NIST Privacy Framework, Communicate-PCM.AW-P1

Tell a person, at the latest when you collect their personal data or within a reasonable period if collected elsewhere, who you are, the purpose and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, under Articles 15 and 16.

If you make solely automated decisions about a person in Bulgaria of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Where the processing relies on artificial intelligence, disclose to the data subject the criteria and the nature of the personal data behind the automated decision, from the moment you collect it.

Obtain a person's prior consent before sending them unsolicited direct marketing communications of any kind, tell them before their data is first used for that purpose or disclosed to a third party, and let them withdraw consent at any time.

Tell a data subject, no later than when you collect their data, your identity, the purposes of the processing, the categories of data, the recipients, the rights of access, rectification, erasure and objection, the retention period, any transfer abroad, and how to give or withdraw consent.

Warn a data subject, when their data is collected over an open network and unless they already know it, that their personal data may circulate without security conditions and risk being seen and used by unauthorized third parties.

Tell a data subject, except where they already know it, your identity and address and any representative's, the data protection officer's contact details, the categories of data, the purposes and legal basis of processing, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, erasure and objection, at the time of collection or, if not collected from the data subject, when the data is recorded or at the latest on first disclosure to a third party, unless the law authorizes the processing or informing them is impossible or would take disproportionate effort.

A data controller must give a data subject the information article 27 lists before processing their personal data, and must act on a request to access, rectify, erase, restrict, receive in a portable form, or object to the processing of their personal data, generally within one month of the request.

At the point of collecting personal data, provide the data subject the controller's identity, the processing purposes, the data categories, the recipients, the retention period, and any prospect of transfer to a third country.

Before requesting a data subject's authorization, tell them clearly and expressly the purpose of the processing, that answering a question about sensitive data or a minor's data is optional, their rights as a data subject, and how to identify and contact you, and keep proof that you gave this notice.

Tell a data subject, when you collect their personal data directly from them, your identity, the processing's purpose, whether answering is mandatory, the recipients, and how to exercise the rights of objection, access and rectification.

Tell a network communication user, clearly and completely, the purpose of accessing or storing information in their terminal equipment and the means available to object to it, unless the access or storage has the exclusive purpose of enabling or facilitating electronic communication or is strictly necessary to provide an online communication service at the user's express request.

If you make solely automated decisions about a person in Croatia of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

If you make solely automated decisions about a person in Cyprus of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Before you restrict, in whole or in part, a person's rights under GDPR Articles 12, 18, 19 or 20 in Cyprus on a ground in GDPR Article 23(1), carry out an impact assessment and consult the Commissioner, and tell the person about the restriction, under Law 125(I)/2018 Article 11.

If you make solely automated decisions about a person in the Czech Republic of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Give the person concerned, at the latest when you collect their data, your identity, the purpose, the categories of data, the recipients, their right to refuse to appear on the file, their rights of access and rectification, the retention period, and whether the data may be transferred to a third country.

Stop processing a person's data for prospecting purposes as soon as they object, free of charge, and tell them before their data are first disclosed to a third party for prospecting so they can object to that disclosure.

Let a data subject object at any time, on legitimate grounds, to processing of their data, offer them that right expressly and free of charge before their data is first communicated to a third party or used for prospecting, and answer an objection within thirty days.

At collection, give the data subject your identity, the purposes and legal basis, the categories of data, the recipients, whether a reply is mandatory or optional, their rights of access, rectification, objection and complaint, the retention period, and any transfer to a third country; give the same information within a reasonable time when you did not collect the data from them directly.

If you make solely automated decisions about a person in Denmark of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Inform the data subject clearly, specifically, and transparently about personal-data processing carried out through an AI system, including its purposes.

If you make solely automated decisions about a person in Estonia of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

If you operate a whistleblowing system, preserve fairness, proportionality and openness about its scope and purpose, and inform a person implicated in a report as soon as possible of the report's existence and the facts alleged.

Tell a data subject, when you obtain their personal data, who you are, the purposes and lawful basis of the processing, the recipients, any transfer to a third-party jurisdiction, the retention periods, their rights, and whether automated decision-making including profiling is in use; where the data came from elsewhere, add the categories obtained and their source, and give the information within a reasonable period and at the latest one month after obtaining it.

Stop processing personal data for direct marketing, including the profiling related to it, as soon as the data subject objects, and bring the right to object to the data subject's attention explicitly.

Let the customer obtain an explanation of the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).

Give the consumer the right to request and obtain from you a clear and comprehensible explanation of the assessment of creditworthiness, including on the logic and risks involved in the automated processing of personal data as well as its significance and effects on the decision (Article 18(8), point (a)).

Inform the consumer of the right to request and obtain human intervention (Article 18(8), second subparagraph).

Before concluding a contract for the purchase, rent or lease of a connected product, and as the seller, rentor or lessor (which may be the manufacturer), give the user in a clear and comprehensible manner at least the type, format and estimated volume of product data the product is capable of generating, whether it is capable of generating data continuously and in real-time, whether it is capable of storing data on-device or on a remote server (with the intended duration of retention, where applicable), and how the user may access, retrieve or, where relevant, erase the data, including the technical means and the terms of use and quality of service (Article 3(2)).

Before concluding a contract for the provision of a related service, and as the provider of the related service, give the user in a clear and comprehensible manner at least the information listed in Article 3(3), points (a) to (i), among them the nature, estimated volume and collection frequency of the product data the prospective data holder is expected to obtain, whether it expects to use readily available data itself and for which purposes, how the user can request that the data are shared with a third party, the user's right to lodge a complaint with the competent authority designated under Article 37, and the duration of the contract and the arrangements for terminating it (Article 3(3)).

Tell the data subject, when collecting their data (or, where the data came from another source, within the Article 14(3) period) and on any access request, that this kind of automated decision-making occurs, and give meaningful information about the logic involved, the significance, and the envisaged consequences.

