Duty LXD-3945
Makes public services decisions, in Delaware
Computer Security Breaches, protection of personal informationsince 1 line
Del. Code Ann. tit. 6, section 12B-100 · Read the law's page
- Implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.
- This binds any person, including a government entity, that conducts business in Delaware and owns, licenses, or maintains personal information of a Delaware resident.
- There is no separate compliance runway to build against: the duty has been in force since , when 81 Del. Laws, c. 129, section 1 took effect 240 days after its approval.
- Expect enforcement only from the Delaware Attorney General, through the Director of Consumer Protection, seeking to address a violation and to recover direct economic damages; the chapter does not itself state whether a private plaintiff may also sue.
Delaware Personal Data Privacy Act, consumer rightssince 6 lines
Del. Code Ann. tit. 6, § 12D-104 · Read the law's page
- Give a Delaware consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Offer a Delaware consumer an opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects, and honor universal opt-out preference signals as of . Until the profiling opt-out reaches only solely-automated decisions; from it reaches automated decisions.
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.
- From , include in your response to an access request any inferences about the consumer derived from their personal data, and whether you or a processor is processing it for profiling to make a decision that produces a legal or similarly significant effect concerning the consumer (section 12D-104(a)(1)).
- From , on request give a consumer a list of the third parties, not only the categories of third parties, to which you have disclosed their personal data, unless the data is pseudonymous, you cannot compile the list with reasonable effort (in which case disclose all third parties to which you disclose personal data) or listing a third party would reveal a trade secret (section 12D-104(a)(5)).
- From , do not disclose in response to an access request the consumer's Social Security number, driver's license, state identification card or other government-issued identification number, financial account number, health insurance or medical identification number, account password, security question or answer, or biometric data; tell the consumer, with sufficient particularity, that you process them (section 12D-104(c)(6)).
Delaware Personal Data Privacy Act (DPDPA), general applicability and controller/processor dutiessince 10 lines
Del. Code Ann. tit. 6, §§ 12D-101, 12D-103, 12D-106 to 12D-108 · Read the law's page
- Cite DPDPA to Title 6, Chapter 12D of the Delaware Code, not Chapter 12C, which is a different statute.
- From , comply with DPDPA if you control or process the personal data of 10,000 or more Delaware consumers, or of 5,000 or more where more than 20% of your gross revenue comes from selling personal data, or if you are a third party that acquires personal data from a controller. From that date, do not treat biometric data that can be associated with a specific consumer and was collected without the consumer's consent as publicly available information, and do not treat personal data processed in connection with profiling and reports under section 12D-106(f) as exempt because it concerns an applicant, employee, agent, or contractor.
- From , do not rely on being a financial institution subject to Title V of the Gramm Leach Bliley Act as an entity-level exclusion: section 12D-103(b) instead excludes an insurer, insurance producer or other listed insurance entity, a federal or state-chartered bank, credit union or savings association, and an agent, broker-dealer or investment adviser regulated by the Delaware Investor Protection Unit or the Securities and Exchange Commission, with an affiliate or subsidiary of an insurer or bank excluded only if principally engaged in financial activities as described in section 1843(k) of title 12 of the United States Code; data subject to Title V of the Gramm Leach Bliley Act stays excluded under section 12D-103(c)(14).
- From , limit your processing of personal data to what is reasonably necessary and proportional to the purposes you disclosed to the consumer, and do not process it for an additional purpose that is not reasonably necessary and proportionate to those purposes unless the consumer consents (section 12D-106(a)(1) and (2)).
- From , before you disclose personal data to a third party, including in a sale or for targeted advertising, enter into a binding contract that limits the disclosure to specified purposes, obliges the third party to comply with the Act and provide the same level of privacy protection, lets you take reasonable steps to ensure the third party uses the data consistently with your obligations and to stop and remediate unauthorized use, and requires the third party to tell you if it can no longer meet its obligations (section 12D-106(a)(10)).
- From , conduct reasonable due diligence of each third party to which you disclose personal data, at a minimum by assessing it through questionnaires and review of its relevant documents, with further measures commensurate with the sensitivity of the data (section 12D-106(a)(11)).
- From , if you control or process the data of not less than 50,000 consumers, conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm, including targeted advertising, sale, certain profiling and the processing of sensitive data, and conduct and document an impact assessment if you engage in profiling in furtherance of automated decisions that produce legal or similarly significant effects, covering the purpose and benefits of the profiling, any known or foreseeable heightened risk of harm and its mitigation, the categories of personal data used as inputs and the outputs produced, performance metrics and known limitations, transparency measures, and post-deployment monitoring (section 12D-108(a)).
- From , if you disclose to a third party a report for use in a decision that produces legal or similarly significant effects concerning a Delaware resident, contract with the third party to give the resident notice of any adverse action based on the report, a description of the personal data relied on, and a statement that the resident may request human review where technically feasible; on a resident's request, provide within 30 days the personal data you maintain, the source of the personal data used in profiling and the third parties that obtained a report within the previous 24 months; and give the resident an opportunity to correct incorrect personal data (section 12D-106(f)).
- From , if you are a processor, your contract with the controller must identify each limited and specific purpose for which you process personal data, described with specificity and particularity and not generically, and you must provide the information and cooperate with the reasonable assessments the controller or its designated assessor needs to conduct due diligence (section 12D-107(a)(4), (b)(3) and (b)(6)).
- From , if you are a third party that receives personal data from a controller or processor without a contract the chapter requires, do not further process it, comply with the terms of any contract the chapter requires, provide the information the controller needs for its data protection assessments and due diligence, and, if you meet section 12D-103(a)(1) or (2), comply with all provisions of the chapter (section 12D-107A).