Processes personal data, in Indiana

Ind. Code §§ 27-8-26-0.1 to 27-8-26-11 · Read the law's page

• If you are an insurer of health care services coverage, do not require an individual or a member of the individual's family seeking coverage to submit to genetic screening or testing when you process an application or determine insurability (Ind. Code 27-8-26-5(1)).
• Do not consider information from genetic screening or testing adversely to an applicant or covered individual or a family member, inquire directly or indirectly into the results, or decide adversely on entries about the results in medical records or other reports (27-8-26-5(2) to (4)).
• Do not ask an applicant for the results of genetic screening or testing, or questions designed to find out the results, when you develop medical history questions (27-8-26-6).
• Do not cancel, refuse to issue, refuse to renew or refuse to enter into a contract for coverage based on the results of genetic screening or testing (27-8-26-7).
• Do not deliver, issue, renew or execute a contract in Indiana that limits benefits or sets premiums based on the results of genetic screening or testing, and consider results only if the applicant or the individual seeking renewal voluntarily submits them and they are favorable (27-8-26-8 and 27-8-26-9).

Ind. Code §§ 22-9-14-1, 22-9-14-2 · Read the law's page

• Do not discriminate against an individual on the basis of the individual's solicitation and use of consumer genetic testing services or on the basis of the results of genetic testing performed by a consumer genetic testing provider, including by denying the individual access to your goods or services, charging the individual a different rate for them, or suggesting that the individual will be subject to either measure (Ind. Code 22-9-14-2).

Ind. Code §§ 24-4-24-1 to 24-4-24-11 · Read the law's page

• If you are a consumer genetic testing provider, give an individual a written disclosure of your privacy policy before you perform, or cause to be performed, genetic testing on the individual's biological material, covering how you collect, maintain, secure, retain and use the material and the resulting data, and publish the disclosure on your website with prominent directions and hyperlinks to it (Ind. Code 24-4-24-8).
• Do not, without the individual's freely given, specific, informed and unambiguous consent, test the individual's biological material beyond what the individual requested, use it for any other purpose, give a third party access to it or to identifiable genetic data, keep the material or identifiable data for more than 30 days after the requested testing or service, send advertising based on the results, or give a third party information that lets it advertise to the individual (24-4-24-9(a)).
• Describe each action in terms a person of ordinary intelligence can understand and ask for consent to each action separately, because consent given by inaction, by accepting general terms of service, by closing, muting or hovering over content, or through an interface designed to subvert user choice is not valid (24-4-24-9(b) and (c)).
• Implement commercially reasonable security measures to protect the biological material and the resulting data from unauthorized access, destruction, use, modification or disclosure (24-4-24-10(a)(1)).
• Let the individual access the data resulting from the genetic testing, provide a procedure to revoke consent with clear notice and instructions for it, and comply with a revocation not later than 30 days after it is communicated, including by destroying the biological material and the data whose retention the individual no longer consents to (24-4-24-10(a)(2) to (4)).
• Give a third party access to the biological material or the resulting data only under contract terms that bar the third party from using them beyond the individual's consent, giving another party access, or keeping them longer than you may (24-4-24-10(a)(5)).
• Clearly and prominently mark advertising or marketing communications sent because of the individual's use of your services, and make sure third-party communications identify the third party and state that you have not evaluated the claims in them (24-4-24-10(a)(6)).
• Do not provide data, other than deidentified data, resulting from genetic testing to an insurer, to a person that provides information to insurers for underwriting or rating, or to the individual's employer, even if the individual has consented to third-party access (24-4-24-10(b)).
• Do not charge a law enforcement agency, on a search warrant or court order, more than your actual cost, not counting labor or overhead, for providing the biological material or the data (24-4-24-10(c)).

Ind. Code § 24-15-3-1 · Read the law's page

• Give an Indiana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer an Indiana consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
• Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available when reasonably necessary, and inform the consumer within that period of any extension and its reason.

Ind. Code §§ 24-15-1-1, 24-15-4-1, 24-15-11-1 · Read the law's page

• Determine whether you conduct business in Indiana, or produce a product or service targeted to Indiana residents, and control or process the personal data of at least 100,000 Indiana consumers, or at least 25,000 Indiana consumers while deriving more than 50 percent of gross revenue from selling personal data, before relying on INCDPA's scope in compliance planning.
• Limit the collection of personal data from an Indiana consumer to what is adequate, relevant, and reasonably necessary for the purposes disclosed to that consumer, and do not process it for an incompatible purpose without consent.
• Do not rely on a local Indiana ordinance to vary INCDPA. Article 15 preempts city, county, and other local law on the processing of personal data.

Ind. Code §§ 24-15-10-1 to 24-15-10-4 · Read the law's page

• Expect INCDPA violations to be enforced exclusively by the Indiana Attorney General, never by a private plaintiff.
• Cure a noticed violation and provide a written attestation of the cure within 30 days of Attorney General notice to avoid a civil penalty of up to $7,500 per violation. Unlike some peer states, Indiana's 30-day cure right is mandatory and carries no expiration date in the statute.

