EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
[Brackets] indicate matter deleted from existing law.
*sb0905*
SENATE BILL 905
E1 5lr3232
CF 5lr3290
By: Senator Hester
Introduced and read first time: January 28, 2025
Assigned to: Judicial Proceedings
A BILL ENTITLED
AN ACT concerning 1
Criminal Law – Identity Fraud – Artificial Intelligence and Deepfake 2
Representations 3
FOR the purpose of prohibiting a person from utilizing certain personal identifying 4
information or engaging in certain conduct in order to cause certain harm; 5
prohibiting a person from using certain artificial intelligence or certain deepfake 6
representations for certain purposes; providing that a person who is the victim of 7
certain conduct may bring a civil action against a certain person; and generally 8
relating to identity fraud and artificial intelligence and deepfake representations. 9
BY repealing and reenacting, with amendments, 10
Article – Criminal Law 11
Section 8–301 12
Annotated Code of Maryland 13
(2021 Replacement Volume and 2024 Supplement) 14
BY repealing and reenacting, without amendments, 15
Article – State Finance and Procurement 16
Section 3.5–801(a) and (c) 17
Annotated Code of Maryland 18
(2021 Replacement Volume and 2024 Supplement) 19
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 20
That the Laws of Maryland read as follows: 21
Article – Criminal Law 22
8–301. 23
(a) (1) In this section the following words have the meanings indicated. 24
2 SENATE BILL 905
(2) “ARTIFICIAL INTELLIGEN CE” HAS THE MEANING STAT ED IN § 1
3.5–801 OF THE STATE FINANCE AND PROCUREMENT ARTICLE. 2
(3) (I) “DEEPFAKE REPRESENTATION ” MEANS A PHOTOGRAPH , A 3
FILM, A VIDEO, AN AUDIO RECORDING , A DIGITAL IMAGE , A PICTURE, OR A 4
COMPUTER OR COMPUTER –GENERATED IMAGE OR P ICTURE, WHETHER MADE , 5
PRODUCED, OR GENERATED BY ELEC TRONIC, MECHANICAL , OR OTHER MEANS , 6
THAT IS INDISTINGUIS HABLE FROM AN ACTUAL AND IDENTIFIABLE HUM AN BEING. 7
(II) “DEEPFAKE REP RESENTATION ” DOES NOT INCLUDE 8
IMAGES OR ITEMS DEPI CTING HUMAN BEINGS T HAT ARE: 9
1. DRAWINGS; 10
2. CARTOONS; 11
3. SCULPTURES; OR 12
4. PAINTINGS. 13
(4) “HARM” MEANS: 14
(I) PHYSICAL INJURY ; 15
(II) SERIOUS EMOTIONAL DI STRESS; OR 16
(III) ECONOMIC DAMAGES . 17
[(2)] (5) “Health care” means care, services, or supplies related to the 18
health of an individual that includes the following: 19
(i) preventative, diagnostic, therapeutic, rehabilitative, 20
maintenance care, palliative care and counseling, service assessment, or procedure: 21
1. with respect to the physical or mental condition or 22
functional status of an individual; or 23
2. that affects the structure or function of the body; and 24
(ii) the sale or dispensing of a drug, device, equipment, or other item 25
in accordance with a prescription. 26
[(3)] (6) “Health information” means any information, whether oral or 27
recorded in any form or medium, that: 28
SENATE BILL 905 3
(i) is created or received by: 1
1. a health care provider; 2
2. a health care carrier; 3
3. a public health authority; 4
4. an employer; 5
5. a life insurer; 6
6. a school or university; or 7
7. a health care clearinghouse; and 8
(ii) relates to the: 9
1. past, present, or future physical or mental health or 10
condition of an individual; 11
2. provision of health care to an individual; or 12
3. past, present, or future payment for the provision of health 13
care to an individual. 14
(7) (I) “INDISTINGUISHABLE FRO M AN ACTUAL AND IDEN TIFIABLE 15
HUMAN BEING ” MEANS AN IM AGE AN ORDINARY PERS ON WOULD CONCLUDE IS OF 16
AN ACTUAL AND IDENTI FIABLE HUMAN BEING . 17
(II) “INDISTINGUISHABLE FRO M AN ACTUAL AND IDEN TIFIABLE 18
HUMAN BEING ” INCLUDES AN IMAGE TH AT IS COMPUTER –GENERATED AND HAS 19
BEEN CREATED , ADAPTED, OR MODIFIED TO APPEA R AS AN ACTUAL AND 20
IDENTIFIABLE HUMAN B EING. 21
[(4)] (8) “Interactive computer service” means an information service, 22
system, or access software provider that provides or enables computer access by multiple 23
users to a computer server, including a system that provides access to the Internet and 24
cellular phones. 25
[(5)] (9) “Payment device number” has the meaning stated in § 8–213 of 26
this title. 27
[(6)] (10) (i) “Personal identifying information” includes a name, 28
address, telephone number, driver’s license number, Social Security number, place of 29
employment, employee identification number, health insurance identification number, 30 4 SENATE BILL 905
medical identification number, mother’s maiden name, bank or other financial institution 1
