Maryland State Archives Privacy Policy
State Government Article § 10-1702
Effective Date: July 1, 2026
I. Purpose
The Maryland State Archives ("Archives") establishes these procedures pursuant to Maryland State Government Article § 10-1702 to prevent the sale and redisclosure of personal records and geolocation data provided or made available by the Archives in a manner that harms the privacy of Maryland residents.
These procedures are intended to protect the privacy of individuals whose personal records or geolocation data may be collected, maintained, processed, or otherwise made available through Archives programs, facilities, websites, applications, electronic services, research services, and other official activities.
The Archives shall administer these procedures in consultation with the Maryland Department of Information Technology (DoIT), consistent with applicable State and federal law, State information security requirements, records-management requirements, contractual obligations, and the Maryland Public Information Act.
II. Scope
These procedures apply to personal records and geolocation data provided or made available by the Maryland State Archives, including information collected through:
- Archives websites and online services;
- Online registration and research services;
- Electronic forms and communications;
- Applications and systems operated by or on behalf of the Archives;
- Visitor and facility registration systems;
- Services provided by contractors, vendors, or other third parties on behalf of the Archives; and
- Other governmental activities through which the Archives provides or makes available personal records or geolocation data.
These procedures do not restrict access to or disclosure of records when disclosure is required or authorized by applicable law, including the Maryland Public Information Act, applicable records-management requirements, court orders, subpoenas, or other lawful governmental authority.
III. Prohibition on Sale of Personal Records and Geolocation Data
The Maryland State Archives does not sell personal records or geolocation data provided or made available to the Archives.
The Archives shall not knowingly provide or make available personal records or geolocation data to a person for the purpose of establishing, facilitating, or supporting a commercial market for that information in a manner that harms the privacy of Maryland residents.
The Archives shall take reasonable measures to prevent persons receiving personal records or geolocation data from the Archives from selling that information or using it for unauthorized commercial purposes.
IV. Redisclosure of Personal Records and Geolocation Data
The Archives shall limit the redisclosure of personal records and geolocation data provided or made available by the Archives to circumstances authorized by law or necessary to perform an authorized governmental function.
Where the Archives provides personal records or geolocation data to another governmental entity, contractor, service provider, or other authorized recipient, the Archives shall consider whether restrictions on further disclosure or use are appropriate based on the nature of the information, the purpose for which it is provided, and applicable legal requirements.
Recipients may be prohibited from selling, commercially exploiting, or redisclosing the information except when such activity is expressly authorized or required by law.
V. Contractual Restrictions
When the Archives contracts with a third party that may receive, access, process, maintain, or otherwise handle personal records or geolocation data on behalf of the Archives, the applicable contract or data use agreement shall include appropriate requirements concerning, as applicable:
- The authorized purpose for which the information may be collected, accessed, used, or processed;
- Restrictions on the sale or redisclosure of personal records and geolocation data;
- Requirements concerning the protection and security of the information;
- Confidentiality and nondisclosure obligations;
- Restrictions on the use of information for advertising, marketing, profiling, or other unauthorized commercial purposes;
- Requirements for appropriate handling, retention, and destruction of information;
- Restrictions on subcontractors and other persons receiving access to the information; and
- Requirements for reporting suspected unauthorized access, use, disclosure, sale, or redisclosure.
The Archives shall consider contractual limitations necessary to prevent a recipient from creating a secondary commercial market for personal records or geolocation data provided or made available by the Archives.
VI. Data Brokers and Secondary Commercial Uses
The Archives recognizes the privacy risks associated with data brokers and other entities that acquire, aggregate, analyze, sell, license, or otherwise commercially exploit personal records or geolocation data.
The Archives shall consider the potential for personal records or geolocation data to be obtained by a data broker or other commercial entity when determining whether and how information may be provided to a third party.
The Archives shall take reasonable measures to discourage the development of a secondary commercial market for personal records or geolocation data provided or made available by the Archives.
VII. Purpose Limitation
Personal records and geolocation data collected or maintained by the Archives shall be used for the purpose for which the information was collected or otherwise made available, or for another purpose authorized or required by law.
The Archives shall consider the risk that information may be used for purposes unrelated to the purpose for which it was collected or developed.
When evaluating the disclosure or sharing of information, the Archives may consider:
- The purpose for which the information was originally collected;
- The sensitivity of the information;
- Whether the proposed use is consistent with the Archives' governmental functions;
- Whether the proposed recipient requires the information to perform an authorized function;
- The potential privacy impact on Maryland residents; and
- Whether reasonable contractual, technical, or administrative safeguards can mitigate identified risks.