Ind. Code §§ 24-15-2-12, 24-15-7-1, 24-15-7-3 · Read the law's page

• To treat data as de-identified under INCDPA, take reasonable measures to ensure that the data cannot be associated with an individual (Ind. Code 24-15-7-1(a)(1)).
• Publicly commit to maintaining and using the de-identified data without attempting to re-identify it (Ind. Code 24-15-7-1(a)(2)).
• Contractually obligate every recipient of the de-identified data to comply with all provisions of chapter 7 (Ind. Code 24-15-7-1(a)(3)).
• When disclosing pseudonymous or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (Ind. Code 24-15-7-3).

Ind. Code §§ 24-15-2-25, 24-15-7-2 · Read the law's page

• To claim the pseudonymous data exemption from the consumer rights in Ind. Code 24-15-3-1(b)(1) to (4) and the controller responsibilities in 24-15-4-1(1) to (5), be able to demonstrate that any information necessary to identify the consumer is kept separately (Ind. Code 24-15-7-2).
• Subject that separately kept information to effective technical and organizational controls that prevent you from accessing it (Ind. Code 24-15-7-2).

Ind. Code §§ 24-15-6-1, 24-15-6-2 · Read the law's page

• Conduct and document a data protection impact assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
• Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
• Make an assessment available to the Attorney General when it is requested under a civil investigative demand as relevant to an investigation.
• Apply the assessment duty to processing activities created or generated after December 31, 2025, and not to earlier ones.

Ind. Code sec. 24-4.9-3-3.5 · Read the law's page

• This binds any 'data base owner' that owns or licenses computerized data including personal information of an Indiana resident. A data base owner already maintaining its own data security procedures as part of an information privacy, security policy, or compliance plan under the USA PATRIOT Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or HIPAA, and complying with that plan's own reasonable-procedures requirement, is exempt; a current or former health care provider that claimed the HIPAA-based exemption remains bound for personal information, including health records, if its own plan does not require, or is not implemented to provide, that protection once it stops being a HIPAA covered entity.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard from unlawful use or disclosure any personal information of Indiana residents you collect or maintain.
• Do not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable.
• There is no private right of action for a violation. A knowing or intentional failure to comply with either duty is a deceptive act, actionable only by the Indiana Attorney General, who may seek an injunction, a civil penalty of up to $5,000 per deceptive act, and reasonable investigation and litigation costs; a related series of acts or omissions constitutes one deceptive act.

Ind. Code secs. 24-4-14-1 to 24-4-14-8 · Read the law's page

• This binds any person (an individual, partnership, corporation, limited liability company or other organization) that holds a customer's personal information, other than state government and its political subdivisions, a unit and the county offices the chapter lists, and a person that maintains and complies with a disposal program under the USA Patriot Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Financial Modernization Act of 1999 or the Health Insurance Portability and Accountability Act; a person in the business of waste collection is bound only as to personal information it holds directly in connection with that business.
• Do not dispose of a customer's unencrypted, unredacted personal information, which means discarding or abandoning it in an area accessible to the public, without shredding, incinerating, mutilating, erasing or otherwise rendering it illegible or unusable.
• Treat personal information as redacted only if it has been altered or truncated so that no more than the last four digits of a driver's license number, state identification number or account number, or no more than five digits of a Social Security number, are accessible.

Ind. Code § 16-39-5-2(d), (e) · Read the law's page

• If you are an insurance company other than a life insurance company, do not obtain the results of any genetic screening or testing without a separate written consent by the individual at the time of application for insurance or at any other time (Ind. Code 16-39-5-2(d)).
• Use a consent form that indicates in at least 10 point boldface type that the individual need not consent to releasing the results of any genetic testing or screening, and that the commissioner has approved before use (16-39-5-2(d)(1) and (2)).
• If you inadvertently receive results of genetic testing or screening without the separate consent, do not use them in violation of IC 27-8-26 (16-39-5-2(e)).

Ind. Code §§ 24-4.9-3-1, 24-4.9-3-3, 24-4.9-4-1, 24-4.9-4-2 · Read the law's page

• Disclose a breach to affected Indiana residents without unreasonable delay and no later than 45 days after discovering the breach, if you know, should know, or should have known that the unauthorized acquisition has resulted in or could result in identity deception, identity theft, or fraud affecting them.
• Notify the Indiana Attorney General of any breach disclosure, and notify each nationwide consumer reporting agency if the breach affects more than 1,000 Indiana consumers.
• Make every disclosure or notification the statute requires, including notice to the Indiana Attorney General, notice to each nationwide consumer reporting agency, and a data holder's notice to the data base owner, without unreasonable delay and no later than 45 days after discovering the breach.
• Expect a failure to disclose, or a failure to implement reasonable safeguards, to be enforced exclusively by the Indiana Attorney General as a deceptive act, never by a private plaintiff.