account number, date of birth, personal identification number, unique biometric data, 2
including fingerprint, voice print, retina or iris image or other unique physical 3
representation, digital signature, credit card number, or other payment device number. 4
(ii) “Personal identifying information” may be derived from any 5
element in subparagraph (i) of this paragraph, alone or in conjunction with any other 6
information to identify a specific natural or fictitious individual. 7
[(7)] (11) “Re–encoder” means an electronic device that places encoded 8
personal identifying information or a payment device number from the magnetic strip or 9
stripe of a credit card onto the magnetic strip or stripe of a different credit card or any 10
electronic medium that allows such a transaction to occur. 11
[(8)] (12) “Skimming device” means a scanner, skimmer, reader, or any 12
other electronic device that is used to access, read, scan, obtain, memorize, or store, 13
temporarily or permanently, personal identifying information or a payment device number 14
encoded on the magnetic strip or stripe of a credit card. 15
(b) A person may not knowingly, willfully, and with fraudulent intent possess, 16
obtain, or help another to possess or obtain any personal identifying information of an 17
individual, without the consent of the individual, in order to use, sell, or transfer the 18
information to get a benefit, credit, good, service, or other thing of value or to access health 19
information or health care. 20
(b–1) A person may not maliciously use an interactive computer service to disclose 21
or assist another person to disclose the driver’s license number, bank or other financial 22
institution account number, credit card number, payment device number, Social Security 23
number, or employee identification number of an individual, without the consent of the 24
individual, in order to annoy, threaten, embarrass, or harass the individual. 25
(B–2) A PERSON MAY NOT KNOWI NGLY, WILLFULLY, AND WITH FRAUDULENT 26
INTENT UTILIZE THE P ERSONAL IDENTIFYING INFORMATION OF AN INDIVIDUAL , 27
WITHOUT THE CONSENT OF THE INDIVIDUAL , IN ORDER TO CAUSE HARM . 28
(c) A person may not knowingly and willfully assume the identity of another, 29
including a fictitious person: 30
(1) to avoid identification, apprehension, or prosecution for a crime; or 31
(2) with fraudulent intent to: 32
(i) get a benefit, credit, good, service, or other thing of value; 33
(ii) access health information or health care; [or] 34
SENATE BILL 905 5
(iii) avoid the payment of debt or other legal obligation; OR 1
(IV) HARM, HARASS, INTIMIDATE, THREATEN, OR COERCE THE 2
OTHER PERSON. 3
(d) A person may not knowingly, willfully, and with fraudulent intent to obtain a 4
benefit, credit, good, service, or other thing of value or to access health information or health 5
care, use: 6
(1) a re–encoder to place information encoded on the magnetic strip or 7
stripe of a credit card onto the magnetic strip or stripe of a different credit card or use any 8
other electronic medium that allows such a transaction to occur without the consent of the 9
individual authorized to use the credit card from which the personal identifying 10
information or payment device number is being re–encoded; or 11
(2) a skimming device to access, read, scan, obtain, memorize, or store 12
personal identifying information or a payment device number on the magnetic strip or 13
stripe of a credit card without the consent of the individual authorized to use the credit 14
card. 15
(e) A person may not knowingly, willfully, and with fraudulent intent possess, 16
obtain, or help another possess or obtain a re–encoder device or a skimming device for the 17
unauthorized use, sale, or transfer of personal identifying information or a payment device 18
number. 19
(f) (1) A person may not knowingly and willfully claim to represent another 20
person without the knowledge and consent of that person, with the intent to solicit, request, 21
or take any other action to otherwise induce another person to provide personal identifying 22
information or a payment device number. 23
(2) A PERSON MAY NOT KNOWI NGLY, WILLFULLY, AND WITH 24
FRAUDULENT INTENT US E ARTIFICIAL INTELLI GENCE OR A DEEPFAKE 25
REPRESENTATION TO: 26
(I) IMPERSONATE , FALSELY DEPICT , OR CLAIM TO REPRESEN T 27
ANOTHER PERSON WITH THE INTE NT TO DEFRAUD , MISLEAD, OR CAUSE HARM TO 28
THAT PERSON OR ANY OTHER PERSON; OR 29
(II) CREATE OR DISTRIBUTE FALSE RECORDS WITH THE INT ENT 30
TO: 31
