§4–320.

    (a)    (1)    In this section, “telephone solicitation” means the initiation of a telephone call to an individual or to the residence or business of an individual to encourage the purchase or rental of or investment in property, goods, or services.

        (2)    “Telephone solicitation” does not include a telephone call or message:

            (i)    to an individual who has given express permission to the person making the telephone call;

            (ii)    to an individual with whom the person has an established business relationship; or

            (iii)    by a tax–exempt, nonprofit organization.

    (b)    Except as provided in subsections (c) through (f) of this section, a custodian may not knowingly disclose a public record of the Motor Vehicle Administration containing personal information.

    (c)    A custodian shall disclose personal information when required by federal law.

    (d)    (1)    This subsection applies only to the disclosure of personal information for any use in response to a request for an individual motor vehicle record.

        (2)    The custodian may not disclose personal information without written consent from the person in interest.

        (3)    (i)    At any time the person in interest may withdraw consent to disclose personal information by notifying the custodian.

            (ii)    The withdrawal by the person in interest of consent to disclose personal information shall take effect as soon as practicable after it is received by the custodian.

    (e)    (1)    This subsection applies only to the disclosure of personal information for inclusion in lists of information to be used for surveys, marketing, and solicitations.

        (2)    The custodian may not disclose personal information for surveys, marketing, and solicitations without written consent from the person in interest.

        (3)    (i)    At any time the person in interest may withdraw consent to disclose personal information by notifying the custodian.

            (ii)    The withdrawal by the person in interest of consent to disclose personal information shall take effect as soon as practicable after it is received by the custodian.

        (4)    The custodian may not disclose personal information under this subsection for use in telephone solicitations.

        (5)    Personal information disclosed under this subsection may be used only for surveys, marketing, or solicitations and only for a purpose approved by the Motor Vehicle Administration.

    (f)    Notwithstanding subsections (d) and (e) of this section, and subject to § 4–320.1 of this subtitle, a custodian shall disclose personal information:

        (1)    for use by a federal, state, or local government, including a law enforcement agency, or a court in carrying out its functions;

        (2)    for use in connection with matters of:

            (i)    motor vehicle or driver safety;

            (ii)    motor vehicle theft;

            (iii)    motor vehicle emissions;

            (iv)    motor vehicle product alterations, recalls, or advisories;

            (v)    performance monitoring of motor vehicle parts and dealers; and

            (vi)    removal of nonowner records from the original records of motor vehicle manufacturers;

        (3)    for use by a private detective agency licensed by the Secretary of State Police under Title 13 of the Business Occupations and Professions Article or a security guard service licensed by the Secretary of State Police under Title 19 of the Business Occupations and Professions Article for a purpose allowed under this subsection;

        (4)    for use in connection with a civil, an administrative, an arbitral, or a criminal proceeding in a federal, state, or local court or regulatory agency for service of process, investigation in anticipation of litigation, and execution or enforcement of judgments or orders;

        (5)    for purposes of research or statistical reporting as approved by the Motor Vehicle Administration provided that the personal information is not published, redisclosed, or used to contact the individual;

        (6)    for use by an insurer, an insurance support organization, or a self–insured entity, or its employees, agents, or contractors, in connection with rating, underwriting, claims investigating, and antifraud activities;

        (7)    for use in the normal course of business activity by a legitimate business entity or its agents, employees, or contractors, but only:

            (i)    to verify the accuracy of personal information submitted by the individual to that entity; and

            (ii)    if the information submitted is not accurate, to obtain correct information only for the purpose of:

                1.    preventing fraud by the individual;

                2.    pursuing legal remedies against the individual; or

                3.    recovering on a debt or security interest against the individual;

        (8)    for use by an employer or insurer to obtain or verify information relating to a holder of a commercial driver’s license that is required under the Commercial Motor Vehicle Safety Act of 1986 (49 U.S.C. § 31101 et seq.);

        (9)    for use in connection with the operation of a private toll transportation facility;

        (10)    for use in providing notice to the owner of a towed or impounded motor vehicle;

        (11)    for use by an applicant who provides written consent from the individual to whom the information pertains if the consent is obtained within the 6–month period before the date of the request for personal information;

        (12)    for use in any matter relating to:

            (i)    the operation of a Class B (for hire), Class C (funeral and ambulance), or Class Q (limousine) vehicle; and

            (ii)    public safety or the treatment by the operator of a member of the public;

        (13)    for a use specifically authorized by State law, if the use is related to the operation of a motor vehicle or public safety;

        (14)    for use by a hospital to obtain, for hospital security, information relating to ownership of vehicles parked on hospital property;

        (15)    for use by a procurement organization requesting information under § 4–516 of the Estates and Trusts Article for the purposes of organ, tissue, and eye donation;

        (16)    for use by an electric company, as defined in § 1–101 of the Public Utilities Article, but only:

            (i)    information describing a plug–in electric drive vehicle, as defined in § 11–145.1 of the Transportation Article, and identifying the address of the registered owner of the plug–in vehicle;

            (ii)    for use in planning for the availability and reliability of the electric power supply; and

            (iii)    if the information is not:

                1.    published or redisclosed, including redisclosed to an affiliate as defined in § 7–501 of the Public Utilities Article; or

                2.    used for marketing or solicitation; and

        (17)    for use by an attorney, a title insurance producer, or any other individual authorized to conduct a title search of a manufactured home under Title 8B of the Real Property Article.

    (g)    (1)    A person receiving personal information under subsection (e) or (f) of this section may not use or redisclose the personal information for a purpose other than the purpose for which the custodian disclosed the personal information.

        (2)    A person receiving personal information under subsection (d), (e), or (f) of this section may not disclose the personal information to a federal agent or federal agency for the purpose of federal immigration enforcement unless the person is presented with a valid warrant issued by a federal court or a court of this State.

        (3)    A person receiving personal information under subsection (e) or (f) of this section who rediscloses the personal information shall:

            (i)    keep a record for 5 years of the person to whom the information is redisclosed and the purpose for which the information is to be used; and

            (ii)    make the record available to the custodian on request.

    (h)    (1)    The custodian shall adopt regulations to implement and enforce this section.

        (2)    (i)    The custodian shall adopt regulations and procedures for securing from a person in interest a waiver of privacy rights under this section when an applicant requests personal information about the person in interest that the custodian is not authorized to disclose under subsections (c) through (f) of this section.

            (ii)    The regulations and procedures adopted under this paragraph shall:

                1.    state the circumstances under which the custodian may request a waiver; and

                2.    conform with the waiver requirements in the federal Driver’s Privacy Protection Act of 1994 and other federal law.

    (i)    The custodian may develop and implement methods for monitoring compliance with this section and ensuring that personal information is used only for the purposes for which it is disclosed.