If you are a digital labour platform, inform persons performing platform work, platform workers' representatives and, upon request, national competent authorities of the use of automated monitoring systems or automated decision-making systems (Article 9(1)).

Include in that information, for an automated monitoring system, the fact that it is in use or is in the process of being introduced, the categories of data and action monitored, supervised or evaluated, including evaluation by the recipient of the service, the aim of the monitoring and how the system carries it out, and the recipients or categories of recipient of the personal data processed and any transmission or transfer of it, including within a group of undertakings (Article 9(1), point (a)).

If you make solely automated decisions about a person in Finland of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

If you make solely automated decisions about a person in France of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

When you collect personal data from a minor under fifteen in France, give them the information GDPR Article 13 lists in clear, easily accessible language, under Loi n. 78-17 Article 48.

At collection, tell the person your identity, the data protection officer's contact details where designated, the purpose and legal basis, any legitimate interest relied on, recipients, any transfer abroad, the retention period or the criteria for it, their rights including withdrawal of consent, their right to complain to the APDPVP, and the existence and logic of any automated decision-making or profiling that concerns them.

Where you did not collect the data from the person, give them the same categories of information, including the data's origin and whether it came from a publicly accessible source, within one month, or by the time you first contact them or first disclose the data to another recipient, whichever is earliest.

Give a data subject your identity, the purposes of the processing, the recipients of the data and your legal basis, at the time you collect their personal data or within a reasonable period where you obtained it indirectly.

If you make solely automated decisions about a person in Germany of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

If you make solely automated decisions about a person in Greece of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Inform employees in Greece in writing or electronically of the installation and operation of closed circuit television in the workplace, which is permitted only where necessary for the protection of persons and goods (Law 4624/2019, Article 27(7)).

Give the data subject notice of the purpose and source of collection, their access and rectification rights, the classes of third party the data may be disclosed to, and whether supplying the data is obligatory, when they request it.

Let the recipient learn, before and during use of the service, which kinds of data you process for which purposes (Section 13/A, paragraph 9).

If you make solely automated decisions about a person in Hungary of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

If you monitor an employee's conduct in connection with the employment by a technical means, inform the employee of it in writing in advance (Labour Code Section 11/A, paragraph 1).

If you make solely automated decisions about a person in Iceland of the kind the incorporated GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under the incorporated GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Offer an Iowa consumer an opt-out of the sale of personal data. If you sell personal data to third parties or engage in targeted advertising, disclose that clearly and conspicuously together with the manner in which a consumer may opt out of it. ICDPA gives no right to opt out of profiling.

If you make solely automated decisions about a person in Ireland of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

After furnishing the copy, advise the patient or the specified person in writing that you have done so (Section 8, paragraph 3).

If you make solely automated decisions about a person in Italy of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Carry in every direct marketing communication the identity of the sender and an address or other contact details the recipient can use to ask that the communication cease.

Notify a data subject in writing when a decision about them is based solely on automated processing, including profiling, that produces a legal or similarly significant effect, and allow them to request reconsideration or a new decision that is not based solely on automated processing.

Tell a data subject before collecting their personal data who the controller is and how to contact them, the purpose of the processing, how to exercise their Part IV rights, and how to lodge a complaint with the Digital Transformation Office, and give that information as soon as possible afterward where it could not be given beforehand.

Tell a data subject, at the point you collect or first obtain their personal data, your identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and their rights, within one month where the data came from elsewhere.

Stop processing personal data for direct marketing, including related profiling, as soon as a data subject objects, and bring that right to their attention explicitly and separately no later than the first communication with them.

If you make solely automated decisions about a person in Latvia of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Tell the people you collect personal data from who you are or who your representative is, what the processing is for, whether answering is mandatory or optional, what follows from not answering, who the data will be sent to, and that they may access and correct it, and print that statement explicitly and clearly on the collection form itself.

Where you did not collect the data from the person, tell them personally and explicitly what the data contains, what the processing is for and that they may object to it, unless they already know or telling them is impossible or takes an effort out of proportion to the benefit.

Give a data subject notice, before or as soon as practicable after collecting personal information about them, of your name and address, the purpose of the collection, whether supply is mandatory, and the consequences of not providing it.

Before processing a person's data, give them notice of who is responsible for the processing and the nature, purpose, and method of the processing.

If you make solely automated decisions about a person in Liechtenstein of the kind the incorporated GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under the incorporated GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

If you make solely automated decisions about a person in Lithuania of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

If you make solely automated decisions about a person in Luxembourg of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Tell a person, when you collect their personal data, who you are, the purpose of the processing, whether the information is mandatory or optional, the data categories, the recipients, their rights of objection, access, and rectification, and any transfer and its safeguards, and give the same notice, including how to object, before storing or reading information on their communications-terminal equipment.

When collecting personal data from a data subject, tell them who the data controller is, together with any representative, the purpose of the processing, and that they have rights of access, rectification and objection.

A Controller must tell a data subject about the processing of their personal data and answer a request to access it, correct it, erase it, restrict its processing, receive it in a portable form, or object to the processing.

At collection, or before transmitting data you did not collect directly, tell the person your identity, the purposes of processing, the categories of data, the recipients, whether answering is obligatory or optional and the consequences of not answering, their right to ask to no longer appear in the file, their rights of access and rectification, the retention period, and any transfer abroad you envisage.

Before accessing or writing information to a user's connection terminal equipment over an electronic communication network, clearly and completely tell them the purpose and how to object, unless doing so is solely to enable the communication itself or is strictly necessary to supply a service the user expressly asked for.

If you make solely automated decisions about a person in Malta of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.

Where you did not collect the data from the person directly, give them the same information when you record it or, if you plan to disclose it, no later than the first disclosure.

Give a data subject, at collection, your identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, and where the data came from elsewhere, its source and the categories concerned.

