Duty LXD-0459
Trains models, in Delaware
Computer Security Breaches, protection of personal informationsince 1 line
Del. Code Ann. tit. 6, section 12B-100 · Read the law's page
- Implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.
- This binds any person, including a government entity, that conducts business in Delaware and owns, licenses, or maintains personal information of a Delaware resident.
- There is no separate compliance runway to build against: the duty has been in force since , when 81 Del. Laws, c. 129, section 1 took effect 240 days after its approval.
- Expect enforcement only from the Delaware Attorney General, through the Director of Consumer Protection, seeking to address a violation and to recover direct economic damages; the chapter does not itself state whether a private plaintiff may also sue.
Delaware Personal Data Privacy Act (DPDPA), publicly available information exemptionsince 3 lines
Del. Code tit. 6, ch. 12D (84 Del. Laws c. 197) · Read the law's page
- Personal data that is lawfully made available through a government record or that a consumer has lawfully made available to the public through widely distributed media falls outside the DPDPA's definition of personal data, so scraping it does not by itself trigger the Act's duties.
- Delaware's applicability thresholds are 35,000 consumers, or 10,000 consumers with more than 20% of gross revenue from personal-data sales, until , and 10,000 consumers, or 5,000 with that revenue share, from that date, so check the threshold for the period in question.
- Cite the Delaware Personal Data Privacy Act at Title 6, Chapter 12D, never Chapter 12C, which is a different, older website-privacy-policy law.