LAWRENCE J. HOGAN, JR., Governor Ch. 169
– 1 –
Chapter 169
(House Bill 1276)
AN ACT concerning
Baltimore City Youth Data Hub – Establishment
FOR the purpose of establishing the Baltimore City Youth Data Hub for the purpose of
promoting well–being of youth and improving access to and cost–efficiency of youth
programs; establishing an executive committee and providing for a manager to
operate the Baltimore City Youth Data Hub; providing that certain activities of the
executive committee and manager are not subject to the Open Meetings Act or the
Public Information Act; authorizing certain entities to provide data to the Baltimore
City Youth Data Hub; providing for the authorized uses and ownership of the data
provided to the Baltimore City Youth Data Hub; establishing certain penalties and
immunity under certain circumstances; and generally relating to the Baltimore City
Youth Data Hub.
BY adding to
Article – Local Government
Section 31–101 through 31–110 to be under the new title “Title 31. Baltimore City
Youth Data Hub”
Annotated Code of Maryland
(2013 Volume and 2021 Supplement)
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND,
That the Laws of Maryland read as follows:
Article – Local Government
TITLE 31. BALTIMORE CITY YOUTH DATA HUB.
31–101.
(A) IN THIS TITLE THE FOL LOWING WORDS HAVE TH E MEANINGS
INDICATED.
(B) “AGGREGATE” MEANS TO CORRELATE , LINK, OR ASSOCIATE
PERSONALLY IDENTIFIA BLE INFORMATION FROM ONE PROVIDER WITH
PERSONALLY IDENTIFIA BLE INFORMATION FROM ANY OTHER PROVIDER INSID E
THE BALTIMORE CITY YOUTH DATA HUB.
(C) “AUTHORIZED PURPOSE ” MEANS AN EVIDENCE –BASED, TESTABLE
INQUIRY THAT IS INTE NDED TO YIELD RESULT S THAT FURTHER THE P URPOSE OF
THE BALTIMORE CITY YOUTH DATA HUB. Ch. 169 2022 LAWS OF MARYLAND
– 2 –
(D) “BALTIMORE CITY YOUTH DATA HUB” MEANS AN INTEGRATED ,
ELECTRONIC DATA MANA GEMENT SYSTEM THAT L INKS DATA ABOUT YOUT H FROM
ANY PROVIDER .
(E) (1) “DATA” MEANS ANY INFORMATIO N ABOUT A YOUTH .
(2) “DATA” INCLUDES NAMES , ADDRESSES, TELEPHONE NUMBERS ,
DATES OF BIRT H, INFORMATION ON GENDE R, ETHNICITY, AND ENGLISH LANGUAGE
PROFICIENCY, FAMILY OR PERSONAL I NCOMES, OTHER FAMILY DATA , SOCIAL
SECURITY NUMBERS , STUDENT OR EMPLOYEE IDENTIFICATION NUMBE RS,
ENROLLMENT AND ATTEN DANCE DATES , PERFORMANCE INFORMAT ION IN ANY
JOBS, INTERNSHIPS, SCHOOLS, OR OTHER PROGRAMS , CURRENT AND PAST HEA LTH
INFORMATION , INCLUDING BIRTH WEIG HTS, MATERNAL HEALTH AT B IRTH, AND
EXPOSURE TO LEAD , AND INFORMATION ON T HE RECEIPT INDIVIDUA LLY OR BY
FAMILY OF WELFARE BE NEFITS.
(F) (1) “DATA RECIPIENT” MEANS ANY INDIVIDUAL , AGENCY, OR ENTITY
THAT RECEIVES DE –IDENTIFIED DATA FROM THE BALTIMORE CITY YOUTH DATA
HUB FOR ANALYSIS , RESEARCH, OR EVALUATION PURPOS ES.
(2) “DATA RECIPIENT” INCLUDES THE MANAGER OR A PROVIDER.
(G) “DE–IDENTIFIED DATA ” MEANS AN Y PERSONALLY IDENTIF IABLE
INFORMATION THAT IS PERMANENTLY REMOVED IN A MANNER THAT LEA VES NO
REASONABLE BASIS TO BELIEVE THAT THE REM AINING INFORMATION C AN BE USED
TO SUCCESSFULLY LINK THE DE–IDENTIFIED DATA TO A PARTICULAR INDIVIDUA L.