Tell a person, at the point you collect their data, who you are, the purposes and legal basis of the processing, any legitimate interest relied on, the categories of data, the retention period or the criteria for setting one, whether a reply from them is mandatory, the right to withdraw consent, the recipients, how to exercise their rights, the right to complain to the Authority, whether automated decision making including profiling is in use, and any transfer outside Monaco and its safeguards.

Stop processing a person's data for direct marketing, including any profiling tied to it, the moment they object, and flag that right to them clearly and separately no later than the first communication.

Explain to a Mongolian data subject a decision made by processing their data electronically without human involvement, and its consequences.

Give a person from whom you collect personal data directly notice of your name and address, the purpose and legal basis of processing, the third party or user and the legal basis for disclosing to it, whether giving the data is mandatory or voluntary, and their rights of access and rectification, under Article 20, and give a similar notice no later than immediately before processing begins where the data were not collected directly, under Article 21.

Before or when you collect personal data directly from the data subject, tell them, expressly, precisely, and unambiguously, your identity, the purposes of the processing, and, where fair processing requires it, the recipients, whether their response is mandatory, and their access and rectification rights.

Where you did not collect the data from the data subject, give them that same information no later than the first disclosure to a third party, unless they already have it.

Where personal data was not collected from the data subject directly, give the subject the reason it was collected and your identity as the processor, by the time the data is first disclosed to a third party, unless notice is impossible, disproportionately burdensome, permitted by law, or the data is collected for statistical, historical, or scientific purposes.

Make available to any person specific information about your policies and practices for managing personal information, including who to contact with a complaint or question, how to obtain access to personal information you retain, and a description of the type of personal information retained and its general use.

If you make solely automated decisions about a person in the Netherlands of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Before obtaining a data subject's personal data, tell them, expressly and clearly, the purpose and possible recipients, the existence and location of the file and who is responsible for it, whether answering is mandatory or optional, the consequences of refusing or of giving inaccurate data, and their rights of access, rectification, and cancellation.

Tell a data subject about the privacy policies you adopt and notify them of any change to those policies.

Give the data subject information about the processing no later than the time you collect their data.

Let a person know and contest the information and reasoning used in any processing of their data, automated or not, whose results are used against them, and, where the processing involves artificial intelligence, tell them the criteria and the nature of the personal data behind it from the point of collection.

Carry a clause on the right to lodge a complaint with the Commission in every regulation, policy, framework or legal instrument of yours that pertains to processing personal data, and answer a Standard Notice to Address Grievance a data subject serves on you.

Give a data subject the information section 27 of the Act requires in clear terms, taking their circumstances into account.

If you make solely automated decisions about a person in Norway of the kind the incorporated GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under the incorporated GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Let a data subject ask for review of a decision based on automated processing of their personal data that adversely affects their interests or produces legal effects, express their point of view and contest it, and on request give them clear, complete information about the criteria and procedures the decision used.

Tell a data subject what article 27 requires about the processing of their personal data.

Tell a person, in detailed, simple, express and unequivocal terms before collecting their personal data, the purpose of the processing, who its recipients are, the data bank's existence and its owner's identity and address, whether their answers are mandatory or optional, any transfer, how long you will keep the data, and how to exercise their rights; an easily accessible and identifiable privacy policy satisfies this for data collected online.

Tell a person when you engage a new processor after they gave consent, or when a merger, portfolio acquisition, or similar transfer gives their data a new data-bank owner.

If you make solely automated decisions about a person in Poland of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

If you make solely automated decisions about a person in Portugal of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Before or at the time you communicate a decision based exclusively on automated processing of personal information, tell the person that the decision was made this way.

At collection, give the data subject your identity, the purposes and categories of data, the recipients, whether a reply is obligatory or optional and the consequences of not replying, their right to be removed from the file, their rights of access and rectification, the retention period, and any transfer envisaged to a third country.

Let a data subject object to processing of their personal data on legitimate grounds, and tell them, before their data is first communicated to or used by a third party for prospecting, of their free right to object to it.

If you make solely automated decisions about a person in Romania of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Before or when collecting personal data, tell the data subject your identity and contact details, the purposes and recipients, whether provision is mandatory, their rights including to withdraw consent, access, rectify, restrict, erase, object and appeal, the retention period, and the existence and consequences of any automated decision making.

Identify the purposes for which customer information is collected at or before collection, and do not collect, use, maintain, or disclose customer information for an undisclosed purpose without the customer's consent or legal authority.

Give a data subject, at collection, your identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, and where the data came from elsewhere, its source and the categories concerned.

Inform the data holder, at collection, of your identity, the purpose of the processing, and their right of access and rectification, and where you did not collect the data from the holder directly, give that information by the time you register the data or before you first disclose it to a third party.

Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.

Where you did not collect the data from the person directly, give them the same information when you record it or, if you plan to disclose it, no later than the first disclosure, unless it falls within the state-security, defence, criminal-enforcement, or major economic-interest exemption.

Tell a person, at the time you collect their personal data from them, your identity and contact details, the purpose and legal basis of processing, the recipients, any cross-border transfer, the retention period, and their rights.

Where personal data was not collected from the person, give them the same information, plus its source and category, within a reasonable time and no later than when you first communicate with them or disclose the data to someone else.

If you make solely automated decisions about a person in Slovakia of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

If you make solely automated decisions about a person in Slovenia of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Before you collect personal data, tell the data subject who you are, the basis and purposes of the processing, who you will share the data with, their rights and their right to complain to the Authority, and describe any automated decision-making and its likely consequences.

Before or when you collect personal information, tell the data subject what is being collected and its source, your identity, the purpose of collection, whether supplying it is voluntary or mandatory, any intended transfer to another country, and their rights of access, correction, objection and complaint to the Information Regulator.

An app that makes a decision about a Korean data subject using a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, must let the subject object to or request an explanation of the decision, must not apply the decision over an objection absent a compelling reason or must reprocess it with human involvement, and must disclose the criteria and procedures it uses for automated decisions.

If you use a person's data in Spain for profiling, state in the basic information you give them that they may object to a solely automated decision that produces legal or similarly significant effects on them, where GDPR Article 22 gives that right, under LOPDGDD Article 11(2).

If you make solely automated decisions about a person in Spain of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Give a data subject the transparency information article 10(3) lists, including your identity, the purposes and legal basis of processing, recipients, retention period, and their rights, at collection, or, where the data did not come from the data subject, within a reasonable time and at latest within one month.

Let a data subject obtain confirmation that you are processing their personal data, and on request give them the reasons underlying a decision produced by processing their data.

If you make solely automated decisions about a person in Sweden of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Tell a data subject, at the latest when you collect their personal data directly from them, your identity, the purposes of the processing, the categories of data and recipients, whether answering is mandatory, their right to be excluded from the file, their rights of access and rectification, the retention period, and any transfer abroad you envisage.

Let a data subject object, on legitimate grounds, to the processing of their personal data, and tell them before their data is first disclosed to or used by a third party for prospecting, offering a free right to object to it, unless the processing meets a legal obligation.

At the time you collect personal information, tell the data subject your identity and contact details, that you are collecting it, the purpose including any direct marketing, whether sensitive personal information is collected and of what nature, and who the intended recipients are.

Give the person written notice, at least one month before processing their data, of its nature, the processing's purpose, whether their answer is mandatory or optional, the recipient's and your own identity and address, their rights of access, withdrawal and objection, the retention period, a summary of your security measures, and the destination country of any transfer.

Before or as soon as practicable after collecting personal data, tell the data subject its nature and category, your name and address, the purpose, whether supplying it is discretionary or mandatory, the consequences of not providing it, the recipients, their rights of access and rectification, and the retention period.

Disclose your automated decision making mechanisms to a data subject in Ukraine, under Article 18.

Before or when you collect personal data, tell the data subject expressly, precisely, and unambiguously the purpose of the processing and who may receive it, the existence and identity of the database's controller, whether answering is mandatory, the consequences of refusing or of inaccuracy, their rights of access, rectification, and challenge, whether the data will be transferred internationally, and, for an automated-decision process, the valuation criteria, the process applied, and the technology or program used.

Stop processing personal data for direct marketing as soon as the data subject objects, and bring the rights of objection to their attention clearly and separately at your first communication with them.

Give a data subject notice of who is responsible for processing and why, and let them access, object to, correct, or have deleted false or misleading personal data about them.

Make the disclosures section 15 requires when you collect personal information directly from the data subject.

Inform the data subject about the processing of their personal data, and process it confidentially and with security measures against unauthorized access.

If you process the personal data of Colorado residents at the qualifying volume thresholds, give clear privacy notice and honor consumer requests to access, correct, delete, and port their data within 45 days.

If you use facial recognition technology on your premises to prevent, detect or respond to security incidents, fraud or similar activity, use it only to match images against a database you maintain, and post signage at each entrance, other than an entrance to an area restricted to authorized employees, that links to your facial recognition technology policy.

Before collecting a person's personal data, inform them of the purpose of collection and obtain their express, written consent, unless the data are publicly accessible or a law or judicial order compels disclosure.

Before transferring personal data to another party, obtain the data subject's prior consent and tell them the transfer's purpose and the recipient's identity.

Process personal data lawfully, fairly and in a transparent manner in relation to the data subject (Article 5(1), point (a)).

Before introducing camera surveillance, examine less intrusive means, keep the intrusion on employee privacy to what is necessary, use recordings only for the purposes of the surveillance, inform employees after the cooperation or consultation procedure, and announce the surveillance visibly in the premises where cameras are placed (Section 17, paragraph 1).

Tell a data subject, before or as soon as practicable after collecting their personal data, the nature of the data, your identity, the purpose of collection, the recipients, and whether supplying the data is mandatory or discretionary.

Give the data subject your identity, the identity of your data protection officer, the purposes of the processing, the recipients you contemplate disclosing to, the expected retention period and the legal authority for seeking the data, before you first process it.

An app that collects, uses, or discloses the personal data of an individual in Japan must give notice of, or publicly disclose, its purpose of use before or promptly after collection, must not acquire the data by wrongful or deceptive means, and must confine use to the stated purpose unless a statutory exception or the data subject's consent applies.

Give the notice or public announcement of the purpose of use that Article 21 requires, and the notice of a data breach that Article 26(2) requires, to the legal representative of a person under 16 and not to the person (Article 40-2(1)).

Before personal information enters your system, or at the next practical opportunity, give the data subject the description, purposes, scope and method of processing, the recipients, your identity and contact details, the storage period and the existence of the rights of access, correction and complaint.

Before the monitoring starts, inform the joint committee or, failing it, the staff delegation or, failing that, the Labour and Mines Inspectorate, or for statutory staff the staff representation bodies, with a detailed description of the purpose, the way the system works and any retention period or criteria, and give a formal commitment not to use the data for another purpose (Article L.261-1, paragraph 2).

Give the data subject a privacy notice, at or before the first collection of their personal data, stating your identity and address, the categories of data collected and which are sensitive, the purposes that require consent, the options to limit use or disclosure, the ARCO mechanisms, and how you will communicate any change to the notice.

Specify the purpose for collecting personal data and your identity as the processor before collecting it, and limit any later use to that stated purpose.

Limit personal data collection to what is adequate, relevant, and reasonably necessary, and describe your purposes in a privacy notice.

If you collect personal information about an individual other than from that individual, including by scraping it from a third-party source, take reasonable steps to make the individual aware, as soon as practicable after collection, of the fact of collection, its purpose, the intended recipients, your identity, any legal authority for the collection, and their access and correction rights.

Before deploying data processing software that tracks a data subject or opens a communication link with one, carry out an impact assessment, design it for privacy by design and by default, put a data privacy policy inside the software, and give a prospective user a privacy statement before installation.

Publish a clear, visible notice that video surveillance is in place before operating it, naming the controller and explaining how to learn the place and storage period of the recordings, and notify employees of video surveillance on official or business premises.

Present a clear, distinguishable privacy notice before collecting personal data online, and keep any bundled consent request identifiable from the rest of the terms.

Before collecting personal information through technology with functions that identify, locate or profile the individual, disclose that use and the means available to activate those functions.

Before collecting personal data, tell the data subject the purpose of collection, the source of the data where available, the classes of third party it may be disclosed to, whether supplying the data is obligatory or voluntary, and how to request access or correction.

Before collecting personal data directly from a person, tell them what is being collected, why, who will receive it, whether providing it is mandatory, the consequences of not providing it, and their rights to access, correct, and have it destroyed.

Where your processing is exempt from notification, still give any person who asks your identity, the processing's purposes, and the data holder's rights of access and rectification.

An app that collects, uses, or discloses the personal data of an individual in Singapore must obtain the individual's consent, or rely on a Part 3 or Schedule exception, and must state its purpose for the collection, use, or disclosure.

Disclose to a consumer the purpose of collecting information about them, and do not use or maintain that information for an undisclosed purpose.

An app that collects or processes the personal data of individuals in Tajikistan must obtain the subject's consent, limit processing to a specific, predetermined, lawful purpose, and notify the subject of the data collected about them with a right to correction.

Make available to individuals your policies and practices for managing personal information, and give an individual the ability to challenge your compliance with these Principles and a timely, appropriate response.

Obtain the INPDP's prior authorization before using video surveillance, confine it to the listed categories of place, never pair it with audio recording, and post clear, permanent notice that it is in use.

Communicate personal data to a third party only for a purpose directly tied to the sender's and recipient's legitimate interest, only with the data subject's prior consent, and only after telling them the purpose of the communication and identifying the recipient.

Provide Utah consumers a reasonably accessible, clear privacy notice describing the categories of personal data you process, the purposes, how consumers may exercise their rights, and any third parties you share data with, if you meet UCPA's 25 million dollar revenue and consumer-volume thresholds.

Do not disclose personal data without the data subject's consent, and before any disclosure tell them when and to whom it will be disclosed, why, what policies will protect it, and how to complain.

It reaches you if you provide an internet access service or a publicly available number-based interpersonal communications service, meaning an interpersonal communications service that connects with publicly assigned numbering resources or enables communication with a number in a national or international numbering plan (Article 2, point (6), and Article 115(1)): where the competent authority of the Member State requires it, make calling-line identification available free of charge, subject to technical feasibility, so that the calling party's number is presented to the called party prior to the call being established (Article 115(1) and Annex VI, Part B, point (a)).

Where you make calling-line identification available, provide it in accordance with the relevant law on protection of personal data and privacy, in particular Directive 2002/58/EC, and, to the extent technically feasible, provide data and signals to facilitate the offering of calling-line identity and tone dialling across Member State boundaries (Annex VI, Part B, point (a)).

Do not intentionally prevent transmission of your name or telephone number to the party called when your equipment can create and transmit it, and do not use technology that displays a different caller identification number than the one the call actually originates from to conceal your identity.

Identify yourself immediately, by your true first and last name and the business on whose behalf you are soliciting, upon making contact in an unsolicited telephonic sales call.

Transmit your originating telephone number, and your name where your carrier makes it available, to the caller identification service of anyone you place a telephonic sales call to, and do not intentionally alter your voice to disguise your identity in order to defraud, confuse, or injure the recipient.

When you collect a consumer's telephone data, tell the consumer that any commercial telephone solicitation needs their prior consent, unless it is made in the performance of a current contract. Where you collect the data on concluding a contract, state in the contract, clearly and understandably, that canvassing a consumer by telephone without prior consent is prohibited.

When you call a person to advertise to them, do not suppress the display of your telephone number and do not have your telecommunications provider suppress it, and ensure that the number assigned to you is transmitted to the person called (section 15(2)).

Disconnect within 30 seconds after the call ends; if that is not technically feasible, have a live operator state their name, the name, address, and telephone number of the business or organization represented, and the purpose of the call, and ask at the outset whether the called person consents to hear the prerecorded message.

Do not use an autodialer to dial numbers by successively increasing or decreasing digits, and do not operate it in a way that impedes a called party's caller ID display when your equipment can display your number.

As a live operator, immediately state your name, the name of the business or organization you represent, and the purpose of the call, ask at the outset whether the called person consents to the solicitation, and do not continue without that consent.

Do not solicit in a way that impedes a called party's caller ID display when your equipment can display your number.

When you call for those purposes, guarantee the presentation of your calling line identification.

At the time of the call, or in the paper mailing, state that the person's data were lawfully extracted from the subscriber lists or from other sources and give the information useful for registering in the register.

If your telephone service or equipment lets you choose whether to display your number, do not block or otherwise prevent its transmission to the person you are soliciting.

On every telephone solicitation, transmit your originating telephone number, and your name where your carrier makes it available, to the called party's caller identification service (the seller's name and customer service number may stand in), do not act to block that transmission, and do not use technology that displays a different number to conceal your identity.

Before saying anything else besides a greeting, state your identity, the trade name of the person you represent, and the kind of goods or services you are offering, when soliciting a sale by telephone at a prospective buyer's residence, and do not use a plan, scheme, or ruse that misrepresents your true status or purpose for doing so.

Identify yourself, the company you are calling on behalf of, and the purpose of the call within the first minute of a telephonic sales call, before requesting, accepting, or arranging for payment, and disclose the ultimate seller's name and a complete and accurate description of the goods or services offered, including their retail value, plus the cost, any restrictions, and the refund and cancellation terms, before accepting payment.

At the start of a telephone solicitation to a residential subscriber, state your name and the full name of the organization or person on whose behalf the call is made, and provide on request a telephone number answered by a natural person who can describe the organization and the solicitation; do not intentionally block or interfere with the caller ID display of your number.

Do not deliver or attempt to deliver intrastate commercial advertising while blocking the display of caller identification information the subscriber would otherwise see.

When contacting a consumer, promptly and clearly disclose your identity, that the purpose of the call is to sell goods or services, the nature of the goods or services, and that no purchase or payment is necessary to win a prize or enter a prize promotion.

State your identity clearly at the start of every telephone solicitation call to a Montana residential subscriber, and do not knowingly block or circumvent the subscriber's caller identification service.

When you send such communication through a public telephone service, do not use the facility that blocks the provision of the calling number (Article 11.9(1)(a)).

Do not block or otherwise intentionally circumvent a service used to identify you as the caller, and do not place an unsolicited call that such a service cannot identify by your telephone number or business name, unless identification is not technically feasible.

When soliciting a sale or lease by telephone, identify yourself, whom you represent and the purpose of the call within 30 seconds after the conversation begins.

Before a device for automatic dialing and announcing plays a prerecorded sales message, have a recorded or unrecorded natural voice tell the person who answers the nature of the call, including that such a device will deliver the message if they stay on the line, and give the name, address and telephone number of the business or organization you represent.

Whatever equipment you use, do not disseminate an unsolicited prerecorded sales message by telephone in the course of your business to a person with whom you have no preexisting business relationship unless a natural voice first gives the nature of the call and your business's name, address and telephone number.

Do not make an unsolicited call for the sale of goods or services to a number on the currently effective registry list, unless you have a preexisting business relationship with that person (a purchase or other financial transaction directly with you within the preceding 18 months), keep an internal do-not-call registry of people who asked you not to call, and send each such customer an annual written notice explaining how to join it.

Disclose the name of the caller, the purpose of the call and any goods or services offered immediately after the called party answers, and configure the system to disconnect within 30 seconds after the called party hangs up.

Do not use per-call or per-line blocking, or any other method, to prevent your caller identification information from reaching the called party; that information must include a number at which you can receive calls and may not be misleading, inaccurate or deceptive.

Do not use equipment or techniques designed to block or avoid detection of your identity or telephone number by caller identification devices, and do not use automatic dialing equipment that results in more than five percent abandoned calls a day in a calling campaign.

Transmit your originating telephone number, and your name when your carrier makes it available, to the recipient's caller identification service; you may substitute the seller's name and its customer service number, answered during regular business hours, and any number you display must be able to receive calls and connect the caller to you or to the seller.

As a commercial telephone seller or salesperson, do not make a commercial telephone solicitation call before 8 a.m. or after 8 p.m. in the called person's time zone, or more than three such calls to one person in 24 hours on the same subject matter from any number, and do not block your name or number or display a different caller identification number to conceal your identity.

When you represent free items, offer metals, stones or minerals or an oil, gas or mineral interest, or offer office equipment or supplies below usual prices, give the prospective purchaser, at the time of the solicitation and before any sale, the street address you are calling from, your principal address, and the further information ORS 646.557 lists for that kind of offer.

During the initial contact, disclose promptly the purpose of the call, your name and what you are selling; give the caller's name, the name of the person on whose behalf you call and, on request, a contact number or address; end the solicitation when the called party indicates they want to end it.

Do not act to block or falsify your name or number on the recipient's caller identification, or to circumvent, bypass or disable a call-screening product the subscriber uses, and do not use any technology or any synthetic or computer-generated messaging to defraud, deceive or mislead a subscriber.

State the nature of the call, your identity, and the number you are calling from within the first 30 seconds of the recorded message, add the pay-per-call disclosures where the call promotes such a service, and keep a solicitation message shorter than 30 seconds unless the device can recognize an answering machine and end the call within 30 seconds.

When you make a facsimile solicitation from Texas, include in at least 12-point type your complete name and street address and a toll-free or local number answered by a person on weekdays from 9 a.m. to 5 p.m. or that automatically deletes the recipient's number; on a stop request, send a written acknowledgment within 24 hours and make no further transmission to that number.

In making a telemarketing call, do not block your number, interfere with or circumvent a caller identification service, fail to provide caller identification information you are capable of providing, or transmit misleading caller identification information; you may substitute the name and number of the person on whose behalf you call.

Get the called subscriber's prior consent before transmitting, or instigating the transmission of, recorded matter for direct marketing purposes by an automated calling or communication system (one that can automatically dial a sequence of numbers and play sounds that are not live speech), and either do not prevent presentation of your calling line's identity or present a line on which you can be contacted.

Whether or not the call is solicited, do not prevent presentation of your calling line's identity, or present a line on which you can be contacted, when making a call for direct marketing purposes.

On a solicitation made by telephone call, identify yourself by your first and last name and name the person on whose behalf you are calling, promptly upon making contact.

On every solicitation, transmit your telephone number, and your name where your carrier makes it available, through a number at which any individual can ask during regular business hours not to receive solicitations (for a text message, a number that accepts a reply-text opt-out), and do not block that transmission or cause false or misleading caller-identification information to display; the seller's name and customer service number may be substituted.

Identify yourself and the company or organization on whose behalf you are calling, and the purpose of the call, within the first 30 seconds of a telephone solicitation call.

It reaches you if you are a service provider, meaning a natural or legal person providing an information society service (Article 2, point (b)), and you send or show a commercial communication that is part of, or constitutes, that service: make the commercial communication clearly identifiable as such, and make the natural or legal person on whose behalf it is made clearly identifiable (Article 6, points (a) and (b)).

Never send a direct-marketing electronic mail (including a text message) that disguises or conceals the sender's identity, that itself contravenes Directive 2000/31/EC Article 6's disclosure rules, or that has no valid address the recipient can use to ask that the messages stop, and never encourage the recipient to visit a website that itself breaches those rules.

