Sends commercial email, in Indiana

Ind. Code § 3-9-8 · Read the law's page

• Include a disclaimer stating that elements of the media have been digitally altered or artificially generated, on any paid campaign communication that includes fabricated media of a candidate conveying a materially inaccurate depiction
• Display a printed disclaimer continuously for the duration of a video communication, and read an audio disclaimer at the start, the end, and every two minutes for a communication longer than two minutes
• A candidate depicted in noncompliant fabricated media may sue the payor, sponsor, or a disseminator who knowingly stripped the disclaimer, for actual damages, injunctive relief, and attorney's fees

Ind. Code §§ 24-4-24-1 to 24-4-24-11 · Read the law's page

• If you are a consumer genetic testing provider, give an individual a written disclosure of your privacy policy before you perform, or cause to be performed, genetic testing on the individual's biological material, covering how you collect, maintain, secure, retain and use the material and the resulting data, and publish the disclosure on your website with prominent directions and hyperlinks to it (Ind. Code 24-4-24-8).
• Do not, without the individual's freely given, specific, informed and unambiguous consent, test the individual's biological material beyond what the individual requested, use it for any other purpose, give a third party access to it or to identifiable genetic data, keep the material or identifiable data for more than 30 days after the requested testing or service, send advertising based on the results, or give a third party information that lets it advertise to the individual (24-4-24-9(a)).
• Describe each action in terms a person of ordinary intelligence can understand and ask for consent to each action separately, because consent given by inaction, by accepting general terms of service, by closing, muting or hovering over content, or through an interface designed to subvert user choice is not valid (24-4-24-9(b) and (c)).
• Implement commercially reasonable security measures to protect the biological material and the resulting data from unauthorized access, destruction, use, modification or disclosure (24-4-24-10(a)(1)).
• Let the individual access the data resulting from the genetic testing, provide a procedure to revoke consent with clear notice and instructions for it, and comply with a revocation not later than 30 days after it is communicated, including by destroying the biological material and the data whose retention the individual no longer consents to (24-4-24-10(a)(2) to (4)).
• Give a third party access to the biological material or the resulting data only under contract terms that bar the third party from using them beyond the individual's consent, giving another party access, or keeping them longer than you may (24-4-24-10(a)(5)).
• Clearly and prominently mark advertising or marketing communications sent because of the individual's use of your services, and make sure third-party communications identify the third party and state that you have not evaluated the claims in them (24-4-24-10(a)(6)).
• Do not provide data, other than deidentified data, resulting from genetic testing to an insurer, to a person that provides information to insurers for underwriting or rating, or to the individual's employer, even if the individual has consented to third-party access (24-4-24-10(b)).
• Do not charge a law enforcement agency, on a search warrant or court order, more than your actual cost, not counting labor or overhead, for providing the biological material or the data (24-4-24-10(c)).

Ind. Code sec. 24-4.9-3-3.5 · Read the law's page

• This binds any 'data base owner' that owns or licenses computerized data including personal information of an Indiana resident. A data base owner already maintaining its own data security procedures as part of an information privacy, security policy, or compliance plan under the USA PATRIOT Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or HIPAA, and complying with that plan's own reasonable-procedures requirement, is exempt; a current or former health care provider that claimed the HIPAA-based exemption remains bound for personal information, including health records, if its own plan does not require, or is not implemented to provide, that protection once it stops being a HIPAA covered entity.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard from unlawful use or disclosure any personal information of Indiana residents you collect or maintain.
• Do not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable.
• There is no private right of action for a violation. A knowing or intentional failure to comply with either duty is a deceptive act, actionable only by the Indiana Attorney General, who may seek an injunction, a civil penalty of up to $5,000 per deceptive act, and reasonable investigation and litigation costs; a related series of acts or omissions constitutes one deceptive act.

Ind. Code secs. 24-4-14-1 to 24-4-14-8 · Read the law's page

• This binds any person (an individual, partnership, corporation, limited liability company or other organization) that holds a customer's personal information, other than state government and its political subdivisions, a unit and the county offices the chapter lists, and a person that maintains and complies with a disposal program under the USA Patriot Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Financial Modernization Act of 1999 or the Health Insurance Portability and Accountability Act; a person in the business of waste collection is bound only as to personal information it holds directly in connection with that business.
• Do not dispose of a customer's unencrypted, unredacted personal information, which means discarding or abandoning it in an area accessible to the public, without shredding, incinerating, mutilating, erasing or otherwise rendering it illegible or unusable.
• Treat personal information as redacted only if it has been altered or truncated so that no more than the last four digits of a driver's license number, state identification number or account number, or no more than five digits of a Social Security number, are accessible.