(H) “EXECUTIVE COM MITTEE” MEANS THE BODY THAT PROVIDES VISION ,
OVERSIGHT, AND LEADERSHIP FOR T HE BALTIMORE CITY YOUTH DATA HUB.
(I) “MANAGER” MEANS THE NONGOVERNM ENTAL CUSTODIAN OF T HE
BALTIMORE CITY YOUTH DATA HUB RESPONSIBLE FOR I TS OPERATION , UPKEEP,
AND SECURITY.
(J) “PERSONALLY IDENTIFIAB LE INFORMATION ” MEANS INCLUDES:
(1) AN INDIVIDUAL’S NAME;
(2) THE NAME OF AN INDIV IDUAL’S PARENT OR OTHER FA MILY
MEMBERS;
LAWRENCE J. HOGAN, JR., Governor Ch. 169
– 3 –
(3) THE ADDRESS OF AN IN DIVIDUAL OR AN INDIV IDUAL’S FAMILY
MEMBERS;
(4) A PERSONAL IDENTIFIE R, INCLUDING AN INDIVID UAL’S SOCIAL
SECURITY NUMBER , STUDENT IDENTIFICATI ON NUMBER, OR BIOMETRIC RECORD ;
(5) AN INDIRECT IDENTIFI ER, INCLUDING AN INDIVID UAL’S DATE OF
BIRTH, PLACE OF BIRTH , OR MOTHER’S MAIDEN NAME ; AND
(6) ANY DATA THAT , EITHER ALONE OR IN COMBINATION , WOULD
TEND TO ASSOCIATE OR LINK A PIECE OF INFO RMATION WITH A PARTI CULAR
INDIVIDUAL IN A MANN ER THAT WOULD ALLOW A REASONABLE PERSON IN THE
COMMUNITY TO IDENTIF Y THE PARTICULAR IND IVIDUAL.
(K) “PROVIDER” MEANS:
(1) THE MAYOR OF BALTIMORE CITY OR A UNIT WITHIN THE OFFICE
OF THE MAYOR AND CITY COUNCIL OF BALTIMORE CITY;
(2) THE CITY COUNCIL OF BALTIMORE CITY; BALTIMORE’S
PROMISE; AND
(3) THE BALTIMORE CITY BOARD OF SCHOOL COMMISSIONERS ; AND
(4) ANY OTHER PUBLIC , QUASI–PUBLIC, OR PRIVATE ENTITY TH AT
CONTRIBUTES DATA TO THE BALTIMORE CITY YOUTH DATA HUB.
(L) “QUERY” MEANS TO SEARCH , FIND, AND ANALYZE DATA IN THE
BALTIMORE CITY YOUTH DATA HUB.
(M) (L) “SECURE” MEANS TO IMPLEMENT A COMPREHENSIVE DATA
SECURITY PROG RAM TO MAINTAIN DATA IN STRICT CONFIDENCE AND PROTECT
PERSONALLY IDENTIFIA BLE INFORMATION AND DE–IDENTIFIED DATA
AGGREGATED THROUGH T HE BALTIMORE CITY YOUTH DATA HUB FROM
UNAUTHORIZED ACCESS , USE, MODIFICATION , OR DISCLOSURE .
(N) (M) “YOUTH” MEANS ANY P ERSON UNDER THE AGE OF 21 YEARS WHO:
(1) RESIDES IN BALTIMORE CITY;
(2) ATTENDS OR GRADUATED FROM AN ELEMENTARY O R SECONDARY
SCHOOL IN BALTIMORE CITY; OR
Ch. 169 2022 LAWS OF MARYLAND
– 4 –
(3) PARTICIPATES IN OR G RADUATED FROM ANY YO UTH PROGRAM IN
BALTIMORE CITY.
31–102.
(A) THERE IS A BALTIMORE CITY YOUTH DATA HUB IN BALTIMORE CITY.
(B) THE PURPOSE OF THE BALTIMORE CITY YOUTH DATA HUB IS:
(1) TO PROMOTE THE HEALT H, SAFETY, SECURITY, AND WELL–BEING
OF YOUTH; AND
(2) TO IMPROVE EQUITABLE ACCESS TO AND THE OV ERALL
COST–EFFICIENCY OF PROGRA MS SERVING YOUTH .
