Duty LXD-6016
Publishes adult content, in Indiana
Child Exploitation and Possession of Child Pornography, obscene simulated or computer-generated imagessince 2 lines
Ind. Code § 35-42-4-4 · Read the law's page
- Do not produce, disseminate, or possess with intent to disseminate an obscene image of simulated sexual conduct that appears to depict a child under eighteen, whether or not the depicted child actually exists, including an image created by a computer program or artificial intelligence
- Do not knowingly possess or access such an image
SB 17 (2024), age verification for adult oriented websitessince 3 lines
Ind. Code ch. 24-4-23 · Read the law's page
- Applies to an adult oriented website where at least one third of the content is harmful to minors.
- Use a reasonable age verification method before granting access.
- Do not retain a user's identifying information after verification.
Distribution of an Intimate Image and Civil Action for Nonconsensual Pornography, extended to AI-generated images (House Enrolled Act 1047, 2024)since 2 lines
Ind. Code §§ 35-45-4-8, 34-21.5-2-1, 34-21.5-3 · Read the law's page
- Do not distribute an intimate image, including one created or altered by a computer program, artificial intelligence, or other digital editing tool, of an identifiable person who does not consent, when you know or reasonably should know the person does not consent
- A depicted person may bring a civil action for disclosing nonconsensual pornography and recover damages, including statutory damages up to $10,000 per defendant, whether or not the image is an authentic photograph or an AI-generated one
Disclosure of Security Breach Act, data base owner's duty to maintain reasonable security procedures and dispose of recordsin force4 lines
Ind. Code sec. 24-4.9-3-3.5 · Read the law's page
- This binds any 'data base owner' that owns or licenses computerized data including personal information of an Indiana resident. A data base owner already maintaining its own data security procedures as part of an information privacy, security policy, or compliance plan under the USA PATRIOT Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or HIPAA, and complying with that plan's own reasonable-procedures requirement, is exempt; a current or former health care provider that claimed the HIPAA-based exemption remains bound for personal information, including health records, if its own plan does not require, or is not implemented to provide, that protection once it stops being a HIPAA covered entity.
- Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard from unlawful use or disclosure any personal information of Indiana residents you collect or maintain.
- Do not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable.
- There is no private right of action for a violation. A knowing or intentional failure to comply with either duty is a deceptive act, actionable only by the Indiana Attorney General, who may seek an injunction, a civil penalty of up to $5,000 per deceptive act, and reasonable investigation and litigation costs; a related series of acts or omissions constitutes one deceptive act.
Persons holding a customer's personal information, disposal of personal informationin force3 lines
Ind. Code secs. 24-4-14-1 to 24-4-14-8 · Read the law's page
- This binds any person (an individual, partnership, corporation, limited liability company or other organization) that holds a customer's personal information, other than state government and its political subdivisions, a unit and the county offices the chapter lists, and a person that maintains and complies with a disposal program under the USA Patriot Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Financial Modernization Act of 1999 or the Health Insurance Portability and Accountability Act; a person in the business of waste collection is bound only as to personal information it holds directly in connection with that business.
- Do not dispose of a customer's unencrypted, unredacted personal information, which means discarding or abandoning it in an area accessible to the public, without shredding, incinerating, mutilating, erasing or otherwise rendering it illegible or unusable.
- Treat personal information as redacted only if it has been altered or truncated so that no more than the last four digits of a driver's license number, state identification number or account number, or no more than five digits of a Social Security number, are accessible.