1. CAUSE HARM TO ANOTHE R PERSON; 32
2. INDUCE ANOTHER PERSO N TO PROVIDE PERSONA L 33
IDENTIFYING INFORMAT ION; OR 34 6 SENATE BILL 905
3. OBTAIN A BENEFIT , CREDIT, GOOD, SERVICE, OR 1
OTHER THING OF VALUE . 2
(g) (1) (i) A person who violates this section where the benefit, credit, good, 3
service, health information or health care, or other thing of value that is the subject of 4
subsection (b), (c), or (d) of this section has a value of at least $1,500 but less than $25,000 5
is guilty of a felony and on conviction is subject to imprisonment not exceeding 5 years or a 6
fine not exceeding $10,000 or both. 7
(ii) A person who violates this section where the benefit, credit, good, 8
service, or other thing of value that is the subject of subsection (b), (c), or (d) of this section 9
has a value of at least $25,000 but less than $100,000 is guilty of a felony and on conviction 10
is subject to imprisonment not exceeding 10 years or a fine not exceeding $15,000 or both. 11
(iii) A person who violates this section where the benefit, credit, good, 12
service, or other thing of value that is the subject of subsection (b), (c), or (d) of this section 13
has a value of $100,000 or more is guilty of a felony and on conviction is subject to 14
imprisonment not exceeding 20 years or a fine not exceeding $25,000 or both. 15
(2) A person who violates this section where the benefit, credit, good, 16
service, health information or health care, or other thing of value that is the subject of 17
subsection (b), (c), or (d) of this section has a value of at least $100 but less than $1,500 is 18
guilty of a misdemeanor and on conviction is subject to imprisonment not exceeding 1 year 19
or a fine not exceeding $500 or both. 20
(3) A person who violates this section under circumstances that reasonably 21
indicate that the person’s intent was to manufacture, distribute, or dispense another 22
individual’s personal identifying information without that individual’s consent is guilty of 23
a felony and on conviction is subject to imprisonment not exceeding 10 years or a fine not 24
exceeding $25,000 or both. 25
(4) A person who violates subsection (b–1), (c)(1), (e), or [(f)] (F)(1) of this 26
section is guilty of a misdemeanor and on conviction is subject to imprisonment not 27
exceeding 1 year or a fine not exceeding $500 or both. 28
(5) (I) A PERSON WHO VIOLATES SUBSECTION (F)(2) OF THIS 29
SECTION INVOLVING ONE VICTIM IS GUILTY OF A FELON Y AND ON CONVICTION IS 30
SUBJECT TO IMPRISONM ENT NOT EXCEEDING 5 YEARS OR A FINE NOT EXCEEDING 31
$10,000 OR BOTH. 32
(II) A PERSON WHO VIOLATES SUBSECTION (F)(2) OF THIS 33
SECTION INVOLVING TWO OR MORE VICTIMS IS GUILTY OF A FELON Y AND ON 34
CONVICTION IS SUBJEC T TO IMPRISONMENT NO T EXCEEDING 10 YEARS OR A FINE 35
NOT EXCEEDING $15,000 OR BOTH. 36
SENATE BILL 905 7
[(5)] (6) When the violation of this section is pursuant to one scheme or 1
continuing course of conduct, whether from the same or several sources, the conduct may 2
be considered as one violation and the value of the benefit, credit, good, service, or other 3
thing of value may be aggregated in determining whether the violation is a felony or 4
misdemeanor. 5
(H) (1) A PERSON WHO IS THE VI CTIM OF AN ACT THAT WOULD 6
CONSTITUTE A VIOLATI ON OF SUBSECTION (F)(2) OF THIS SECTION MAY BRING A 7
CIVIL ACTION AGAINST THE PERSON O R PERSONS WHO COMMIT TED THE ACT IN A 8
COURT OF COMPETENT J URISDICTION. 9
(2) THE COURT MAY : 10
(I) ISSUE AN INJUNCTION TO PREVENT OR RESTRA IN AN ACT 11
THAT WOULD CONSTITUT E A VIOLATION OF SUB SECTION (F)(2) OF THIS SECTION ; 12
AND 13
(II) GRANT ANY OTHER APPR OPRIATE RELIEF. 14
[(h)] (I) A person described in subsection (g)(2) or (4) of this section is subject to 15
§ 5–106(b) of the Courts Article. 16
[(i)] (J) In addition to restitution under Title 11, Subtitle 6 of the Criminal 17
Procedure Article, a court may order a person who pleads guilty or nolo contendere or who 18
is found guilty under this section to make restitution to the victim for reasonable costs, 19
including reasonable attorney’s fees, incurred: 20
(1) for clearing the victim’s credit history or credit rating; 21
(2) for clearing the victim’s record or history related to health information 22
or health care; and 23
(3) in connection with a civil or administrative proceeding to satisfy a debt, 24
lien, judgment, or other obligation of the victim that arose because of the violation. 25
[(j)] (K) A sentence under this section may be imposed separate from and 26