31–103.
(A) THE EXECUTIVE COMMITT EE CONSISTS OF:
(1) THE MAYOR OF BALTIMORE CITY, OR THE MAYOR’S DESIGNEE;
(2) THE CHIEF EXECUTIVE OFFICER OF THE BALTIMORE CITY
PUBLIC SCHOOL SYSTEM, OR THE CHIEF EXECUTIVE OFFICER’S DESIGNEE; AND
(3) REPRESENTATIVES FROM OTHER PROVIDERS ANY OTHER
INDIVIDUALS JOINTLY SELECTED BY THE MAYOR AND THE CHIEF EXECUTIVE.
(B) THE EXECUTIVE COMMITT EE SHALL:
(1) OVERSEE THE BALTIMORE CITY YOUTH DATA HUB; AND
(2) APPOINT AND OVERSEE THE MANA GER OF THE BALTIMORE CITY
YOUTH DATA HUB.
(C) (1) THE EXECUTIVE COMMITT EE SHALL ESTABLISH A N ADVISORY
COMMITTEE OF COMMUNI TY STAKEHOLDERS , INCLUDING REPRESENTA TIVES FROM
NONPROFIT ORGANIZATI ONS, FAITH–BASED INSTITUTIONS , COMMUNITY RES IDENT
ASSOCIATIONS, AND MEMBERS FROM THE LARGER COMMUNITY .
(2) THE PURPOSE OF THE AD VISORY COMMITTEE IS TO INCREASE
AWARENESS OF AND PRO VIDE FEEDBACK ON THE BALTIMORE CITY YOUTH DATA
HUB.
31–104. LAWRENCE J. HOGAN, JR., Governor Ch. 169
– 5 –
(A) (1) THE BALTIMORE CITY YOUTH DATA HUB AND ANY
DE–IDENTIFIED AGGREGATE D DATA ARE NOT PUBLI C OR GOVERNMENT RECO RDS
AND ARE NOT SUBJECT TO THE PUBLIC INFORMATION ACT.
(2) THE PARTICIPATION OF THE MAYOR OF BALTIMORE CITY, THE
CHIEF EXECUTIVE OFFICER OF THE BALTIMORE CITY PUBLIC SCHOOL SYSTEM,
OR THEIR DE SIGNEES IN THE EXECU TIVE COMMITTEE DOES NOT SUBJECT THE
BALTIMORE CITY YOUTH DATA HUB TO THE PUBLIC INFORMATION ACT OR THE
OPEN MEETINGS ACT.
(B) (A) (1) THE MANAGER SHALL OPE RATE THE BALTIMORE CITY
YOUTH DATA HUB.
(2) (B) THE MANAGER SHALL BE A CITY–WIDE ENTITY THAT AIM S
TO IMPROVE OUTCOMES FOR YOUTH, WITH A SPECIFIC FOCU S ON YOUTH FROM
HISTORICALLY MARGINA LIZED COMMUNITIES .
(3) (C) THE MANAGER SHALL AGG REGATE PROMPTLY AND
PROPERLY PERSONALLY IDENTIFIABLE INFORMA TION RECEIVED FROM
PROVIDERS.
(4) (D) (I) (1) SUBJECT TO SUBPARAGRAPH (II) OF THIS
PARAGRAPH PARAGRAPH (2) OF THIS SUBSECTION , THE MANAGER MAY CONT RACT
WITH A TECHNOLOGY VE NDOR OR OTHER PROFES SIONAL.
(II) (2) IF THE MANAGER CONTRA CTS WITH A TECHNOLOG Y
VENDOR OR OTHER PROFESSIONAL TO CODE , CREATE, OR ASSIST WITH THE
OPERATION OF THE BALTIMORE CITY YOUTH DATA HUB, THE TECHNOLOGY
VENDOR OR PROFESSION AL IS SUBJECT TO THE REQUIREMENTS OF THIS TITLE
RELATED TO THE MANAG ER.
(5) (E) (I) (1) THE MANAGER IS NOT SU BJECT TO THE PUBLIC
INFORMATION ACT OR THE OPEN MEETINGS ACT.
