Maryland IT Asset Disposition (ITAD), Data Destruction, and Electronics Recycling Compliance

Maryland’s Personal Information Protection Act (Md. Code Com. Law § 14-3501 to 3508) extends a 45-day breach-notification deadline and a separate records-disposal duty, and the heavy DoD, NIH, NSA, and federal-contractor footprint in Maryland brings CMMC 2.0 and FAR/DFARS into routine in-state operations. The Enterprise Compliance Reference below provides the Maryland posture in a single table; the sections that follow walk every duty, regulator, and penalty band with statute citation and recent Attorney General enforcement context.

Maryland Enterprise Compliance Reference

Maryland Compliance Reality

Maryland’s privacy compliance regime spans (1) the Maryland Personal Information Protection Act at Md. Code, Com. Law § 14-3501 et seq. (45-day breach notice with AG notice before resident notice; records-disposal duty at § 14-3503 requiring “unreadable or undecipherable through any means”; biometric data and genetic information enumerated since HB 1154 of 2020), (2) the Maryland Online Data Privacy Act at Md. Code, Com. Law § 14-4601 et seq. (effective October 1, 2025, with strict data-minimization, sensitive-data sale prohibition, and enumeration of biometric, genetic, and neural data as sensitive), (3) the Maryland Consumer Protection Act at § 13-101 et seq. (PIPA violations are prima facie unfair or deceptive practices), (4) the Maryland Statewide eCycling Program at Md. Code, Envir. § 9-1727 (manufacturer-registration since 2005), and (5) the MDE hazardous-waste rules at COMAR 26.13. Audit defensibility is the ability to reconstruct each step of asset retirement across that duty surface on demand.

Maryland and Federal Compliance Interaction

Maryland hosts more federal civilian and defense agencies than almost any state, so FAR 52.204-21, DFARS 252.204-7012, CMMC 2.0, the HIPAA Security Rule, GLBA, and the FTC Safeguards Rule cover most data handling in the state, with Md. Code Com. Law § 14-3501 layered on top. A regulated enterprise must satisfy the stricter of (1) Maryland statutes including PIPA (§ 14-3501 et seq.), MODPA (§ 14-4601 et seq., effective October 1, 2025 with biometric/genetic/neural sensitive-data enumeration), MCPA (§ 13-101 et seq.), and the Statewide eCycling Program (Envir. § 9-1727), (2) federal sector rules including the HIPAA Security Rule, the FTC Disposal Rule, the FTC Safeguards Rule, GLBA, FAR 52.204-21, and DFARS 252.204-7012, and (3) customer or prime-contract clauses. The 45-day PIPA deadline, the “unreadable or undecipherable through any means” disposal outcome, and the MODPA sensitive-data sale prohibition are the state-specific anchors layered on top of the federal baseline.

Maryland Preemption Matrix (Federal Floor vs. State Posture)

The preemption matrix below states, for each federal regime that touches enterprise IT asset disposition in Maryland, whether Maryland law is preempted by, equal to, or exceeds the federal floor, and where it exceeds, the specific stricter element.

NIST SP 800-171 Revision 3 (May 2024 final) is the operative federal CUI sanitization baseline for federal-contractor environments, and CMMC 2.0 (32 CFR Part 170, effective December 16, 2024) is the operative DoD contractor framework that enforces the NIST 800-171 control set through assessment-based compliance levels. Federal contractors operating in Maryland must satisfy CMMC 2.0 in addition to Maryland state law.

Maryland Data Security, Privacy, and Disposal Obligations

Md. Code, Com. Law § 14-3504 — PIPA Breach Notification (45-Day Deadline)

Md. Code, Com. Law § 14-3504 requires any business that owns or licenses computerized data that includes personal information of a Maryland resident, upon discovery of a breach, to give notice to affected residents as soon as reasonably practicable, but not later than 45 days after the business concludes its investigation. Notice to the Maryland Attorney General is required before notifying individuals. Personal information includes SSN, driver’s license, account or credit card number plus access code, biometric data, genetic information (added by HB 1154 of 2020), passport number, state identification, and health information.

Md. Code, Com. Law § 14-3503 — PIPA Records Disposal

§ 14-3503 requires a business that owns or licenses records containing personal information to take reasonable steps to protect against unauthorized access to or use of the personal information when disposing. Reasonable steps include shredding, erasing, or otherwise modifying records to make personal information unreadable or undecipherable through any means.

