Sends automated texts, in Alabama

Ala. Code secs. 8-38-3, 8-38-10 · Read the law's page

• Implement and maintain reasonable security measures to protect sensitive personally identifying information against a breach of security. The measures required are those practicable for the entity, including consideration of: designating an employee or employees to coordinate the effort, identifying internal and external risks, adopting and assessing information safeguards, retaining service providers contractually required to maintain appropriate safeguards, evaluating and adjusting the measures for changed circumstances, and keeping management, including the board of directors where one exists, informed of the overall status of the measures. An assessment of the entity's security looks at its measures as a whole, emphasizing failures that are multiple or systemic, and weighs the entity's size, the amount and type of information and activities, and its cost of the measures relative to its resources.
• Take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable through any reasonable means consistent with industry standards.
• This binds any covered entity (a person, sole proprietorship, partnership, government entity, corporation, nonprofit, trust, estate, cooperative association, or other business entity that acquires or uses sensitive personally identifying information of an Alabama resident) and any third-party agent it contracts with to maintain, store, process, or access that information. An entity already subject to and complying with a federal or state data-breach-notification regime at least as thorough as this chapter is exempt from the entire chapter.
• There is no private right of action for a violation of either duty. Only the Attorney General may bring an action for civil penalties under the chapter, and the chapter's only stated civil-penalty amounts (up to $500,000 per breach, or $5,000 per day) are tied expressly to a violation of the chapter's separate notification provisions, not to this reasonable-security-measures or disposal duty; no distinct penalty figure is stated for either duty. The Attorney General may also sue for actual damages on behalf of named individuals (Section 8-38-9(b)(2)), and may sue a state, county or municipal official or employee to compel performance of the official's duties under the chapter, while government entities themselves are exempt from civil penalties (Section 8-38-9(b)(6)).

Alabama Genetic Data Privacy Act, Ala. Code secs. 8-43-1 to 8-43-6 · Read the law's page

• As a genetic testing company, display to the consumer in plain language your policies and procedures for the collection, use, maintenance and disclosure of genetic data: a privacy policy overview, the full privacy policy notice, a notice that genetic data may be included in deidentified data shared with a third party for research, and a description of how to file a complaint.
• Obtain the consumer's initial express consent to use of the biological sample and resulting genetic data to provide the ordered product or service, to who may have access (including a contractor), and to retention for future testing for other products or services, and tell the consumer you may later seek consent to transfer the sample or disclose the data to a third party other than a contractor.
• Obtain the consumer's express consent every time you transfer the biological sample or disclose genetic data to a third party other than a contractor for a reason other than fulfilling an order, use them for a purpose other than the ordered product or service, or market to the consumer based on genetic data (customized content on your own site or app is not marketing).
• Obtain the consumer's informed consent, in compliance with the federal rules for the protection of human subjects at 45 C.F.R. Part 46, before you transfer a biological sample or disclose genetic data for independent research by a third party or for research you sponsor.
• Provide a process for the consumer to access genetic data, delete the account, request destruction of the biological sample and genetic data, and revoke any express or informed consent given.
• Destroy the biological sample and genetic data as soon as reasonably possible and no more than 30 days after a destruction request, and secure the return of a sample and data transferred or disclosed on a consent the consumer revokes as soon as reasonably possible and no more than 60 days after the revocation.
• Do not disclose a consumer's genetic data to a person issuing health, life, disability or long-term care insurance, or to an employer or prospective employer of the consumer, without the consumer's express written consent.
• When law enforcement requests data under valid legal process, do not disclose the existence of the process or the fact of your compliance to the person it concerns (you may still publish a transparency report of the number and types of requests).
• Bind each contractor by contract not to use, retain or disclose a biological sample, extracted genetic material, genetic data or identifying information for any purpose other than the contracted service, and hold the contractor to the same confidentiality obligation as your own.

Ala. Code sec. 16-1-58 · Read the law's page

• Do not knowingly sell, give or receive any list of names and addresses contained in or derived from public records requested from an Alabama local board of education for the purpose of selling or offering for sale any property or service to the individuals or entities listed (section 16-1-58(a)).
• If the public officer holding such records asks, certify in writing that you will not use a list of names or addresses derived from the records to sell or offer property or services to anyone listed or residing at a listed address, and will not sell, give or otherwise make the list available to another person for that purpose (section 16-1-58(c)).