VIII. Geolocation and Other Sensitive Information
The Archives recognizes that geolocation information may present heightened privacy risks, particularly when it can be associated with an identifiable individual or used to determine a person's movements, activities, residence, workplace, or other sensitive information.
The Archives shall limit the collection, use, access, and disclosure of geolocation data to legitimate governmental purposes and shall consider whether the collection or disclosure of such information is necessary and appropriate.
Where feasible and appropriate, the Archives may use aggregated, anonymized, or otherwise de-identified information when individual-level information is not necessary to accomplish the intended governmental purpose.
The Archives shall also consider the privacy risks associated with other sensitive information, including information that may reveal particularly sensitive characteristics or circumstances of an individual.
IX. Website and Online Services
Archives websites may automatically collect technical information associated with a user's visit, including IP address, browser and operating system information, date and time of access, pages visited, referring website information, and other technical information necessary to operate and secure the website.
The Archives may use temporary cookies, session variables, or similar technologies to support website functionality, maintain user sessions, improve navigation, monitor system performance, and protect Archives systems.
Where such information constitutes personal records or geolocation data subject to § 10-1702, the Archives shall handle the information in accordance with these procedures and applicable law.
The Archives does not sell personal information or geolocation data collected through its websites.
X. Public Records and the Maryland Public Information Act
Nothing in these procedures shall be interpreted to prohibit a disclosure that is required or authorized by Maryland law.
Records maintained by the Maryland State Archives may be subject to the Maryland Public Information Act, Md. Code Ann., General Provisions Article, § 4-101 et seq., and other applicable State and federal laws.
The Archives shall evaluate requests for access to records in accordance with applicable law. Information that is otherwise subject to disclosure under law is not made confidential solely by these procedures.
Where an applicable law provides an exemption or other protection from disclosure, the Archives shall apply that protection as required by law.
XI. Records Retention and Disposition
Personal records and geolocation data shall be retained and disposed of in accordance with applicable State records-retention schedules, archival requirements, information technology requirements, contractual obligations, and State and federal law.
Nothing in these procedures requires the destruction of records that are required to be retained or preserved as permanent records by the Maryland State Archives.
XII. Security and Access Controls
The Archives shall maintain reasonable administrative, technical, and physical safeguards appropriate to the nature and sensitivity of personal records and geolocation data maintained by the agency.
Access to personal records and geolocation data shall be limited, as appropriate, to authorized employees, contractors, service providers, or other persons with a legitimate governmental need for access.
The Archives shall work with DoIT and other appropriate State entities to address applicable cybersecurity, privacy, and information security requirements.
XIII. Unauthorized Sale or Redisclosure
The Archives shall take appropriate action when it becomes aware that personal records or geolocation data provided or made available by the Archives have been sold, redisclosed, or used in a manner that violates applicable law, contractual requirements, or these procedures.
Depending on the circumstances, corrective action may include:
- Restricting or terminating access;
- Requiring corrective measures by a recipient or contractor;
- Reviewing or modifying contractual requirements;
- Notifying appropriate State officials or agencies;
- Referring the matter for investigation; and
- Taking other action authorized or required by law.
XIV. Review and Updates
The Archives shall periodically review these procedures and update them as necessary to reflect changes in applicable law, State policies, technology, contractual practices, and the Archives' collection or use of personal records and geolocation data.
The Archives shall consult with the Department of Information Technology as required by State Government Article § 10-1702.
XV. Questions
Questions regarding these procedures or the Maryland State Archives' collection, use, disclosure, retention, or protection of personal records and geolocation data may be directed to the Maryland State Archives. All queries regarding this document should be directed to the MSA Helpdesk at msa.helpdesk@maryland.gov.
XVI. Authority
These procedures are adopted pursuant to:
- Maryland State Government Article § 10-1702;
- Maryland General Provisions Article § 4-501 et seq.;
- Maryland Public Information Act, Md. Code Ann., General Provisions Article § 4-101 et seq.;
- Applicable State records-management requirements;
- Applicable State information security and privacy requirements; and
- Other applicable State and federal law.
This web site is presented for reference purposes under the doctrine of fair use. When this material is used, in whole or in part, proper citation and credit must be attributed to the Maryland State Archives. PLEASE NOTE: The site may contain material from other sources which may be under copyright. Rights assessment, and full originating source citation, is the responsibility of the user.