Information Technology – State and Higher Education E–Mail – Requirements, the official text

WES MOORE, Governor                      Ch. 438

Chapter 438

                   (House Bill 718)

AN ACT concerning

Information Technology – State and Higher Education E–Mail – Requirements

FOR the purpose of establishing that certain provisions of law governing information
         technology plans apply to certain public institutions of higher education; establishing
         a certain policy of the State relating to State and higher education employee e–mail
         systems; requiring certain policies, plans, and standards to include certain
         provisions relating to e–mail security; and generally relating to State e–mail
         systems.

BY repealing and reenacting, with amendments,
         Article – State Finance and Procurement
         Section 3.5–302(c) and 3.5–305
         Annotated Code of Maryland
         (2021 Replacement Volume and 2025 Supplement)

         SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND,
That the Laws of Maryland read as follows:

                   Article – State Finance and Procurement

3.5–302.

         (c) Notwithstanding any other provision of law, except as provided in subsection
(a) of this section and §§ 3.5–305, 3.5–307(a)(2), 3.5–308, and 3.5–309 of this subtitle, this
subtitle applies to all units of the Executive Branch of State government including public
institutions of higher education other than Morgan State University, the University
System of Maryland, St. Mary’s College of Maryland, and Baltimore City Community
College.

3.5–305.

        (A) (1) IN THIS SECTION THE FOLLOWING WORDS HAVE THE MEANINGS
INDICATED.

                (2) (I) “SPAM E–MAIL” MEANS UNSOLICITED, PHISHING,
SOLICITATION, AND BULK E–MAILS UNRELATED TO STATE BUSINESS.

                         (II) “SPAM E–MAIL” DOES NOT INCLUDE SOLICITATION AND
BULK E–MAILS RELATING TO STATE BUSINESS, INCLUDING BULK E–MAIL FROM
STATE VENDORS, PARTNERS, AND EXCLUSIVE REPRESENTATIVES.

                                                           –1–
Ch. 438      2026 LAWS OF MARYLAND

                (3) “STATE BUSINESS” MEANS THE FURTHERANCE OF THE STATE’S
OBLIGATIONS:

                         (I) UNDER THE MARYLAND CONSTITUTION, MARYLAND CODE,
AND CODE OF MARYLAND REGULATIONS;

             (II) UNDER THE LAWS OF THE UNITED STATES; AND

             (III) BY OPERATION OF CONTRACTS AND SIMILAR OBLIGATIONS.

        (B) IT IS THE POLICY OF THE STATE THAT E–MAIL SYSTEMS AND
RESOURCES FOR STATE AND HIGHER EDUCATION EMPLOYEES ARE INTENDED TO
SUPPORT STATE BUSINESS AND MAY NOT SERVE AS A PUBLIC FORUM.

        [(a)] (C) Except as provided in subsection [(b)] (D) of this section, in accordance
with guidelines established by the Secretary, each unit of State government shall develop
and submit to the Secretary:

             (1) information technology policies and standards;

             (2) an information technology plan; and

                  (3) an annual project plan outlining the status of efforts to make
information and services available to the public over the Internet.

        [(b)] (D) (1) The governing boards of the public institutions of higher
education shall develop and submit information technology policies and standards and an
information technology plan for their respective institutions or systems to the Secretary.

                  (2) If the Secretary finds that the submissions required under this
subsection are consistent with the master plan, the Secretary shall incorporate those
submissions into the master plan.

                  (3) If the Secretary finds that the submissions required under this
subsection are not consistent with the master plan:

             (i) the Secretary shall return the submissions to the governing

boards; and

                           (ii) the governing boards shall revise the submissions as appropriate
and submit the revised policies, standards, and plans to the Secretary.

        (E) (1) IN ORDER TO PROTECT THE INFORMATION TECHNOLOGY
RESOURCES OF THE STATE, THE POLICIES, PLANS, AND STANDARDS REQUIRED

                                                           –2–
WES MOORE, Governor                                         Ch. 438

UNDER SUBSECTIONS (C) AND (D) OF THIS SECTION SHALL INCLUDE PROVISIONS TO
PROTECT STATE AND HIGHER EDUCATION EMPLOYEE E–MAIL SERVICES FROM
SPAM E–MAIL AND OTHER USE THAT DOES NOT SUPPORT STATE BUSINESS,

INCLUDING BY IMPLEMENTING SYSTEMS THAT AUTOMATICALLY FILTER SPAM

E–MAIL FROM STATE AND HIGHER EDUCATION EMPLOYEES’ E–MAIL ACCOUNTS.

                (2) THE POLICIES, PLANS, AND STANDARDS REQUIRED UNDER
SUBSECTIONS (C) AND (D) OF THIS SECTION SHALL PERMIT INCIDENTAL PERSONAL
USE OF INFORMATION TECHNOLOGY, INCLUDING E–MAIL, BY STATE EMPLOYEES
THAT:

(I) HAS A DE MINIMIS IMPACT ON RESOURCES; AND

                         (II) IS CONSISTENT WITH GENERALLY  ACCEPTED
PROFESSIONAL BUSINESS NORMS AND EXPECTATIONS.

         SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect
October 1, 2026.

Approved by the Governor, May 12, 2026.

–3–