§10–1702.

    (a)    (1)    In this section the following words have the meanings indicated.

        (2)    “Governmental entity” means a unit or instrumentality of State or local government.

        (3)    “Personal record” has the meaning stated in § 4–501 of the General Provisions Article.

    (b)    (1)    Subject to paragraph (2) of this subsection, on or before July 1, 2026, each governmental entity, in consultation with the Department of Information Technology, shall develop and publish procedures that prevent the sale and redisclosure of personal records and geolocation data provided or made available by the governmental entity in a way that harms the privacy of residents of the State.

        (2)    The procedures required and published under paragraph (1) of this subsection shall address:

            (i)    any possible contractual limitations on the sale or redisclosure of personal records or geolocation data that a governmental entity may place on a person who receives personal records or geolocation data that are provided or made available by the governmental entity;

            (ii)    considerations regarding:

                1.    the threat to privacy posed by data brokers who utilize personal records or geolocation data for commercial purposes;

                2.    the risk that personal records or geolocation data may be used for purposes other than the purposes for which the personal records or geolocation data were developed or collected; and

                3.    geolocation, genetic, and other sensitive data; and

            (iii)    any other considerations necessary to:

                1.    protect the privacy of residents of the State;

                2.    discourage the development of a secondary commercial market for personal records or geolocation data that are provided or made available by a governmental entity; and

                3.    limit a person who receives personal records or geolocation data that are provided or made available by a governmental entity from selling or redisclosing the data with other persons.

    (c)    On or before July 1, 2026, each governmental entity shall, in accordance with § 2–1257 of this article, submit to the General Assembly a copy of the procedures developed under subsection (b) of this section.