1122 of 2020, which added the subtitle, took effect on . House Bill 1122 was enacted as Chapter 429 of the Acts of 2020.
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .