Distributes a software product, in Arkansas

Ark. Code Ann. sec. 25-26-204 (Act 1227 of 1999, as amended by Act 218 of 2019) · Read the law's page

• If you sell information technology to the state or to a state-assisted organization (a college, nonprofit organization, political subdivision, school system or other entity supported in whole or in part by state funds), expect the contract to include the technology access clause, which requires your product to comply with the state's nonvisual access standards (Ark. Code Ann. sec. 25-26-204(a)).
• Make software applications and operating systems follow the standards of 36 C.F.R. 1194.21, and web-based intranet and internet information and applications follow the standards of 36 C.F.R. 1194.22, each as it existed on January 1, 2019 and subject to 36 C.F.R. 1194.1 to 1194.4 (sec. 25-26-204(b)(2) and (3)).
• Make effective, interactive control and use of the technology, including the operating system, software applications and the format of the data presented, readily achievable by nonvisual means, to the extent the subchapter provides (sec. 25-26-204(b)(4)(A)).
• Make technology equipped for nonvisual access compatible with the information technology used by other individuals with whom a blind or visually impaired individual interacts, to the extent the subchapter provides (sec. 25-26-204(b)(4)(B)).
• Integrate nonvisual access technology into the networks used to share communications among employees, program participants and the public, to the extent the subchapter provides (sec. 25-26-204(b)(4)(C)).
• Give the technology the capability of providing equivalent access by nonvisual means to telecommunications or other interconnected network services used by persons who are not blind or visually impaired, to the extent the subchapter provides (sec. 25-26-204(b)(4)(D)).
• A product that does not meet the minimum specifications may still be bought or used where the information it manipulates or presents is inherently visual in nature, so that its meaning cannot be conveyed nonvisually (sec. 25-26-204(c)).

Ark. Code Ann. section 4-110-104(b) · Read the law's page

• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you acquire, own, or license, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• This binds a person or business, a term defined to include a state agency, that acquires, owns, or licenses personal information about an Arkansas resident.
• This duty is separate from the same section's duty to take all reasonable steps to destroy or arrange for destruction of a customer's records containing personal information no longer retained, and from the Act's own breach-notification duty, researched as this jurisdiction's privacy row.
• There is no dedicated regulator or stated penalty amount for a violation of this duty; only the Arkansas Attorney General may bring an enforcement action, under the Arkansas Deceptive Trade Practices Act. Whether that Act's private-suit provision also reaches a violation of this duty has not been confirmed either way; treat it as an open question rather than a cleared risk.