Last Updated: 10/01/2026Table of Contents
1. Introduction
2. What Personal Information We Collect
3. Why We Collect and Process Your Personal Information
4. Knowledge and Consent
5. Limiting Collection
6. Use, Disclosure, and Retention of Personal Information
7. Accuracy
8. Safeguarding Personal Information
9. Privacy Notice Changes
10. Access to Personal Information
11. Artificial intelligence
12. How to Contact Us
13. E-Mail
14. Website Privacy
1. Introduction
The State of Maryland’s Department of Planning, the Maryland Historical Trust (MHT), Jefferson Patterson Park & Museum (JPPM), Maryland 250 Commission, and the Maryland Heritage Areas Authority (MHAA) (“we,” “our,” “us”), are committed to maintaining the confidentiality, accuracy, and security of your Personal Information (as defined in Section 2) and the application of generally accepted fair information privacy principles. This Privacy Notice governs our actions related to the collection, processing, protection, and disclosure of Personal Information. We are responsible for maintaining and protecting the Personal Information that is under our agency’s control. This Privacy Notice applies to all Personal Information collected, used, and disclosed by our agency through various means, including our websites, in-person services, and written correspondence; applications for financial assistance; and event registrations and property rentals.
We may collect and process the following information about you (“Personal Information”):
- Standard Identifiers: Full name (including given and surnames), signature or other personal mark, home address, mailing address, telephone number, and email address.
- Government-Issued Identifiers: Social Security Number (SSN), driver’s license number, state identification card number, or other individual identification numbers issued by state or federal units.
- Financial Information: Taxpayer Identification Numbers (TINs) and payment information (such as card numbers or check details) collected strictly to process payments or confirm proof of purchase
- Technical and Usage Information: Internet Protocol (IP) addresses, web browser types and operating systems, date and time of website visits, and navigation and clickstream tracking data.
This information is collected in accordance with the Maryland Public Information Act and the Maryland Online Data Privacy Act and the following State and federal laws:
- State Finance and Procurement § 5-505 (State planning)
- State Finance and Procurement § 5-310 (excess State property)
- State Finance and Procurement § 5A-325 (MHT grant program)
- State Finance and Procurement § 5A-303 (MHT tax credit program)
- Financial Institutions § 13-1107 (MHAA grant program)
- The National Historic Preservation Act, 54 U.S.C. § 300101 et seq.
a. Why we Collect Your Information
We collect, process, and disclose Personal Information to determine, for example, whether you are eligible for the services, benefits, and/or products you have applied for or requested from us. We may also collect certain sensitive or financial information for other purposes, such as to fulfill a service or benefit request that requires that information.
We may offer you the opportunity to apply for additional benefits or services from other agencies that we believe you might be eligible for or interested in. In certain circumstances, the purposes for which information is collected may be self-explanatory, and consent may be implied, such as where you or a designee provide your name, address, and payment as part of an application or other process.
b. How We Use Your Information
We collect and use your personal data to see if you qualify for the benefits or services you’ve requested. This may include financial or sensitive information if it's necessary to process your application.
Your information may also be used to comply with legal and regulatory requirements, support audits and investigations, prevent fraud, and improve agency programs and operations. Where permitted by law, information may be shared with other government agencies or authorized entities for these purposes.
We only use personal information as necessary to fulfill these functions and in accordance with applicable privacy and data protection laws.
Sharing & Consent
- Other Opportunities: We may let you know about programs from other agencies that might help you.
- Implied Consent: When you voluntarily provide details like your address or payment info as part of an application, we take that as your permission to use the data for that specific purpose.
- Service Improvements: We also use data to analyze and improve State services and to stay compliant with the law.
4. Knowledge and Consent
Your knowledge and consent are required for the collection, processing, or disclosure of Personal Information, except when the law permits us to do so without your knowledge or consent. The purposes for which we collect Personal Information will be identified before or at the time we collect the information. Providing us with your Personal Information is always your choice. However, your decision not to provide certain information may limit our ability to provide you with the services you seek. We will not require you to consent to the collection, processing, or disclosure of information as a condition to the supply of a product or service, unless such information is necessary to provide the product or service to you, or if it is required by law. Your signature on a document or “clicking” your agreement on an electronic application serves as your consent.
5. Limiting Collection
We adhere to data minimization principles, collecting only the Personal Information that is reasonably necessary, proportionate, and directly relevant to fulfill the specified purposes. In the event we receive your Personal Information from a third party, such as the federal government or identity verification vendor, we enter into appropriate agreements and request only that information required to meet a contractual purpose.
Unless you give permission, this Notice explains otherwise, or the law requires or allows it, we use or share your Personal Information only for the purpose for which it was collected. We retain your Personal Information only for as long as necessary to meet that purpose, following approved state retention schedules, or in compliance with the law.
We may share Personal Information with third parties that process your Personal Information on our behalf so that we can fulfill your requests. Prior to sharing Personal Information with these third parties we enter into agreements with them requiring them to adhere to strict obligations regarding data use, protection, security, confidentiality, and non-disclosure. We do not sell your personal information to any third-party under any circumstances.
To better serve Marylanders, we may de-identify or anonymize Personal Information that pertains to you for our performance improvements, and make it available to other State agencies, so they can measure and improve service performance, or for research purposes. New protection methods, like privacy enhancing technologies (PETs, such as data masking, differential privacy, federated learning, homomorphic encryption, zero knowledge proofs, and trusted execution environments), ensure that Maryland State agencies can securely utilize anonymous data without releasing any personal information.