consecutive to or concurrent with a sentence for any crime based on the act or acts 27
establishing the violation of this section. 28
[(k)] (L) Notwithstanding any other law, the Department of State Police may 29
initiate investigations and enforce this section throughout the State without regard to any 30
limitation otherwise applicable to the Department’s activities in a municipal corporation or 31
other political subdivision. 32
8 SENATE BILL 905
[(l)] (M) (1) Notwithstanding any other law, a law enforcement officer of the 1
Maryland Transportation Authority Police, the Maryland Port Administration Police, the 2
Park Police of the Maryland–National Capital Park and Planning Commission, or a 3
municipal corporation or county may investigate violations of this section throughout the 4
State without any limitation as to jurisdiction and to the same extent as a law enforcement 5
officer of the Department of State Police. 6
(2) The authority granted in paragraph (1) of this subsection may be 7
exercised only in accordance with regulations that the Department of State Police adopts. 8
(3) The regulations are not subject to Title 10, Subtitle 1 of the State 9
Government Article. 10
(4) The authority granted in paragraph (1) of this subsection may be 11
exercised only if an act related to the crime was committed in the investigating law 12
enforcement agency’s jurisdiction or if the complaining witness resides in the investigating 13
law enforcement agency’s jurisdiction. 14
[(m)] (N) If action is taken under the authority granted in subsection [(l)] (M) of 15
this section, notification of an investigation: 16
(1) in a municipal corporation, shall be made to the chief of police or 17
designee of the chief of police; 18
(2) in a county that has a county police department, shall be made to the 19
chief of police or designee of the chief of police; 20
(3) in a county without a police department, shall be made to the sheriff or 21
designee of the sheriff; 22
(4) in Baltimore City, shall be made to the Police Commissioner or the 23
Police Commissioner’s designee; 24
(5) on property owned, leased, or operated by or under the control of the 25
Maryland Transportation Authority, the Maryland Aviation Administration, or the 26
Maryland Port Administration, shall be made to the respective chief of police or the chief’s 27
designee; and 28
(6) on property owned, leased, or operated by or under the control of the 29
Maryland–National Capital Park and Planning Commission, to the chief of police of the 30
Maryland–National Capital Park and Planning Commission for the county in which the 31
property is located. 32
[(n)] (O) When acting under the authority granted in subsection [(k)] (L) or [(l)] 33
(M) of this section, a law enforcement officer: 34
SENATE BILL 905 9
(1) in addition to any other immunities and exemptions to which the officer 1
may be entitled, has the immunities from liability and exemptions accorded to a law 2
enforcement officer of the Department of State Police; but 3
(2) remains an employee of the officer’s employing agency. 4
[(o)] (P) (1) A State’s Attorney or the Attorney General may investigate and 5
prosecute a violation of this section or a violation of any crime based on the act establishing 6
a violation of this section. 7
(2) If the Attorney General exercises authority under paragraph (1) of this 8
subsection, the Attorney General has all the powers and duties of a State’s Attorney, 9
including the use of a grand jury in any county or Baltimore City, to investigate and 10
prosecute the violation. 11
[(p)] (Q) Notwithstanding any other provision of law, the prosecution of a 12
violation of this section or for a violation of any crime based on the act establishing a 13
violation of this section may be commenced in any county in which: 14
(1) an element of the crime occurred; or 15
(2) the victim resides. 16
Article – State Finance and Procurement 17
3.5–801. 18
(a) In this subtitle the following words have the meanings indicated. 19
(c) “Artificial intelligence” means a machine–based system that: 20
(1) can, for a given set of human–defined objectives, make predictions, 21
recommendations, or decisions influencing real or virtual environments; 22
(2) uses machine and human–based inputs to perceive real and virtual 23
environments and abstracts those perceptions into models through analysis in an 24
automated manner; and 25
(3) uses model inference to formulate options for information or action. 26
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 27
October 1, 2025. 28