Privacy Notice
1. Introduction
Protecting Your Information
The Maryland State Department of Education ("MSDE" or "we") works to protect your Personal Information. This includes keeping it private, accurate and secure. We do this by using fair information privacy rules.
What This Page Covers
This page explains:
- How we collect your personal information
- How we use it
- How we protect it
- How we share it
We are responsible for protecting any personal information we control. This notice applies to all Personal Information we collect, use, and share through our websites, in-person services, and written correspondence.
2. What Personal Information We Collect
We collect and use certain personal information about you. Here’s what we gather:
From Local Education Agencies (LEAs):
- Student information such as names, contact details, government‑issued identifiers, demographic data, academic performance, disciplinary records, and disability‑related information.
- Staff information including names, contact details, government‑issued identifiers, and demographic characteristics.
From Educators, Child Care Providers, and Applicants:
- Names, contact details, government‑issued identifiers, and demographic characteristics for program registration, training, or work.
- Mandatory biometric fingerprinting results and health-related information required for licensing or employment.
From Website Users:
- Demographic information, preferred language for reading web contents, and viewing location.
From Maryland Public Information Act Communications:
- Names, contact details, and government issued identifiers when appropriate to identify the subject of requested records
From Vocational Rehabilitation (DORS) Clients:
- Names, contact details, government‑issued identifiers, financial information for cost‑sharing eligibility, and health‑related records necessary to determine program eligibility and appropriate employment supports.
This information is collected in accordance with applicable State and federal laws. These include various titles within the Education, Family Law, Criminal Procedure, and State Government Articles of the Annotated Code of Maryland, as well as the Family Educational Rights and Privacy Act (FERPA), the Every Student Succeeds Act (ESSA), the Individuals with Disabilities Education Act (IDEA) , the Child Care and Development Block Grant Act (CCDBGA), the Rehabilitation Act, and the Workforce Innovation and Opportunity Act (WIOA).
3. Why We Collect and Process Your Personal Information
- Why We Collect Your Information
We collect, use, and share your personal information to administer public education along with related services and communications, professional licensing, and state support programs. We also collect financial or sensitive data to complete specific transactions you request.
Sometimes, the reason we need your data is obvious. For example, if you give us your name and payment information for an application, we assume you agree to let us use it for that service. When we collect your personal information, we may also offer you chances to apply for other helpful State programs.
- How We Use Your Information
We collect and use your personal information strictly as necessary to execute our official duties, administer public programs, and comply with state and federal laws.
What We Do with Your Information
MSDE collects and uses personal information only for the specific purposes described below.
- Administer Public Education and Accountability: We use student and staff data from Local Education Agencies (LEAs) to verify enrollment and academic progression, fulfill state and federal reporting mandates (including under ESSA), measure school performance, distribute public education funding, manage employment registries, and coordinate training services for LEA staff, educators, and child care providers.
- Govern Educator Licensure: We collect and process applicant and licensee data to vet, credential, and train educators, manage certification renewals, and maintain regulatory communications with Maryland educators.
- Regulate Child Care Services: We collect provider and applicant information to administer licensing, safety monitoring, credentialing, background clearances, and scholarship assistance, in compliance with state and federal child safety requirements.
- Deliver Vocational Rehabilitation: Our Division of Rehabilitation Services (DORS) collects clinical and financial data to evaluate eligibility, coordinate transition and independent living services, and monitor individualized training and employment plans for individuals with disabilities.
- Determine and Validate Benefit Eligibility: We process financial, historical, or sensitive information only to evaluate and verify your qualification for the specific public benefits, services, or accommodations you have requested.
- Legal and Regulatory Compliance: We use information to meet state and federal legal requirements, support institutional audits, conduct mandated compliance investigations, and detect and prevent fraudulent activity and cybersecurity threats. We also use information to improve our public programs and operations.
- Other Opportunities: We may use your information to inform you about relevant programs, resources, or services from other government agencies that could provide additional assistance.
- Service Improvements: We use personal information to analyze and enhance State services, including website usage, to improve communications, operational efficiency, and educational effectiveness, consistent with applicable law.
- Sharing Information: Where permitted by law, we may share information with other government agencies or authorized entities for the purposes described above, for example, secure data sharing with state or federal authorities for program evaluations, audits, or to satisfy a lawful subpoena, in compliance with statutes such as the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. Any additional cross-agency data sharing beyond those purposes will occur only with your express, written consent. This consent requirement applies only to disclosures outside the purposes listed above; Separate consent for the purposes described in this section is not required. We do not sell, lease, or share your information for secondary marketing or promotional purposes.
4. Knowledge and Consent
We will let you know and get your consent before we gather, use, or share your information, unless the law lets or requires us do it without asking. We will tell you why we need your information before or when we ask for it. When you provide information like your address or payment details as part of an application, we consider it your permission to use that data for that specific purpose.
