MDSP Privacy Notice

The State of Maryland’s Department of State Police (“we,” “our,” “us”) is committed to maintaining the confidentiality, accuracy, and security of your Personal Information (as defined in Section 1) and the application of generally accepted fair information privacy principles. This Privacy Notice governs our actions related to the collection, processing, protection, and disclosure of Personal Information. We are responsible for maintaining and protecting the Personal Information that is under our agency’s control. This Privacy Notice applies to all Personal Information collected, used, and disclosed by our agency through various means, including our websites, in-person services, and written correspondence.

What Personal Information We Collect

We may collect and process the following information about you (“Personal Information”):

First, middle, and last name;
home and work addresses;
phone numbers;
race/ethnicity;
gender;
country of birth;
Social Security numbers;
FBI numbers;
driver’s license numbers;
biometric data;
financial data;
healthcare data; and
other unique identifiers.

This information is collected in accordance with the Criminal Justice Information Services (CJIS) and other Federal and State laws.

Why We Collect and Process Your Personal Information

Why We Collect Your Information

We collect, process, and disclose Personal Information in accordance with criminal justice requirements, or to determine eligibility for the services you have applied for or requested from us. This includes the Regulated Firearm Applications, Licenses, and Permits system, Salvage Vehicle Inspection system, and criminal justice systems.

How We Use Your Information

We collect and use your personal data in accordance with criminal justice requirements. This may include sensitive information.

Your information may also be used to comply with legal and regulatory requirements, support audits and investigations, prevent fraud, and improve agency programs and operations. Where permitted by law, information may be shared with other government agencies or authorized entities for these purposes.

We only use personal information as necessary to fulfill these functions and in accordance with applicable privacy and data protection laws.

Knowledge and Consent

Your knowledge and consent are required for the collection, processing, or disclosure of Personal Information, except when the law permits us to do so without your knowledge or consent. The purposes for which we collect Personal Information will be identified before or at the time we collect the information. Providing us with your Personal Information is always your choice. However, your decision not to provide certain information may limit our ability to provide you with the services you seek. We will not require you to consent to the collection, processing, or disclosure of information as a condition to the supply of a product or service, unless such information is necessary to provide the product or service to you, or if it is required by law. Your signature on a document or “clicking” your agreement on an electronic application serves as your consent.

Limiting Collection

We adhere to data minimization principles, collecting only the Personal Information that is reasonably necessary, proportionate, and directly relevant to fulfill the specified purposes. In the event we receive your Personal Information from a third party, such as the federal government or identity verification vendor, we enter into appropriate agreements and request only that information required to meet a contractual purpose.

Use, Disclosure, and Retention of Personal Information

Unless you give permission, this Notice explains otherwise, or the law requires or allows it, we use or share your Personal Information only for the purpose for which it was collected. We retain your Personal Information only for as long as necessary to meet that purpose, following approved state retention schedules, or in compliance with the law.

We may share Personal Information with third parties that process your Personal Information on our behalf so that we can fulfill your requests. Before sharing Personal Information with these third parties, we enter into agreements requiring them to adhere to strict obligations regarding data use, protection, security, confidentiality, and non-disclosure. We do not sell your personal information to any third-party under any circumstances.

To better serve Marylanders, we may de-identify or anonymize Personal Information that pertains to you for our performance improvements and make it available to other State agencies, so they can measure and improve service performance, or for research purposes. New protection methods, like privacy-enhancing technologies (PETs, such as data masking, differential privacy, federated learning, homomorphic encryption, zero-knowledge proofs, and trusted execution environments), ensure that Maryland State agencies can securely utilize anonymous data without releasing any personal information.

Information that you share with us, including Personal Information, may be subject to public disclosure if required by the Maryland Public Information Act (General Provision Article § 4-101 et seq.), if necessary to perform our official duties, or as otherwise required by applicable law. However, Maryland law includes exemptions that protect certain information from being publicly released in specified circumstances.

Accuracy

We strive to maintain Personal Information in as accurate, complete, and up-to-date form as is necessary to fulfill the purposes for which you provided it. We may ask for or implement verification processes to maintain up-to-date Personal Information. Pursuant to the Maryland Public Information Act (General Provisions Article § 4-502 — “Corrections of Public Record” - PDF), data subjects have the right to request corrections, update old information, or add missing details to their records. You are responsible for ensuring that the Personal Information you provide to us is accurate and current, and you should notify organizations whenever your details change.

