Processes personal data, in Arizona

A.R.S. sec. 44-7601 · Read the law's page

• This binds any 'entity': a corporation, foreign corporation, unincorporated association, sole proprietorship, partnership, trust, estate, joint venture, limited liability company, or a government, governmental subdivision or agency, that discards or disposes of a paper record or document containing an individual's first and last name, or first initial and last name, combined with a Social Security number, a credit, charge or debit card number, a retirement account number, a savings, checking or securities entitlement account number, or a driver license or nonoperating identification license number.
• Redact that personal identifying information, or destroy the paper record or document, before discarding or disposing of it. This duty reaches paper records and documents only; it states no separate duty over electronic data.
• An entity subject to the Gramm-Leach-Bliley Act, a HIPAA covered entity or business associate, or an entity subject to the federal Fair Credit Reporting Act is exempt. An entity that maintains and complies with its own disposal procedures, consistent with this duty, is deemed compliant.
• A county attorney or the Attorney General may enforce this section, and a civil penalty applies per violation arising out of one incident: up to $500 for a first violation, $1,000 for a second violation, and $5,000 for a third or subsequent violation. The statute states no private right of action of its own.

Genetic Information Privacy Act, section 44-8001(3) and (6)(c) · Read the law's page

• To keep data outside the definition of genetic data, de-identify it in accordance with 45 CFR section 164.514(b); data de-identified in that way is de-identified data under the chapter, and genetic data does not include de-identified data (section 44-8001(3) and (6)(c)).

Genetic Information Privacy Act, section 44-8002(A)(5) · Read the law's page

• Provide a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request and obtain the destruction of the consumer's biological sample (section 44-8002(A)(5)).

Genetic Information Privacy Act, sections 44-8001 to 44-8004 · Read the law's page

• If you are a direct-to-consumer genetic testing company, make available to a consumer both a high-level privacy policy overview and a prominent, publicly available privacy notice covering your data collection, consent, use, access, disclosure, transfer, security, retention and deletion practices (section 44-8002(A)(1)).
• Obtain a consumer's initial express consent that clearly describes the uses of the genetic data collected and specifies who has access to test results and how the data may be shared, and separate express consent to transfer or disclose the data to anyone other than your vendors and service providers, to use it beyond the primary purpose of the product or service and inherent contextual uses, and to retain a biological sample after the initial testing (section 44-8002(A)(2)(a) and (b)).
• Obtain informed consent in compliance with 45 CFR part 46 before transferring or disclosing a consumer's genetic data to third-party persons for research, or for research under your control for the purpose of publication or generalizable knowledge (section 44-8002(A)(2)(c)).
• Obtain a consumer's express consent for marketing to the consumer based on the consumer's genetic data, and for marketing by a third-party person based on the consumer having ordered or purchased a genetic testing product or service; customized content or offers within your own websites, applications or services are not marketing for this purpose (section 44-8002(A)(2)(d)).
• Require a valid legal process before disclosing genetic data to law enforcement or any other government agency, unless the consumer gives express written consent (section 44-8002(A)(3)).
• Develop, implement and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use or disclosure (section 44-8002(A)(4)).
• Provide a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request and obtain the destruction of the consumer's biological sample (section 44-8002(A)(5)).
• Disclose genetic data only in accordance with section 12-2802, and never disclose a consumer's genetic data to any entity offering health insurance, life insurance or long-term care insurance or to any employer of the consumer (section 44-8002(A)(6) and (B)).

A.R.S. sec. 1-602(A)(7) and (9) and (E) to (G) · Read the law's page

• Do not make a biometric scan of a minor child under A.R.S. 15-109 without the parent's written consent (A.R.S. 1-602(A)(7)).when it serves a public body
• Do not create, store or share any record of a minor child's blood or DNA without the parent's written consent, except as required by A.R.S. 36-694, and do not conduct genetic testing on a minor child under A.R.S. 12-2803 without that consent unless authorized under A.R.S. 13-610 or a court order (A.R.S. 1-602(A)(8)).
• If you are this state or one of its political subdivisions, obtain a parent's written consent before making a video or voice recording of a minor child, unless the recording is made during a court proceeding, a law enforcement investigation or an interview in a criminal or child safety services investigation, or is used solely for safety demonstrations, a legitimate academic or extracurricular activity, regular classroom instruction, security or surveillance of buildings or grounds, or a photo identification card (A.R.S. 1-602(A)(9)).when it serves a public body

A.R.S. secs. 18-551 to 18-552 · Read the law's page

• Notify each affected Arizona resident of a breach of system security involving their personal information within 45 days after determining the breach occurred.
• Notify the Arizona Attorney General and the director of the Arizona Department of Homeland Security, in writing, within 45 days after determining the breach occurred, and the three largest nationwide consumer reporting agencies, if the breach requires notification of more than 1,000 individuals (A.R.S. 18-552(B)).
• Where a law enforcement agency has delayed the notifications, make them within 45 days after the agency tells you that they no longer compromise its investigation (A.R.S. 18-552(D)).
• Treat a person's unique biometric data generated to authenticate access to an online account as personal information capable of triggering this notification duty. Biometric data collected for a purpose other than online-account authentication is not covered by this statute's biometric element.
• Expect this statute to be enforced exclusively by the Arizona Attorney General as an unlawful practice under the Arizona Consumer Fraud Act. It creates no private right of action.

Health information organizations, section 36-3804(F) · Read the law's page

• If you receive de-identified information from a health information organization, do not use it, alone or in combination with other information, to identify an individual (section 36-3804(F)).

Health information organizations, section 36-3805(C) · Read the law's page

• If you are a health information organization, do not transfer individually identifiable health information or de-identified health information that is accessible through the health information exchange to any person or entity for the purpose of research, or for use as part of a set of data for an application for grant or other research funding, unless the health care provider obtains the individual's consent for the transfer (section 36-3805(C)).
• Have a health care provider participating in the organization document that it has provided a notice of transfer, in the form of the individual's signature showing the individual has received and read and understands the notice and consents to the transfer; the notice must be in at least twelve-point type and describe the purposes of the transfer (section 36-3805(C)).