Make every e-mail, text, voice, sound or image message intended for direct marketing under sections 200 and 202 clearly and unambiguously recognizable as marketing when it is received, and do not send one that conceals the identity of the sender on whose behalf it is sent, has no valid address for a request to stop the communication, or tries to steer recipients to websites that breach Chapter 2 of the Consumer Protection Act (section 203).

Do not conceal the identity of the person on whose behalf the message is sent, and do not state a subject unrelated to the service or product offered.

Make commercial communications that are digital services, or parts of digital services, clearly recognizable as such, and make the person on whose behalf they are made clearly identifiable (section 6(1) numbers 1 and 2).

When you send a commercial communication by email, do not disguise or conceal the sender or the commercial character of the message in the header and subject lines: designing them deliberately so that the recipient gets no or misleading information about the sender's actual identity or the commercial character before reading the content is disguise or concealment (section 6(2)).

Never send an advertising message that disguises or conceals the sender's identity on whose behalf it is transmitted, that fails to identify the message clearly as a commercial communication with a clearly identifiable sender and clearly identifiable, easily accessible terms for any promotional offer or prize draw, or that invites the recipient to a website with the same failing.

Do not send electronic mail for direct commercial promotion that omits the clearly stated identity of the sender or of the person for whose benefit it is sent, that has no valid address at which the recipient can ask for the communication to stop, or that encourages recipients to visit websites that breach the Article.

In a marketing call, include your name and, if applicable, the name of the person on whose behalf you call; in an automated-calling or fax communication, include the name, address and telephone number of the sender and, if applicable, of the person on whose behalf it is sent; and in a marketing email, include a valid address at which you can be contacted.

Never disguise or conceal your identity in a marketing email, never omit a valid address the recipient can use to stop future messages, and never encourage recipients to visit websites or otherwise breach Regulation 8 of the Electronic Commerce Regulations 2003, which requires a commercial communication, and the person on whose behalf it is made, to be clearly identified.

Do not send such communications, or any communication for promotional purposes, while disguising or concealing the sender's identity, in breach of Article 8 of Legislative Decree 70/2003, without giving a suitable contact where the data subject can exercise the rights in Articles 15 to 22 of the GDPR, or by urging recipients to visit websites that breach that Article 8.

Make every commercial communication that is an information society service, or an integral part of one, state from the first sending, clearly and unequivocally, that it is a commercial communication, the natural or legal person on whose behalf it is sent, that it is a promotional offer (a discount, prize or gift) and its conditions of access, and, for promotional contests or games where permitted, their conditions of participation.

Make every commercial notice clearly recognizable as one, make clear the person on whose behalf it is distributed, state the offer and the terms of receiving the service precisely, make discounts, bonuses and prizes and the terms of receiving them clear, make promotional contests, lotteries and games and their participation terms clear and easy to find, and give the recipient the chance to refuse further commercial notices (article 8, paragraph 1).

Do not send electronic mail for direct marketing that conceals the identity of the sender on whose behalf it is sent, that gives no valid address at which the recipient can demand that sending stop, or that encourages recipients to visit websites that do not meet the requirements of the Law on Information Society Services.

Make it possible to identify the natural or legal person on whose behalf the commercial information is provided.

Do not send electronic messages for direct marketing that disguise, conceal or misrepresent the identity of the sender on whose behalf the communication is made, or that give no valid address to which the recipient can send a request to stop such communications.

Do not send direct marketing electronic mail that disguises or conceals the identity of the sender on whose behalf it is made, that contravenes regulation 6 of the Electronic Commerce (General) Regulations, that has no valid address to which the recipient may send a request that the communications cease, or that encourages recipients to visit websites that contravene that regulation (regulation 9(4)).

A commercial e-mail you intentionally send unsolicited through an e-mail service provider you knew or should have known is located in Michigan, or to an address you knew or should have known is held by a Michigan resident, must carry "ADV:" as the first four characters of the subject line, your legal name, correct street address, valid domain name and valid return e-mail address, and a toll-free number, return e-mail address or other easy electronic method the recipient can use to opt out, with a notice of it in print as large as most of the message; this labeling, identification and opt-out duty is not framed as a rule against falsity or deception.

In every such electronic message, state the real identity of the person on whose behalf the communication is sent and a valid postal address or number to which the recipient can send a request to end such communication. The requirements of Article 15e(1)(a) to (c) of Book 3 of the Civil Code apply to those messages, and they may not encourage the recipient to consult information on the internet that breaches that article.

Before sending, or causing to be sent, email that includes an advertisement, either have a preexisting business or personal relationship with the recipient, obtain the recipient's express consent, or make the advertisement identifiable as promotional and clearly give your legal name, complete street address and email address, a notice of how to decline further advertising mail, and ADV or advertisement as the first word of the subject line.

Name the entity on whose behalf the commercial information is distributed and give its electronic addresses.

In an advertising communication provided at a distance by electronic means, clearly identify, so that an average recipient grasps them easily, the advertising nature of the message as soon as it is presented on the terminal and in a conspicuous way, the advertiser, and any promotional offers such as discounts, prizes or gifts and any promotional contests or games, together with the conditions attached to them.

Do not send electronic mail for direct marketing that conceals or disguises the identity of the person on whose behalf the communication is made, that gives no valid means of contact to which the recipient can send a request to stop, or that encourages recipients to visit websites that breach Article 21 of Decreto-Lei 7/2004.

Do not send commercial communications by electronic mail that hide the real identity of the person on whose behalf they are made contrary to article 5 of Law 365/2002, that give no valid address to which the recipient can send a request to stop such communications, or that encourage recipients to visit internet pages contrary to article 5 of Law 365/2002 (article 12, paragraph 3).