Maryland Online Data Privacy Act (MODPA, Effective October 1, 2025)

The Maryland Online Data Privacy Act at Md. Code, Com. Law § 14-4601 et seq. became effective October 1, 2025. MODPA imposes controller obligations including (i) strict data-minimization (limits collection to “reasonably necessary and proportionate” to provide or maintain a product or service), (ii) sensitive-data sale prohibition, (iii) consumer rights (access, deletion, correction, portability, opt-out of targeted advertising and profiling), and (iv) heightened sensitive-data restrictions for biometric data, genetic data, neural data (one of the first state laws to enumerate neural data), precise geolocation, health-condition data, sexual orientation, race, and religion. Civil penalties are up to $10,000 per violation enforced by the Maryland Attorney General; a 60-day cure period applies until April 1, 2027.

Md. Code, Com. Law § 13-101 — Maryland Consumer Protection Act

PIPA violations are prima facie unfair or deceptive practices under the Maryland Consumer Protection Act (§ 13-101 et seq.), with civil penalties up to $10,000 per violation and $25,000 per repeat violation. The Maryland Attorney General has broad enforcement authority.

Maryland Public-Sector IT Disposal Posture

Maryland state agencies retire IT assets under Maryland Department of Information Technology (DoIT) policy. The operative controls include Maryland DoIT Information Security Policy; Department of General Services surplus; Maryland State Archives records retention schedules. Public-sector retirement requires permanent removal of data before transfer or surplus, documented chain of custody, records-retention-schedule alignment for any records-bearing media, and surplus-property routing through the state’s authorized disposal channel. Private-sector enterprises that contract with the state, that operate in regulated public-sector adjacent industries (higher education, K-12, state-funded healthcare), or that subcontract to state agencies inherit these duties through contract flow-down. See Maryland Department of Information Technology (DoIT) policy guidance.

Maryland Insurance Data Security Act (NAIC Insurance Data Security Adoption)

Maryland has adopted the NAIC Insurance Data Security Model Law at Md. Code Ann., Insurance § 4-301 et seq. (effective October 1, 2020). The statute imposes a written information security program duty on insurance licensees, brokers, and third-party service providers; mandates annual board certification of the program; prescribes incident-notification windows to the state insurance commissioner; and requires risk-based assessment of third-party service-provider controls. Retired Electronic Assets in scope (workstations, servers, backup media, and any device storing nonpublic information of insureds) must be retired under documented chain of custody with verified sanitization, and the destruction certificate must be retained as part of the program’s audit trail.

Maryland Student Data Privacy Act (Student-Data Privacy)

Maryland’s student-data privacy statute at Md. Code Ann., Education § 4-131 regulates K-12 ed-tech operators that collect, store, or process covered student information. The statute imposes data-minimization, retention-limit, destruction-on-termination, and prohibition-on-secondary-use duties. School districts, charter schools, higher-education institutions in scope, and ed-tech service providers retiring devices that have held covered student records must verify data destruction under Maryland’s outcome standard and retain the destruction certificate.

Data Destruction and Media Sanitization Expectations

Md. Code, Com. Law § 14-3503 prescribes the “unreadable or undecipherable through any means” outcome standard with method enumeration (shred, erase, modify). The operative method baseline is NIST Special Publication 800-88 Revision 2 (operative September 26, 2025), which categorizes media sanitization as Clear, Purge, and Destroy. Maryland state agencies follow Maryland Department of Information Technology (DoIT) security policies.

Hard Drive Shredding

Maryland-resident PII on fixed media must reach the NIST 800-88 Rev. 2 Destroy outcome through physical shredding because Md. Code Com. Law § 14-3502’s disposal duty and § 14-3504’s 45-day notification clock both depend on whether the underlying data was actually rendered unusable. Hard drive shredding reduces magnetic and solid-state media to particles small enough that data reconstruction is forensically impossible.

Certified Data Wiping

Certified data wiping aligned to NIST 800-88 Clear or Purge is appropriate where the asset is being remarketed or redeployed.

Media Degaussing

Media degaussing is the appropriate Purge method for legacy magnetic media. SSDs, NVMe, and modern flash media require cryptographic erase (Purge) or physical destruction (Destroy).

