NIST Privacy Framework, Communicate-PCM.AW-P4

Give a personal data subject, once a calendar year and free of charge, information about the transmission of their personal data to third parties, under Article 12.

Tell a data subject which public and private entities you shared their data with, let them object to processing carried out under a consent exemption where it violates this law, and let them revoke consent at any time through a free and easy procedure.

Pass on any rectification, erasure or restriction to every recipient the data were disclosed to, unless that is impossible or disproportionately difficult, and tell the data subject who those recipients are on request.

Give a Maryland consumer a means to confirm whether you process their personal data, access it, correct it, delete it, receive a portable copy, and obtain a list of third-party categories it was disclosed to.

Provide a Minnesota consumer, on request, a list of the specific third parties you disclosed their personal data to, not merely categories of third parties.

Give a Nevada consumer the right to access their consumer health data, obtain a list of third parties it was disclosed to, stop its collection, sharing, or sale, and delete it.

On a registered person's request, disclose what personal data has been accessed, when, by whom, the purpose, manner and duration of access, how long the data will be stored, and whether any profiling or automated decision-making process is being applied to it.

Once in force, give a Vermont consumer access, correction, deletion, portability, opt-out of targeted advertising and sale, a profiling explanation and reevaluation right for housing decisions, and a list of third parties their data was sold to.

Tell the data subject every third party their personal data has been disclosed to, and what safeguards are in place for it.

Maintain a registry of every database you disclose to third parties, covering its legal basis, its contents, who receives it, retention periods and everyone who accessed it, and produce that registry to ANTAI on request.

Before disclosing personal data to a requester, identify the requester and the purpose, notify the data subject, and record how long the requester will hold the data and how it will be destroyed, unless the data subject has consented.