Choosing to give us your information is up to you. But without it, we may not be able to provide the services you need. We will not make you agree unless the law requires it or it is necessary for the service. When you sign a form or select "I agree" online, it means you officially allow us to use your information.
5. Limiting Collection
We have rules to limit the data we collect. We only gather the personal information needed to do our job.
If we get your information from another source, like the government or a verification company, we use legal agreements. This ensures we only get what the law or contract requires.
6. Use, Disclosure, and Retention of Personal Information
Use of Your Data: We use your data only for the purpose it was first collected, unless you give permission, for legitimate government purposes, or the law demands it. We keep your information only as long as needed to complete that task, following State record timelines.
Sharing Your Data: We might share your data with contractors who help us with your requests. These contractors must sign strict contracts to keep your data secure and confidential. We never sell your personal information to anyone.
Anonymizing Your Data: To better serve you, we might remove your name and details to make your data anonymous. We share this “anonymized” data with other Maryland State agencies for research and to improve services. We use advanced tools to block your identity, so agencies can study trends without seeing your personal details.
Public Access to Records: Government records may be open to the public if required by the Maryland Public Information Act. However, Maryland law has safety exceptions to keep your personal details from being released to the public.
7. Accuracy
We make sure your information is correct, complete, and current. We might ask you to verify your details.
Under the Maryland Public Information Act, you can ask us to fix mistakes, update old facts, or add missing information to your records. It is your job to provide us with accurate details and let us know when your information changes.
8. Safeguarding Personal Information
Protecting Your Data: State and federal laws require us to keep your personal information safe. For instance, student data is protected under the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g), and under Maryland law, including the Maryland Student Data Privacy Act (Md. Code Ann., Educ. § 4-131), the State Government Article § 10-1301 et seq., and the State of Maryland's Information Security Policy. We use administrative, technical, and physical safeguards designed to fit the sensitivity of the data we collect, the services we provide, and how we operate. These safeguards include:
- Encryption – converting data into a secure, unreadable format to prevent unauthorized access.
- Access controls – strictly limiting access to authorized individuals who have a legitimate educational or administrative interest in the data.
- Secure storage – maintaining data in protected physical and electronic environments.
- Retention schedules – retaining records only as long as necessary, in accordance with approved schedules.
- Vendor Requirements – Where MSDE shares Personal Information with third-party service providers or educational technology vendors, we require a signed data privacy or data sharing agreement. These agreements strictly specify permitted data uses, safety frameworks, and mandatory data destruction or return obligations.
What Happens if Someone Gains Unauthorized Accesses to Your Data: If someone accesses your information without proper authority, we will promptly investigate the incident. We will notify you about it according to the law and our privacy incident plan.
9. Privacy Notice Changes
We check and update this notice at least once a year to keep up with new laws, technology and best practices. We will let you know about any big changes by posting the new rules with a new "Last Updated" date.
10. Access to Personal Information
Requesting Your Information: You can ask us to share what information we have about you and how it is used. You have the right to request to review it. You can ask us to change or delete data you provided directly, depending on State laws. If the data came from another source, you must contact that source to change their files.
What We Can't Show You: Sometimes, we cannot show you certain files because of the law. We cannot show you records that include:
- Personal data about other people;
- Files restricted by police or law enforcement; or
- Information covered by official security rules.
If We Deny Your Request: If we need to deny your request, we will explain why in writing and keep a record of it.
11. Artificial Intelligence
As Technology advances, you may interact with Generative Artificial Intelligence (AI) directly (such as through a public-facing Chatbot) or indirectly when we utilize automated systems or algorithms to process your Personal Information. This section describes AI systems operated directly by MSDE, such as any AI tools used on this website or in MSDE's own administrative processes. Local school systems adopt and govern their own classroom and administrative AI tools (including adaptive learning platforms, writing- and assessment-scoring tools, and AI-enabled tutoring or translation tools) under separate privacy and data-sharing practices consistent with the Maryland Student Data Privacy Act of 2015. Contact your local school system for information about AI tools used in your child's classroom.
We will maintain strict transparency during direct AI interactions. Where a direct AI interaction, such as a chatbot, is intended for use by a student, MSDE applies additional safeguards consistent with FERPA and, where applicable, the Children's Online Privacy Protection Act (COPPA), including limiting the collection and retention of any information the student provides during the interaction. We follow the State of Maryland’s Responsible AI Policy and related guidelines to ensure your privacy is protected.
Under the State's Responsible AI Policy, any AI system that processes Confidential or Restricted data, which includes student personally identifiable information (PII), is classified as “High-Risk” and may be used only after a documented AI Risk Assessment, implementation of risk mitigation measures, and ongoing monitoring. MSDE applies this standard to any AI system it operates that processes student or other sensitive Personal Information.