Safeguarding Personal Information

State and federal laws provide protections for the Personal Information you provide. Pursuant to Maryland law, we will protect Personal Information using reasonable security safeguards that are appropriate to the nature of the Personal Information collected, the services we provide, and our operations. We use encryption, access controls, and secure data storage to protect your Personal Information. If your Personal Information is accessed by unauthorized individuals, we will notify you in accordance with applicable laws and our data breach response plan.

Privacy Notice Changes

We will make information available to you about our policies and practices with respect to how we manage Personal Information. Following statutory directives and industry best practices, we review and update our privacy notices at least annually to ensure they accurately reflect current data practices, new system implementations, or evolving legal frameworks. We will inform you of significant changes to our privacy practices by posting an updated Privacy Notice with a “Last Updated” date.

Access to Personal Information

Upon your request, we will inform you of the existence, use, or disclosure of your Personal Information as permitted by law. You may gain access to and verify the accuracy and completeness of your Personal Information. You may also request amendment or deletion of the Personal Information we obtained directly from you, as permitted by law and subject to State records retention schedules. To make changes to Personal Information that we have received about you from a third party, contact the third party directly. We cannot update third-party records.

There may be times when we are prohibited from disclosing certain information to you. For example, we cannot provide access to records that contain the Personal Information of other individuals, or where other legal, law enforcement, or security restrictions apply. If we are unable to fulfill your request, we will provide an explanation and document the denial in your record.

Artificial intelligence

We do not use artificial intelligence (AI) when processing Personal Information. We follow the State of Maryland’s Responsible AI Policy and related guidelines to ensure your privacy is protected.

E-Mail

If you send us an email, we may use the information you sent us to respond to your inquiry, just as we do with written correspondence. E-mail correspondence, like mailed correspondence, may become a public record, and could be disclosed to other parties upon their request, in accordance with the Maryland Public Information Act.

Website Privacy

This section explains privacy practices related to our website(s).

A cookie is a small computer file or piece of information that may be stored in your computer's hard drive when you visit our websites. We may use cookies to improve our website’s functionality and, in some cases, to provide visitors with a customized online experience.

Cookies are widely used, and most web browsers are configured initially to accept cookies automatically. You may change your browser settings to prevent your computer from accepting cookies, or to notify you when you receive a cookie, so that you may decline it. Please note that disabling cookies may limit your access to certain features and affect your overall experience on our website.

Information Collected and Stored Automatically

When you browse our websites, read pages, or download information, certain information about your visit is automatically gathered and stored. This information does not identify you personally and includes the following:

The internet domain (example: Maryland.gov or example.com) and the IP address (the number automatically assigned to your computer when surfing the Web) from which you access the site,
The type of browser and operating system used to access a site,
The date and time you access the site,
The page(s) you visit, and
Your navigation through the website and actions (like clicking a button), but no content entered into form fields other than search.

This information is used to make our websites more useful to visitors, to learn about the number of visitors to our sites, and the types of technology our visitors use. We do not track or record identifying information about individuals and their visits.

Other Websites

Our websites may contain links to other third-party sites that are not governed by this Privacy Notice. Although we try to only link to sites with high privacy standards, our Privacy Notice does not apply once you leave our website. Additionally, we are not responsible for the privacy practices employed by third-party websites. Therefore, you should read their privacy statements to learn how they collect, use, share, and disclose your information.

Site Security

To ensure that our websites are secure and remain available to all users, we employ commercial software programs to monitor network traffic to identify unauthorized attempts to upload or change information or otherwise cause damage.

Except for authorized law enforcement investigations, no other attempts are made to identify individual users or their usage habits. Unauthorized attempts to upload information or change information on our websites are strictly prohibited and may be punishable under State and Federal laws that protect against fraud and abuse of computer systems. In the event of a data breach, we will notify affected individuals in accordance with applicable laws and our data breach response plan.

How to Contact Us

You may direct any questions about this Privacy Notice, requests to exercise your data rights, or complaints about our privacy practices by contacting the designated privacy personnel or privacy team.

Inquiries can be submitted via:

Maryland Department of State Police
Technology and Information Management Command
Information Security and Compliance Section
1201 Reisterstown Rd
Pikesville, Maryland 21208-3802
[email protected]