Do not send e-mail from which the identity and address of the sender, to which the recipient can send a request to end such messages, are not known, and do not encourage a visit to a website in breach of a special regulation (section 116, paragraph 15).

Do not send direct-marketing e-mail, contrary to the law on electronic commerce, that hides or disguises the identity of the sender on whose behalf it is sent or has no valid address to which the recipient can send a request to stop such messages, and do not send direct-marketing e-mail that invites recipients to visit websites contrary to that law (article 226, paragraph 5).

Make every commercial communication you send by electronic means clearly identifiable as a commercial communication, and clearly identify the natural or legal person on whose behalf you send it (Article 20(1)).

Do not send commercial communications that disguise or conceal the identity of the sender on whose behalf they are sent, that contravene Article 20, or that invite recipients to visit Internet pages that contravene it (Article 20(4)).

When a person tells you they do not want their data processed to send them commercial communications, inform them of the existing advertising exclusion systems, which you may do by referring them to the information the competent supervisory authority publishes (Article 23(3)).

Do not disguise or conceal the identity of the person on whose behalf a marketing message is sent, and always provide a valid address the recipient can use to ask you to stop.

Do not send a marketing message that breaks the Electronic Commerce (EC Directive) Regulations 2002's identification rules for commercial communications, or that encourages the recipient to visit a website that breaks them.

Every commercial email must carry accurate header and routing information, a subject line that is not deceptive about the message's contents, clear and conspicuous identification that the message is an advertisement unless the recipient gave prior affirmative consent, a functioning return address or other opt-out mechanism, and a valid physical postal address of the sender.

Where your online service is aimed at children, build in privacy-protective technical measures such as marking and filtering, write information for them in terms they can understand, keep advertising, entertainment and games clearly distinct from content, never incite a child to buy goods or enter an online contract, and never use prizes, rewards or links to a non-compliant site to keep them engaged.

Apply specific safeguards to any marketing or profiling directed at children, and put anything addressed to a child in clear, plain language they can easily understand.

Inform the public in clear and simple language of the purposes for which you further process data, and tell a data subject on request the nature, extent and purpose of the processing for research or statistics (Section 6, paragraph 4).

If you reuse personal data without direct identifiers for that research without further consent, still inform the data subject, which a general notice on your website can satisfy, unless knowing the data subject's identity is inevitable or necessary to protect their health (Article 8, paragraph 2).

Inform the data subject under GDPR Article 13 before processing personal data to anonymize, pseudonymize or synthesize it (Article 8, paragraph 3).

Before you request or obtain a consumer report containing personal information about a consumer, give the consumer written notice, and give the consumer the agency's name and address on request.

If you deny a benefit or increase a charge wholly or partly because of information from a consumer reporting agency or another person, give the consumer notice when you communicate the action and, if the consumer asks within sixty days, say what the information was and where it came from or give the agency's name and address.

Have information practices that comply with the Act, follow them, designate a contact person if you are not a natural person, and make available to the public a written statement describing your information practices, how to contact you, how to seek access or correction and how to complain.

As a health information network provider, give each custodian a plain language description of your services that is suitable for sharing with patients, including the safeguards in place, and make that description and your applicable directives, guidelines and policies available to the public, other than a trade secret or confidential scientific, technical, commercial or labour relations information.

If you use or obtain a consumer report, do so only for a purpose section 1681b authorizes and certify that purpose; before procuring a report for employment purposes, make a clear and conspicuous written disclosure in a document that consists solely of the disclosure and get the consumer's written authorization, unless the transportation-applicant procedure in section 1681b(b)(2)(B) applies.

If you use a consumer report for employment purposes and intend to take adverse action based on it, first give the consumer a copy of the report and a written description of the consumer's rights under the Act, unless the transportation-applicant procedure in section 1681b(b)(3)(B) applies.

Obtain a Utah consumer's initial express consent before collecting, using, or disclosing their genetic data through a direct-to-consumer genetic testing product or service, and give them a public privacy notice describing your data practices.

Give Utah consumers clear notice and an opportunity to opt out before processing their sensitive data, including biometric data such as a voiceprint, retina scan, iris scan, or fingerprint collected for the purpose of identifying a specific individual.

Before processing a child's personal data, obtain the consent of a parent, carer or legal guardian, communicate with the child in clear and plain language, and put appropriate age-verification mechanisms in place, unless the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.

Before you record information and related traffic data in lawful business practice to provide evidence of a commercial or other business transaction that may have legal consequences, inform the users of the recording and its purpose, and keep the recorded content and traffic data no longer than the period during which the transaction can be legally challenged.

If you record communications and the related traffic data in lawful professional practice to provide proof of a commercial transaction or other commercial communication, inform the parties beforehand that recordings may be made, why, and for how long they will be kept at most, and delete the recordings as soon as the purpose is achieved and in any event when the legal period for challenging the transaction expires.

Do not record a conversation with a hidden electronic or mechanical device without the knowledge of all parties; a warning of the recording given by any one person is enough, and once it is given either party may record.

Do not purposely intercept an electronic communication, including a chat or other data sent by wire or radio, unless the persons involved were warned of the interception.

Do not obtain any part of an in-person conversation or a conversation occurring through a video conferencing program by means of a recording device unless every participant is specifically informed that the conversation is being obtained, whether or not you are yourself a participant.

You may record communications and the related traffic data in the course of lawful business practice to provide evidence of a market transaction or other business communication only if the parties are told in advance about the recording, its purpose and how long the recording is kept (article 214, paragraph 7).

Give the notice of recording by the same type of medium and in the same form as the recorded communication (article 214, paragraph 8).

If you are a business, a government department, a public authority, or another body exercising a statutory function, you may record or monitor communications on your own telecommunication system for a listed legitimate purpose, such as establishing facts, checking compliance with regulatory standards, or securing the system's own effective operation, if you have made all reasonable efforts to tell every person who may use the system that their communications on it may be intercepted.