When onboarding a new employee, verifying a tenant, or vetting a corporate client, requesting a driver’s license is a standard operational step. However, how your business collects that sensitive image determines whether you are following legal compliance guidelines or committing a severe cyber security violation.

Many Maryland business owners still allow or instruct individuals to send photos or scans of their driver’s licenses through unencrypted, standard email. In the state of Maryland, this practice does far more than just expose sensitive customer data to hackers—it places your company in direct violation of state statutory data security mandates.

Here is what your organization needs to know about the legal, financial, and cybersecurity risks of unencrypted identity transmission.

Under the Maryland Office of the Attorney General’s PIPA guidelines, a government-issued identification number is not casual information. It is legally classified as Personal Information (PI) alongside Social Security numbers and corporate financial account credentials.

The Maryland Personal Information Protection Act (PIPA) imposes explicit mandates on any commercial entity or small business that collects or maintains this data:

• The Security Mandate: Businesses must implement and maintain “reasonable security procedures and practices” to safeguard protected consumer information from unauthorized access, destruction, or disclosure.
• The Unencrypted Email Standard: Standard email operates via open-text protocols (like SMTP). Because it travels across multiple public servers without mandatory encryption, standard email is the digital equivalent of sending a postcard. Legally and technically, requiring or accepting a driver’s license via unencrypted email completely fails to meet the state’s “reasonable security” standard.

If an enterprise stores unencrypted driver’s licenses in an employee email inbox or unsecured local server and experiences a network intrusion, it triggers a mandatory data breach workflow.

According to data breach provisions enforced by the Maryland Attorney General, businesses must follow compressed notification timelines:

• Third-Party Managed IT Vendors: If an IT vendor or contractor maintains data on behalf of a business and discovers a breach, they must notify the data owner within 10 days.
• Affected Consumers & The State: The commercial entity must conduct an investigation and formally notify affected residents and the Office of the Attorney General within 45 days.
• Statutory Penalties: Failing to protect personal data or delaying notifications is prosecuted as an unfair, abusive, or deceptive trade practice under the Maryland Consumer Protection Act. This carries significant statutory fines, costly legal fees, and irreparable reputational damage.

State-level data compliance enforcement directly matches federal cybersecurity guidelines. The National Institute of Standards and Technology (NIST), via NIST Special Publication 800-63 (Digital Identity Guidelines), explicitly requires high-assurance identity verification to protect personal data. NIST notes that transmitting identity-proofing materials over unencrypted channels introduces extreme privacy risks.

Even state infrastructure refuses to use open email channels. The Maryland Department of Transportation Motor Vehicle Administration (MDOT MVA) explicitly warns consumers that the “MVA will NEVER ask you to disclose any personal information… via text or email.” If the issuing state agency recognizes standard email as unsafe for handling state IDs, private enterprises must adopt the same operational logic.

To comply with Maryland PIPA regulations and shield your business from compliance liability, eliminate unencrypted email data collection entirely. Implement these three secure workflows:

• Deploy Encrypted Inboxes or Portals: Implement end-to-end encrypted messaging platforms and secure client portals where files are encrypted both in transit and at rest.
• In-Person Identity Verification: When logistically possible, review the physical driver’s license on-site. Record that the ID was verified, rather than keeping a permanent, hackable digital photocopy.
• Enforce Strict Data Retention Policies: If digital scans must be stored, ensure they are kept in an encrypted, access-controlled directory with automated deletion schedules. This prevents an archive of sensitive identities from lingering indefinitely in an employee’s “Sent” folder.

Convenience should never come at the cost of compliance. If your business is still using standard email to gather customer or employee identification, you are exposing your operations to strict regulatory penalties and crippling cyber risks.

Contact our Managed IT and Cybersecurity team today to audit your data workflows, deploy secure upload portals, and bring your business into full alignment with Maryland PIPA regulations.