§26–401.

    (a)    (1)    In this section the following words have the meanings indicated.

        (2)    “Access information” means a user name, a password, log–in information, an account name, or any other security information that protects access to a personal electronic account.

        (3)    “Institution of postsecondary education” has the meaning stated in § 10–101(i) of this article.

        (4)    (i)    “Personal electronic account” means an account created via an electronic medium or a service that allows users to create, share, or view user–generated content, including uploading or downloading videos or still photographs, blogs, video blogs, podcasts, messages, electronic mail, Internet website profiles or locations, or any other electronic information.

            (ii)    “Personal electronic account” does not include an account that is opened on behalf of, or owned or provided by, an institution of postsecondary education.

        (5)    “Student” includes an individual who is a participant, trainee, or student in an organized course of study or training offered by an institution of postsecondary education.

    (b)    Subject to subsection (c) of this section, an institution of postsecondary education may not:

        (1)    Require, request, suggest, or cause a student, an applicant, or a prospective student to grant access to, allow observation of, or disclose information that allows access to or observation of the individual’s personal electronic account;

        (2)    Compel a student, an applicant, or a prospective student, as a condition of acceptance or participation in curricular or extracurricular activities, to:

            (i)    Add to the list of contacts associated with a personal electronic account any individual, including a coach, a teacher, an administrator, another employee of the institution of postsecondary education, or a volunteer; or

            (ii)    Change the privacy settings associated with a personal electronic account;

        (3)    Take any action or threaten to take any action to discharge, discipline, prohibit from participating in curricular or extracurricular activities, or otherwise penalize a student as a result of the student’s refusal to:

            (i)    Grant access to, allow observation of, or disclose any information that allows access to or observation of a personal electronic account;

            (ii)    Add any individual to the list of contacts associated with a personal electronic account; or

            (iii)    Change the privacy settings associated with a personal electronic account; or

        (4)    Fail or refuse to admit an applicant as a result of the applicant’s refusal to:

            (i)    Grant access to, allow observation of, or disclose any information that allows access to or observation of a personal electronic account;

            (ii)    Add any individual to the list of contacts associated with a personal electronic account; or

            (iii)    Change the privacy settings associated with a personal electronic account.

    (c)    This section may not be construed to:

        (1)    Prohibit an institution of postsecondary education from requesting or requiring a student to disclose access information to allow the institution of postsecondary education to gain access to an electronic account:

            (i)    Opened at the institution of postsecondary education’s behest; or

            (ii)    Provided by the institution of postsecondary education;

        (2)    Prohibit or restrict an institution of postsecondary education from viewing, accessing, or utilizing information about a student, an applicant, or a prospective student that:

            (i)    Can be obtained without access information;

            (ii)    Is publicly accessible; or

            (iii)    Is available to the institution of postsecondary education as the result of actions undertaken independently by the student;

        (3)    Create a duty requiring an institution of postsecondary education to search or monitor the activity of a personal electronic account;

        (4)    Make an institution of postsecondary education liable for failing to request or require a student, an applicant, or a prospective student to grant access to, allow observation of, or disclose information that allows access to or observation of the individual’s personal electronic account;

        (5)    Prohibit a student, an applicant, or a prospective student from allowing an athletic coach or administrator to view the student’s, applicant’s, or prospective student’s publicly accessible communications; or

        (6)    Apply to:

            (i)    A suspected criminal activity investigation into the publicly accessible communications of a student, an applicant, or a prospective student that is performed by a public safety department or police agency of an institution of postsecondary education; or

            (ii)    An investigation, an inquiry, or a determination relating to the publicly accessible communications of a student, an applicant, or a prospective student that is conducted in accordance with the health or public safety administration assessment policy or protocol of an institution of postsecondary education.

    (d)    Notwithstanding any other provision of this section, the governing board of an institution of postsecondary education may adopt a policy authorizing an employee of the institution of postsecondary education to request a student, in order to complete an academic or career–based activity, to create a generic personal electronic account.

    (e)    (1)    Subject to paragraph (2) of this subsection, an individual who is the subject of a violation of any provision of this section may:

            (i)    Bring a civil action to enjoin the violation or for damages;

            (ii)    Add a claim for damages to an action seeking injunctive relief; and

            (iii)    Recover not more than $1,000 in damages plus reasonable attorney’s fees and court costs.

        (2)    An individual may not bring an action for damages or add a claim for damages to an action seeking injunctive relief under this section until at least 60 days after making a written demand of the alleged violator for not more than $1,000 that:

            (i)    Includes reasonable documentation of the violation; and

            (ii)    Is served in the manner provided for service of process in a civil action under the Maryland Rules or by certified mail to the residence or principal office or place of business of the alleged violator.

        (3)    An action under this subsection may be brought in the District Court for the county in which:

            (i)    The alleged violation occurred; or

            (ii)    The alleged violator resides or has a principal office or place of business.

    (f)    It is an affirmative defense to any claim under this section that the institution of postsecondary education acted to comply with the requirements of a federal or State law.