Consistent with the State's Responsible AI Policy, MSDE does not use, and does not permit its contractors to use AI for real-time or covert biometric identification, emotion analysis, or social scoring of students. Where MSDE-associated testing or proctoring tools include any automated monitoring features, those features are reviewed against this prohibition before use.
Where a third-party vendor's AI system processes student or other Personal Information on MSDE's behalf, that vendor is subject to the same data privacy or data-sharing agreement requirements described in Section 8, including limits on permitted use and data retention.
12. How to Contact Us
You may direct any questions about this Privacy Notice, requests to exercise your data rights or complaints about our privacy practices by contacting the designated MSDE Privacy Officer.
Inquiries can be submitted via mailing address, telephone number, or a dedicated agency privacy email address as follows:
Mailing Address: ITB Suite - First Floor, 200 West Baltimore Street, Baltimore, MD 21201
Phone: (410) 767 – 0049
Email: [email protected]
13. E-Mail
If you send us an email, we may use the information you sent us to respond to your inquiry, just as we do with written correspondence. E-mail correspondence, like mailed correspondence, may become a public record, and could be disclosed to other parties upon their request, in accordance with the Maryland Public Information Act.
14. Website Privacy
This section explains privacy practices related to our website(s).
a) Cookies
A cookie is a small computer file or piece of information that may be stored in your computer's hard drive when you visit our websites. We may use cookies to improve our website’s functionality.
Cookies are widely used, and most web browsers are configured initially to accept cookies automatically. You may change your browser settings to prevent your computer from accepting cookies, or to notify you when you receive a cookie, so that you may decline it. Please note that disabling cookies may limit your access to certain features and affect your overall experience on our website.
b) Information Collected and Stored Automatically
When you browse our websites, read pages, or download information, certain information about your visit is automatically gathered and stored, if your privacy settings are not activated. This information includes the following:
- Demographic information (e.g., age group or gender),
- Default language for viewing web content,
- Location (i.e., country and city),
- The internet domain (example: Maryland.gov or example.com) and the IP address (the number automatically assigned to your computer when surfing the Web) from which you access the site,
- The type of browser and operating system used to access a site,
- The date and time you access the site,
- The page(s) you visit, and
- Your navigation through the website and actions (like clicking a button), but no content entered into form fields other than search.
Only MSDE and DoIT staff use this information to improve the functionality of MSDE websites and to learn about the number of visitors to our sites as well as the types of technology used by our web users. All MSDE web analytics are limited to MSDE and DoIT staff and safeguarded using security and privacy controls.
c) Other Websites
Our websites may contain links to third-party sites that are not covered by this Privacy Notice, such as the Maryland Longitudinal Data System, local school system single sign-on portals, and other education data systems used by school systems and their vendors. While we try to link only to sites with strong privacy standards, this Privacy Notice does not apply once you leave our website. Each of these systems maintains its own privacy notice, which governs the information it collects. We are not responsible for the privacy practices of third-party websites not owned or maintained by MSDE staff or contractors. We encourage you to review their privacy statements to learn how they collect, use, share, and disclose your information.
d) Site Security
To report a suspected security or privacy incident involving this website, contact MSDE Security at [email protected] or the MSDE Privacy Officer at [email protected], in addition to the State's central reporting channel, sponsored by the Maryland State Department of Information Technology.
Except for authorized law enforcement investigations, no other attempts are made to identify individual users or their usage habits. Unauthorized attempts to upload information or change information on our websites are strictly prohibited and may be punishable under State and Federal laws that protect against fraud and abuse of computer systems. In the event of a data breach, we will notify affected individuals in accordance with applicable laws and our data breach response plan.
Agency Prohibition on the Sale of Personal Information
Under Maryland Government Article § 10-1702 of the Maryland Data Privacy and Protect Act of 2026 (House Bill 264), MSDE must publish its privacy procedures specifically related to § 10-1702. Therefore, we are posting Section PT-9.01 of our new privacy standard operating procedure document (MD-SOP-415-PT) addressing the prohibition of the sale of personal information. Section PT-9.01 is comprised of the following four bullets:
- The Procurement Officer, Contract Monitor, and APO ensure MSDE contracts and data use agreements disallow the sale of personal information that has been collected by the Agency or Vendors on behalf of the State, including strictly restricting third parties authorized to process PI from the sale/reselling, licensing, renting, monetizing, or otherwise deriving commercial value from State-provided personal data. [MD Code, State Government, § 10-1702]
- The CISO assigned to perform third-party risk assessments includes in the audit that the third parties do not repurpose PI for secondary, non-contracted uses, including but not limited to building commercial profiles, targeted/behavioral advertising, or training proprietary machine learning/AI models.
- Procurement Officer ensures the execution of Attachment Y: Data Use Agreement to document restrictions on third parties from redisclosing PI to any external entity unless expressly required to fulfill the contracted service, as explicitly mandated by law, or authorized by the Data Subject.
- The ITB identifies and classifies all systems containing PI.