Information that you share with us, including Personal Information, may be subject to public disclosure if required by the Maryland Public Information Act (General Provisions Article § 4-101 et seq.), if necessary to perform our official duties, or as otherwise required by applicable law. However, Maryland law includes exemptions that protect certain information from being publicly released in specified circumstances.
7. Accuracy
We strive to maintain Personal Information in as accurate, complete, and up-to-date form as is necessary to fulfill the purposes for which you provided it. We may ask for or implement verification processes to maintain up-to-date Personal Information. Pursuant to the Maryland Public Information Act (General Provisions Article § 4-502 — “Corrections of Public Record.”), data subjects have the right to request corrections, update old information, or add missing details to their records. You are responsible for ensuring that the Personal Information you provide to us is accurate and current and you should notify organizations whenever your details change.
State and federal laws provide protections for the Personal Information you provide. For example, health information is protected under the Health Insurance Portability and Accountability Act (42 U.S.C. §§ 1320d et seq.) and the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) protects consumer financial information. Pursuant to Maryland law, we will protect Personal Information using reasonable security safeguards that are appropriate to the nature of the Personal Information collected, the services we provide, and our operations. We use encryption, access controls, and secure data storage to protect your Personal Information. In the event that your Personal Information is accessed by unauthorized individuals, we will notify you in accordance with applicable laws and our data breach response plan.
9. Privacy Notice Changes
We will make information available to you about our policies and practices with respect to how we manage Personal Information. Following statutory directives and industry best practices, we review and update our privacy notices at least annually to ensure they accurately reflect current data practices, new system implementations, or evolving legal frameworks. We will inform you of significant changes to our privacy practices by posting an updated Privacy Notice with a “Last Updated” date
Upon your request, we will inform you of the existence, use or disclosure of your Personal Information. You may gain access to and verify the accuracy and completeness of your Personal Information. You may also request amendment or deletion of the Personal Information we obtained directly from you, as permitted by law and subject to State records retention schedules. To make changes to Personal Information that we have received about you from a third party, contact the third party directly. We cannot update third party records.
There may be times when we are prohibited from disclosing certain information to you. For example, we cannot provide access to records that contain the Personal Information of other individuals, or where other legal, law enforcement, or security restrictions apply. If we are unable to fulfill your request, we will provide an explanation and document the denial in your record.
11. Artificial intelligence
As Technology advances, you may interact with Generative Artificial Intelligence (AI) directly (such as through a public-facing Chatbot) or indirectly when we utilize automated systems or algorithms to process your Personal Information. We will maintain strict transparency during direct AI interactions. We follow the State of Maryland’s Responsible AI Policy and related guidelines to ensure your privacy is protected.
You may direct any questions about this Privacy Notice, requests to exercise your data rights or complaints about our privacy practices by contacting the designated privacy personnel or privacy team at:
Maryland Department of Planning
120 E. Baltimore St, Suite 2000
Baltimore, MD 21202
410-767-4500
[email protected]
Inquiries can be submitted via mailing address, telephone number, or the agency’s dedicated privacy email address.
13. E-Mail
If you send us an email, we may use the information you sent us to respond to your inquiry, just as we do with written correspondence. E-mail correspondence, like mailed correspondence, may become a public record, and could be disclosed to other parties upon their request, in accordance with the Maryland Public Information Act.
14. Website Privacy
This section explains privacy practices related to our website(s).
a) Cookies
A cookie is a small computer file or piece of information that may be stored in your computer's hard drive when you visit our websites. We may use cookies to improve our website’s functionality and, in some cases, to provide visitors with customized online experience.
Cookies are widely used, and most web browsers are configured initially to accept cookies automatically. You may change your browser settings to prevent your computer from accepting cookies, or to notify you when you receive a cookie, so that you may decline it. Please note that disabling cookies may limit your access to certain features and affect your overall experience on our website.
b) Information Collected and Stored Automatically
When you browse our websites, read pages, or download information, certain information about your visit is automatically gathered and stored. This information does not identify you personally and includes the following:
- The internet domain (example: Maryland.gov or example.com) and the IP address (the number automatically assigned to your computer when surfing the Web) from which you access the site,
- The type of browser and operating system used to access a site,
- The date and time you access the site,
- The page(s) you visit, and
- Your navigation through the website and actions (like clicking a button), but no content entered into form fields other than search.
This information is used to make our websites more useful to visitors, to learn about the number of visitors to our sites, and the types of technology our visitors use. We do not track or record identifying information about individuals and their visits.
c) Other Websites
Our websites may contain links to other third-party sites that are not governed by this Privacy Notice. Although we try to only link to sites with high privacy standards, our Privacy Notice does not apply once you leave our website. Additionally, we are not responsible for the privacy practices employed by third-party websites. Therefore, you should read their privacy statements to learn how they collect, use, share, and disclose your information.
d) Site Security
To ensure that our websites are secure and remain available to all users, we employ commercial software programs to monitor network traffic to identify unauthorized attempts to upload or change information or otherwise cause damage.
Except for authorized law enforcement investigations, no other attempts are made to identify individual users or their usage habits. Unauthorized attempts to upload information or change information on our websites are strictly prohibited and may be punishable under State and Federal laws that protect against fraud and abuse of computer systems. In the event of a data breach, we will notify affected individuals in accordance with applicable laws and our data breach response plan.
