Md. Code, State Government § 4-112

(a) (1) In this section the following words have the meanings indicated.

(2) “Aggregated data” means de–identified data that is summarized by type of program of study or educational institution.

(3) “Student information” means:

(i) student Social Security number;

(ii) program of study;

(iii) enrollment; and

(iv) name of educational institution.

(4) “Tax information” means income tax records, wage information, and other data stored by the Comptroller.

(b) (1) In accordance with the protocol established under § 24–703.2 of the Education Article, the Comptroller shall:

(i) match student information received from the Maryland Longitudinal Data System Center with tax information maintained by the Comptroller; and

(ii) for research purposes, produce aggregated data from the matched information on the average amount of wage or salary earnings from self–employment or other sources of income for individuals within each educational institution or program of study.

(2) The Comptroller may not produce any aggregated data that may be identifiable based on the size or uniqueness of the population under consideration.

(c) The Comptroller shall follow and utilize privacy and security standards developed for the protocol, including:

(1) data retention and disposition policies;

(2) authorized access and authentication for authorized access policies;

(3) privacy compliance standards; and

(4) breach notification and procedures.

(d) The Comptroller shall comply with any data privacy and security standards in accordance with the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies.