Duty LXD-4479
Deploys a mental-health chatbot, in Arkansas
Each law's tag says when it binds: since in force from a date not yet set not yet in force
Arkansas Personal Information Protection Act, reasonable security proceduressince 1 line
Ark. Code Ann. section 4-110-104(b) · Read the law's page
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you acquire, own, or license, to protect it from unauthorized access, destruction, use, modification, or disclosure.
- This binds a person or business, a term defined to include a state agency, that acquires, owns, or licenses personal information about an Arkansas resident.
- This duty is separate from the same section's duty to take all reasonable steps to destroy or arrange for destruction of a customer's records containing personal information no longer retained, and from the Act's own breach-notification duty, researched as this jurisdiction's privacy row.
- There is no dedicated regulator or stated penalty amount for a violation of this duty; only the Arkansas Attorney General may bring an enforcement action, under the Arkansas Deceptive Trade Practices Act. Whether that Act's private-suit provision also reaches a violation of this duty has not been confirmed either way; treat it as an open question rather than a cleared risk.
Arkansas Deceptive Trade Practices Act (general-law hook)from a date not yet set2 lines
Ark. Code Ann. ยง 4-88-107
- This law is recorded as enacted, but the record carries no commencement date, so whether it is yet in force has to be established before relying on what follows.
- Do not knowingly misrepresent goods or services, or otherwise engage in deceptive or unconscionable trade practices toward consumers.