Processes personal data, in Oklahoma

Genetic Nondiscrimination in Insurance Act, Okla. Stat. tit. 36, Sec. 3614.1 · Read the law's page

• If you offer an individual or group accident and health insurance policy, do not deny or condition the issuance or effectiveness of the policy or certificate, including by imposing a preexisting condition exclusion, on the basis of genetic information with respect to any individual (section 3614.1(C)(1) of Title 36).
• Do not discriminate in the pricing of the policy or certificate, including by adjusting premium rates, on the basis of genetic information with respect to any individual (section 3614.1(C)(2) of Title 36).
• Do not request or require an individual or a family member of an individual to undergo a genetic test, except for a request, never a requirement, that meets every condition in subsection H (section 3614.1(E) and (H) of Title 36).
• Do not request, require or purchase genetic information for underwriting purposes, or about any individual before the individual's enrollment under the policy in connection with the enrollment (section 3614.1(I) and (J) of Title 36).
• Request only the minimum amount of information necessary when you obtain and use the results of a genetic test in making a payment determination (section 3614.1(F) and (G) of Title 36).

Genetic Research Studies Nondisclosure Act, Okla. Stat. tit. 36, Sec. 3614.4 · Read the law's page

• Keep the research records of individual subjects in genetic research studies confidential: they are not subject to subpoena or discovery in civil suits, except where the information in the records is the basis of the suit (section 3614.4(C) of Title 36).
• Do not disclose the research records of individual subjects in genetic research studies to employers or health insurers without the informed consent of the subject (section 3614.4(C) of Title 36).
• Identify an individual subject in published or otherwise used research results only if you have the individual's specific informed consent (section 3614.4(F) of Title 36).

Okla. Stat. tit. 24, Secs. 162-166 · Read the law's page

• Provide notice of a breach of security involving personal information without unreasonable delay.
• If you maintain computerized data that includes personal information you do not own or license, notify the owner or licensee of any breach of the security of the system as soon as practicable following determination of the breach, where the information was or is reasonably believed to have been accessed and acquired by an unauthorized person.
• Notify the Oklahoma Attorney General within 60 days of consumer notice if the breach affects 500 or more Oklahoma residents (1,000 or more for a breach maintained by a credit bureau).
• Do not assume a bare identification use of a recording-derived identifier is covered biometric data under this statute. Its definition is bound to authentication use, not identification generally, and carries no exclusion or clawback clause either way.

Storage of Newborn's DNA, Okla. Stat. tit. 21, Sec. 1175 · Read the law's page

• If you are a laboratory, medical facility, hospital or birthing place, do not store, transfer, use or database the DNA of any newborn child without express parental consent (section 1175 of Title 21).

Parents' Bill of Rights, Okla. Stat. tit. 25, Secs. 2001-2002 · Read the law's page

• If you are the state, a political subdivision, another governmental entity or any other institution, do not make, share or store a biometric scan of a minor child without the parent's written consent (section 2002(A)(7) of Title 25).
• If you are the state, a political subdivision, another governmental entity or any other institution, do not create, store or share any record of a minor child's blood or DNA without the parent's written consent, except as sections 1-516 and 1-524.1 of Title 63 require or a court order authorizes (section 2002(A)(8) of Title 25).

Okla. Stat. tit. 75A, Sec. 309 · Read the law's page

• The assessment duty takes effect on January 1, 2027; from that date, conduct and document a data protection assessment of your processing of personal data for targeted advertising, its sale, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, the processing of sensitive data, and any other processing that presents a heightened risk of harm to Oklahoma consumers (Okla. Stat. tit. 75A, Sec. 309(A)).
• In each assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (Okla. Stat. tit. 75A, Sec. 309(B)).
• Make a data protection assessment available to the Attorney General upon written request pursuant to a civil investigation demand (Okla. Stat. tit. 75A, Sec. 309(C)).

Okla. Stat. tit. 75A, Sec. 310 · Read the law's page

• From January 1, 2027, take reasonable measures to ensure that de-identified data you hold cannot be associated with an individual (Okla. Stat. tit. 75A, Sec. 310(A)(1)).
• Publicly commit to process de-identified data only in a de-identified fashion and not to attempt to reidentify it (Okla. Stat. tit. 75A, Sec. 310(A)(2)).
• Contractually obligate any recipient of de-identified data to comply with the same requirements, and monitor each recipient's compliance with those contractual commitments (Okla. Stat. tit. 75A, Sec. 310(A)(3) and (D)).

Okla. Stat. tit. 75A, Secs. 301-303 · Read the law's page

• Give an Oklahoma consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy in a digital format.
• Offer an Oklahoma consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
• Respond to a consumer rights request within 45 days, with one 45-day extension available, and fulfill the first two requests each year free of charge.

Okla. Stat. tit. 75A, Secs. 312-313 · Read the law's page

• Expect Oklahoma Consumer Data Privacy Act violations to be enforced only by the Oklahoma Attorney General, never by a private plaintiff. The Act expressly forecloses a private right of action.
• Cure a noticed violation within 30 days of Attorney General notice to avoid a civil penalty of up to $7,500 per violation.

Okla. Stat. tit. 75A, Secs. 314-315 · Read the law's page

• Confirm you conduct business in Oklahoma, or target a product or service to Oklahoma residents, and meet the 100,000-consumer or 25,000-consumer-plus-majority-revenue-from-data-sales threshold before relying on this Act's scope in compliance planning.
• Confirm whether a sector exemption applies before this Act's January 1, 2027 effective date. It excludes state agencies, GLBA-regulated financial institutions, HIPAA covered entities, nonprofits, and higher-education institutions.