Certified Media Shredding

Certified media shredding covers non-drive media including optical disks, tape cartridges, USB drives, memory cards, smart cards, and any printed material containing personal information subject to PIPA § 14-3503 and MODPA controller duties.

Maryland E-Waste, Hazardous Waste, and Environmental Compliance

The Maryland Statewide eCycling Program at Md. Code, Envir. § 9-1727 et seq. (established 2005) requires manufacturers of computers, monitors, and televisions sold in Maryland to register annually with the Maryland Department of the Environment (MDE) and provide opportunities for recycling. Enterprise IT asset retirement routes through the federal RCRA-delegated state hazardous-waste program at COMAR 26.13. Hazardous-waste characterization follows the federal toxicity characteristic for lead, mercury, cadmium, and chromium.

Enterprise / commercial equipment covered by the Maryland e-waste program: PARTIAL. Maryland Statewide Computer Recycling Pilot Program (Md. Code Ann., Env’t § 9-1727 et seq.) is manufacturer-registration-funded; enterprise bulk disposal routes through COMAR 26.13 hazardous-waste rules. Maryland is an EPA-authorized state administering its own RCRA Subtitle C hazardous-waste program through COMAR 26.13; the state program operates at the federal floor unless explicitly more stringent.

Universal-waste rules at COMAR 26.13.10 cover batteries, lamps, mercury-containing equipment, mercury thermostats, and pesticides. CRT rules at 40 C.F.R. § 261.39 apply. Generator status follows the federal VSQG / SQG / LQG framework; cradle-to-grave generator liability applies. Civil penalties under Md. Code, Envir. § 7-265 run up to $25,000 per day per violation. Enterprise IT asset retirement routes through certified electronics recycling with environmental disposition records.

Regulated Asset Types and Enterprise Scenarios

Servers and Storage Arrays

Server hardware and enterprise storage arrays contain operating-system data, application data, log files, configuration files with credentials, and database content. Certified server recycling covers the full asset including drive bays, controller cards, and embedded firmware storage. Every drive in the chassis must be sanitized to the Destroy category under NIST 800-88 Rev. 2 before custody transfer when protected health information, financial-account information, biometric records, genetic data, or covered defense information was processed.

End-User Computing Assets

Certified laptop recycling and certified computer recycling route through the Maryland Statewide eCycling Program for covered devices, paired with NIST 800-88 Rev. 2 data sanitization.

Mobile Devices and Biometric Sensors

Certified cell phone recycling includes verified erase of internal flash, handling of embedded SIM and eSIM material, and destruction of biometric sensor data (face geometry, fingerprint) which is enumerated under PIPA and MODPA.

Equipment Destruction and Product-Recall Scenarios

Secure equipment destruction covers prototypes, defective products, and regulated equipment. Product recall management, defective product destruction, and classified equipment destruction cover specialized scenarios, including medical and biometric device recalls subject to MODPA sensitive-data restrictions.

Enforcement, Penalties, and Audit Risk

Maryland enforcement is concentrated at the Maryland Attorney General Consumer Protection Division (PIPA violations as prima facie UDAP under MCPA with civil penalties up to $10,000 per violation and $25,000 per repeat; MODPA enforcement at up to $10,000 per violation with 60-day cure until April 1, 2027), Maryland MDE (hazardous-waste violations under Envir. § 7-265 up to $25,000/day; eCycling registration enforcement), and federal regulators with concurrent jurisdiction. Maryland was a participant in the AG v. T-Mobile multistate $350M+ settlement (January 2025). The audit-reconstruction-of-events standard is operative.

Statutory Penalty Schedule

State Sectoral Regulators and Audit Authority

In addition to the Maryland Attorney General and the Maryland environmental agency, state-level sectoral regulators hold audit and inquiry authority over IT-asset-disposition-relevant controls within their regulated populations. The Maryland Office of the Commissioner of Financial Regulation examines banks and credit unions for GLBA-aligned information-security-program controls. The Maryland Insurance Administration examines insurance licensees for the written information security program required by the NAIC Insurance Data Security Act or state-equivalent. The Maryland Department of Health examines healthcare entities for HIPAA Security Rule compliance. The Maryland Higher Education Commission oversees FERPA-overlapping records and student-data-privacy duties at state institutions of higher education. The Maryland Public Service Commission examines investor-owned utilities for customer-data-protection controls. Each sectoral regulator can issue document requests, on-site examinations, or consent orders that probe the chain-of-custody, sanitization-certificate, and environmental-disposition records produced during IT asset retirement.