(II) (2) THE RECORDS FOR WHICH THE MANAGER IS A
CUSTODIAN ARE NOT SU BJECT TO THE PUBLIC INFORMATION ACT.
31–105.
(A) NOTWITHSTANDING ANY O THER PROVISION OF LA W, ANY LOCAL
GOVERNMENTAL ENTITY AND THE BALTIMORE CITY BOARD OF SCHOOL
COMMISSIONERS MAY PRO VIDE PERSONALLY IDEN TIFIABLE INFORMATION AND
DATA FOR THE BALTIMORE CITY YOUTH DATA HUB. Ch. 169 2022 LAWS OF MARYLAND
– 6 –
(B) NOTWITHSTANDING ANY O THER PROVISION OF LA W, ANY STATE OR
LOCAL GOVERNMENTAL E NTITY OR PRIVATE OR QUASI–GOVERNMENTAL ENTITY
MAY PROVIDE PERSONAL LY IDENTIFIABLE INFO RMATION AND DATA FOR THE
BALTIMORE CITY YOUTH DATA HUB.
(B) A ON REQUEST OF THE MAN AGER, A PROVIDER MAY SUBMIT AND
UPDATE PERSONALLY ID ENTIFIABLE INFORMATI ON AND OTHER DATA RELATED TO
THE BALTIMORE CITY YOUTH DATA HUB’S PURPOSE ON A ROLLING OR REAL –TIME
BASIS.
(C) (B) (C) EACH PROVIDER AND ITS CLIENTS, STUDENTS, OR PARTICIPANTS ,
AS APPROPRIATE , SHALL RETAIN OWNERSH IP OF:
(1) THE DATA PROVIDED BY THE PROVIDER ; AND
(2) THE DE–IDENTIFIED DATA AND ANY NEW DATA ELEMENT ,
INCLUDING DERIVATIVE FILES GENERATED AS A RESULT OF THE DATA P ROVIDED
BY THE PROVIDER TO T HE BALTIMORE CITY YOUTH DATA HUB.
31–106.
(A) THE BALTIMORE CITY YOUTH DATA HUB AND MANAGER MAY U SE ONLY
AGGREGAT ED, DE–IDENTIFIED DATA FOR CONDUCTING ANY ANALY SIS, RESEARCH,
AND REPORTING TO THE EXECUTIVE COMMITTEE , THE PUBLIC, OR OTHERWISE .
(B) DIRECT ACCESS TO PERS ONALLY IDENTIFIABLE INFORMATION IN THE
BALTIMORE CITY YOUTH DATA HUB SHALL BE RESTRICT ED TO THE MAN AGER AND
THE MANAGER ’S AUTHORIZED STAFF O R CONTRACTORS ONLY F OR AUTHORIZED
PURPOSES AND LAWFUL QUALITY CONTROL .
(C) ON THE RECEIPT OF DAT A, THE MANAGER OR ITS D ESIGNATED
TECHNOLOGY VENDOR SH ALL WORK WITH PROVID ERS TO PROMPTLY EXTR ACT AND
UPLOAD THE DATA INTO THE BALTIMORE CITY YOUTH DATA HUB’S DATA
MANAGEMENT SYSTEM FO R AGGREGATION AND DE –IDENTIFICATION .
(D) IMMEDIATELY AFTER AGG REGATING PERSONALLY IDENTIFIABLE
INFORMATION IN THE D ATA MANAGEMENT SYSTE M, THE MANAGER SHALL DE STROY
ANY COPIES OF THE PE RSONALLY IDENTIFIABLE IN FORMATION EXISTING O UTSIDE
THE DATA MANAGEMENT SYSTEM IN A MANNER S UCH THAT, AFTER AGGREGATION ,
THE MANAGER DOES NOT POSSESS OR RETAIN AN Y PERSONALLY IDENTIF IABLE
INFORMATION OUTSIDE THE DATA MANAGEMENT SYSTEM.
LAWRENCE J. HOGAN, JR., Governor Ch. 169
– 7 –
(E) THE BALTIMORE CITY YOUTH DATA HUB MAY NOT USE ITS D ATA
MANAGEMENT SYSTEM FO R QUERIES TO PRODUCE ANY PERSONALLY IDENT IFIABLE
INFORMATION OR REPOR TS THAT CONTAIN ANY PERSONALLY IDENTIFIA BLE
INFORMATION .
