Maryland bill would let MLDS share de‑identified student/workforce data with FedRAMP centers for multistate research; privacy safeguards debated

Ross Goldstein, executive director of the Maryland Longitudinal Data System (MLDS) Center, told the committee SB56 would allow the governing board to authorize sharing limited individual‑level student and workforce records with FedRAMP‑authorized third‑party data centers to enable multistate research. Goldstein said the change is necessary to participate in a regional Coleridge Initiative project linking Maryland, the District of Columbia and Virginia to analyze K–12, higher education and workforce pathways across the National Capital Region.

Goldstein and virtual witnesses described several mandatory safeguards in the bill: the governing board must ensure third‑party data centers meet or exceed the MLDS Center’s security (including FedRAMP authorization), use privacy‑enhancing techniques such as hashing to avoid using direct identifiers for analysis, limit the number of data elements to those necessary for matching, use only de‑identified data for analytics, suppress small cell sizes in outputs and require written data‑sharing agreements that comply with state and federal privacy law.

Monica Dodge, executive director of the District of Columbia Office of Education for Employment Pathways, and Jonathan Mills of the Coleridge Initiative detailed the regional research benefits: linking cross‑state records enables analysis of postsecondary and workforce outcomes for graduates who move across state lines, a gap cited by data planners.

At least one witness and some committee members raised concerns. Diana Bergman urged an amendment to exclude immigration‑status data and social security numbers from external sharing, citing potential harm for families. Senator Hester and others asked whether the state chief data privacy officer had reviewed the bill; witnesses said they had not yet done that and welcomed further consultation. Members emphasized the importance of a clear privacy review and technical oversight before any authorization is granted.

Proponents said the partnership would use FedRAMP‑authorized, secure enclaves with strict role‑based access, time‑bound researcher access, multistage disclosure review and aggregate‑only public outputs. "SB56 will allow Maryland to gain actionable, evidence‑based insights into education and workforce pathways while protecting individual privacy through mandatory de‑identification and aggregate report," a Coleridge Initiative witness said.

No committee vote was recorded; senators asked for further follow‑up with the state’s chief data privacy officer and noted a broader forthcoming bill to standardize state data‑sharing practices.