Documentation, Chain of Custody, and Audit-Ready Proof

Maryland Attorney General Consumer Protection Division enforcement under Md. Code Com. Law § 14-3508 is built from the documentary record an enterprise can produce, and a Retired Electronic Asset without serialized destruction Certificates is treated as a presumptive PIPA disposal-duty failure.

How All Green Recycling Operationalizes Maryland Compliance

IT Asset Disposition

All Green Recycling operates certified IT asset disposition structured around Maryland’s statutory duty surface, including the 45-day PIPA breach-notice deadline, the § 14-3503 disposal outcome standard, the MODPA controller obligations effective October 1, 2025, and the Statewide eCycling Program. Asset pickup is scheduled with a documented chain of custody, secured transport through IT equipment packaging and transportation, certified data destruction at the receiving facility, environmental disposition through MDE-authorized channels, and audit-ready reporting. Asset remarketing recovers residual value while preserving chain of custody.

Secure Data Destruction

All Green Recycling’s secure data destruction service line is structured to satisfy the § 14-3503 “unreadable or undecipherable through any means” outcome standard, align to NIST SP 800-88 Rev. 2, and produce attestation documentation appropriate for the PIPA biometric and genetic-data enumeration and the MODPA biometric, genetic, and neural-data sensitive-data categories.

Certified Electronics Recycling

Certified electronics recycling routes retired electronic assets through MDE-authorized channels under the Maryland Statewide eCycling Program. R2v3, NAID AAA, and e-Stewards frameworks are used as reference frameworks for downstream-handler accountability.

Secure Equipment Destruction

Secure equipment destruction covers product-recall management, defective-product destruction, and classified-equipment destruction.

Reverse Logistics and Chain-of-Custody Tracking

Reverse logistics covers multi-site enterprise pickups, manufacturer return programs (including those operating under the Maryland Statewide eCycling Program), and customer-driven returns.

Audit-Ready Reporting

Every engagement produces a uniform documentation package delivered through IT asset reporting: serialized asset list, chain-of-custody log, Certificate of Data Destruction per device (with biometric-, genetic-, and neural-data attestation where applicable), Certificate of Recycling, environmental disposition record cross-referenced to the Maryland Statewide eCycling Program, hazardous-waste manifest where applicable, and HIPAA / GLBA / FTC Safeguards documentation entries where the federal overlay applies.

Frequently Asked Questions

The questions below are the questions enterprise compliance, security, audit, and procurement leaders ask during vendor evaluations, RFP reviews, and breach-response planning when a Retired Electronic Asset is moving through IT Asset Disposition in Maryland.

Maryland Compliance as Risk Management

Maryland IT asset retirement is a layered risk-management discipline, not a recycling transaction. Compliant retirement is the ability to prove, under scrutiny, that data was rendered unreadable or undecipherable through any means before custody transfer, that breach notice surfaced not later than 45 days (with AG notice before resident notice), that biometric and genetic data were handled under the PIPA enumeration in effect since 2020 and that biometric, genetic, and neural data were handled under the MODPA sensitive-data regime effective October 1, 2025, that downstream processing routed through MDE-authorized channels under the Statewide eCycling Program, and that hazardous fractions were handled under the universal-waste rules. MCPA per-violation civil penalties (up to $10,000–$25,000), MODPA $10,000 per-violation penalties, MDE daily penalties (up to $25,000), HIPAA federal overlay, FTC Disposal and Safeguards Rules, and audit-driven counterparty review converge on the same set of records.

Maryland compliance is best treated as a continuous control posture rather than a periodic disposal event. All Green Recycling, LLC operationalizes that posture through IT asset disposition, secure data destruction, certified electronics recycling, secure equipment destruction, reverse logistics, and audit-ready reporting. Compliance, security, and procurement teams that need a Maryland-specific audit walkthrough or an RFP-ready compliance package reach the All Green Recycling response desk at (800) 780-0347.