31–107.
(A) (1) THE MANAGER SHALL PRO MPTLY REVIEW ANY QUE RY
REQUESTED B Y A PROVIDER.
(2) THE MANAGER MAY RUN Q UERIES FOR INDIVIDUA LS OR ENTITIES
THAT ARE NOT PROVIDE RS.
(B) BEFORE APPROVING A QU ERY, THE MANAGER , WITH ASSISTANCE FROM
TECHNICAL EXPERTS ID ENTIFIED BY THE EXEC UTIVE COMMITTEE , SHALL CONDUCT
AN IN–DEPTH REVIEW OF THE PROPOSED QUER Y FOR CONSISTENCY WI TH
AUTHORIZED PURPOSES , ALIGNMENT WITH EVIDE NCE–BASED STANDARDS FOR
EQUITABLE, ETHICAL, AND METHODOLOGICALLY APPROPRIATE INQUIRIE S, AND
ASSESSMENT OF THE BE NEFITS FOR AND IMPAC T ON THE GREATER BALTIMORE
CITY COMMUNI TY.
(C) BEFORE PROVIDING ANY DATA IN RESPONSE TO A QUERY, THE
MANAGER SHALL OBTAIN WRITTEN APPROVAL FRO M ANY PROVIDER OF DA TA TO
CONFIRM THAT THERE I S NO REASONABLE BASI S TO BELIEVE THAT DE –IDENTIFIED
DATA PROVIDED IN RES PONSE TO A QUERY COU LD BE USED BY A DATA RECIPIENT
TO SUCCESSFULLY LINK DE–IDENTIFIED DATA TO A PARTICULAR INDIVIDUA L,
BASED ON THE SIZE OR UNIQUENESS OF THE PO PULATION UNDER CONSI DERATION
IN THE QUERY, OR OTHERWISE .
(D) THE MANAGER SHALL ENS URE THAT THE DATA MA NAGEMENT SYSTEM
AND PROVIDED DATA ARE SECURE USING SECURITY STAND ARDS AND PROTOCOLS
THAT ADDRESS , AT A MINIMUM, DATA SECURITY AND AC CESS, SECURITY INCIDENT
AND DISASTER RECOVER Y PROCEDURES , AND RECORDING AND MO NITORING OF
SYSTEM ACTIVITY .
(E) THE MANAGER SHALL MAI NTAIN APPROPRIA TE ADMINISTRATIVE ,
PHYSICAL, AND TECHNICAL SAFEGU ARDS THAT PROTECT PR IVACY,
CONFIDENTIALITY , INTEGRITY, AND AVAILABILITY OF ANY DATA IN COMPLIAN CE
WITH THE FEDERAL FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT AND OTHER
RELEVANT PRIVACY LAW S AND POLICIES, INCLUDING:
(1) THE REQUIRED USE OF DE–IDENTIFIED DATA IN D ATA RESEARCH
AND REPORTING ;
Ch. 169 2022 LAWS OF MARYLAND
– 8 –
(2) THE REQUIRED DISPOSI TION OF DATA THAT IS NO LONGER
NEEDED;
(3) PROVIDING DATA SECUR ITY, INCLUDING THE CAPACI TY FOR
AUDIT TRAILS;
(4) PROVIDING FOR THE PE RFORMANCE OF REGULAR AUDITS FOR
COMPLIANCE WITH DATA PRIVACY AND SECURITY STANDARDS; AND
(5) IMPLEMENTING GUIDELI NES AND POLICIES THA T PREVENT THE
REPORTING OF OTHER P OTENTIALLY PERSONALL Y IDENTIFIABLE INFOR MATION.
(F) THE MANAGER SHALL ENSURE THAT A QUERY OF THE DATA
MANAGEMENT SYSTEM :
(1) RESULTS IN DISCLOSUR E OF ONLY AGGREGATED DE–IDENTIFIED
DATA OR AGGREGATED D E–IDENTIFIED DATA REPO RTS TO A DATA RECIPI ENT; AND
(2) DOES NOT REVEAL PERS ONALLY IDENTIFIABLE INFORMATION TO
A DATA RECIPIENT .
(G) ON REQUEST, THE MANAGER MAY PROV IDE TECHNICAL ASSIST ANCE TO
DATA RECIPIENTS REGA RDING DATA RECEIVED FROM THE BALTIMORE CITY YOUTH
DATA HUB.
(H) (1) THE MANAGER AND ANY D ATA RECIPIENTS MAY N OT:
(I) ATTEMPT TO RE –IDENTIFY DE–IDENTIFIED DATA; OR
(II) DISCLOSE, RELEASE, OR REPORT DATA IN AN Y FORM THAT
MAY RESULT IN THE RE –IDENTIFICATION OF DE –IDENTIFIED DATA .
(2) THIS SUBSECTION MAY N OT BE CONSTRUED TO I NTERFERE WITH
A DATA RECIPIENT ’S CONTINUED USE OF O R RELIANCE ON PERSON ALLY
IDENTIFIABLE INFORMA TION PROVIDED TO THE BALTIMORE CITY YOUTH DATA
HUB.
31–108.
EACH YEAR, THE BALTIMORE CITY YOUTH DATA HUB SHALL PUBLISH A
REPORT THAT IS AVAIL ABLE AND ACCESSIBLE TO THE PUBLIC ON :
(1) THE IMPLEMENTATION O F THE DATA MANAGEMEN T SYSTEM,
INCLUDING IDENTIFICA TION OF THE SOURCES AND TYPES OF DATA RE CEIVED BY LAWRENCE J. HOGAN, JR., Governor Ch. 169
– 9 –
THE BALTIMORE CITY YOUTH DATA HUB FROM EACH PROVIDE R DURING THE
IMMEDIATELY PRECEDIN G 12 MONTHS;
(2) A DESCRIPTION OF EAC H APPROVED DISCLOSURE OF DATA B Y
THE BALTIMORE CITY YOUTH DATA HUB;
(3) A LIST OF PUBLICATIO NS AND OTHER REPORTS BASED ON THE
BALTIMORE CITY YOUTH DATA HUB DATA;
(4) RECOMMENDATIONS AND BEST PRACTICES FOR E NHANCEMENT
AND ALIGNMENT OF DAT A COLLECTION AND MAI NTENANCE BY PROVIDERS ; AND
(5) ANY OTHER INFORMATIO N CONSIDERED APPROPR IATE BY THE
EXECUTIVE COMMITTEE .
31–109.
(A) A PERSON, WHETHER ACTING ON BE HALF OF THE MANAGER OR A
PROVIDER, WHO OBTAINS , DISCLOSES, OR USES, OR ATTEMPTS TO OBTAI N,
DISCLOSE, OR USE IDENTIFIABLE DATA FO R A PURPOSE OTHER TH AN AGGREGATION
IN THE BALTIMORE CITY YOUTH DATA HUB IS GUILTY OF A MI SDEMEANOR AND ON
CONVICTION IS SUBJEC T TO IMPRISONMENT NO T EXCEEDING 1 YEAR OR A FINE NOT
EXCEEDING $1,000 OR BOTH.
(B) A PERSON, WHETHER ACTING ON BEHALF OF THE MAN AGER OR A
PROVIDER, IS CIVILLY LIABLE TO AN INDIVIDUAL FOR AC TUAL DAMAGES ,
INCLUDING ATTORNEY ’S FEES AND LITIGATIO N COSTS, THAT THE COURT
CONSIDERS APPROPRIAT E IF THE COURT FINDS BY CLEAR AND CONVINC ING
EVIDENCE THAT THE PE RSON COMMITT ED A VIOLATION OF AN Y PROVISION OF THIS
TITLE THAT CAUSED AN Y DAMAGE TO THE INDI VIDUAL.
31–110.
NOTWITHSTANDING ANY O THER PROVISION OF LA W, AND EXCEPT AS
PROVIDED IN § 31–109 OF THIS TITLE, A PROVIDER MAY NOT B E CIVILLY OR
CRIMINALLY LIABLE FO R PROVIDING IDENTIFIABLE DATA TO THE MANAGER FOR
THE SOLE PURPOSE OF INCLUSION IN THE BALTIMORE CITY YOUTH DATA HUB.
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect June
1, 2022.
Approved by the Governor, April 21, 2022.