Law / United States / 
Alabama
Alabama OIT PII Processing and Transparency Policy: documented purposes, privacy notices and consent for State agencies
Alabama OIT PII Processing and Transparency Policy PR-DS-P2, controls PT-1 to PT-4
In force since .
A privacy notice rule binding government bodies.
- Obligation class
- Consent, Disclosure
What it requires
- As a State of Alabama agency, document the purposes and the authority for processing personally identifiable information, describe those purposes in your privacy notices and policies, and restrict processing to what is compatible with the identified purposes (control PT-3).
- As a State of Alabama agency, put procedures in place for monitoring changes in processing PII and for audits and reviews, to ensure changes are made relevant to regulatory and legal requirements (control PT-3).
- As a State of Alabama agency, provide clear information through privacy notices on how individuals' PII will be processed (control PT-4).
- As a State of Alabama agency, implement mechanisms for individuals to consent to the processing of their PII before its collection, and mechanisms to tailor processing permissions to selected elements of PII (control PT-4).
- As a State of Alabama agency, implement tools for individuals to revoke consent to the processing of their PII, and use plain language without technical jargon so individuals understand the risks and implications of giving consent (control PT-4).
- As a contractor or vendor of the State of Alabama, comply with the policy for the information systems you use, manage or operate on behalf of the State.
These lines are LexLint's reading of the law's text.
What this law does
The Alabama Office of Information Technology PII Processing and Transparency Policy, numbered PR-DS-P2, states an effective date of and an approval date of . The policy covers all State information and information systems, including those used, managed or operated by a contractor, the State or other organizations on behalf of the State. The policy states that all State agencies and vendors of the State are required to comply with its current implemented version.
The policy requires that the purposes and authority for processing personally identifiable information (PII) within the State and executive-branch agencies be documented, that the purposes be described in privacy notices and policies, and that processing be restricted to what is compatible with the identified purposes. The policy requires procedures for monitoring changes in processing PII and for audits and reviews so that changes are made relevant to regulatory and legal requirements.
The policy requires individual State agencies to provide clear information through privacy notices on how their PII will be processed and to offer options for individuals to tailor or revoke their consent. The policy requires agencies to allow individuals to give informed consent regarding the processing of their PII before its collection.
The policy requires agencies to provide mechanisms that let individuals tailor processing permissions to selected elements of PII and tools for individuals to revoke consent to the processing of their PII. The policy requires agencies to use plain language and avoid technical jargon so that individuals understand the risks and implications of giving consent.
Section 41-28-4 of the Code of Alabama gives the Secretary of Information Technology the power to adopt rules and policies and establish procedures and standards for the management and operation of information technology by state agencies to carry out the chapter. The same subsection lists establishing and enforcing cybersecurity governance for state agencies among the subjects of those rules and policies.
The Office of Information Technology describes its State IT policy library as a baseline applicable across all State executive-branch departments, agencies, offices, boards, commissions, bureaus, authorities and providers of IT goods and services, except as expressly exempted by statute.
The term state agencies in Chapter 28 of Title 41 of the Code of Alabama does not include counties, municipalities and their instrumentalities, the Alabama State Port Authority, the State Department of Education, the Retirement Systems of Alabama, or institutions of higher education governed by a separate board of trustees.
The chapter's provisions concerning telecommunications, information technology or cybersecurity equipment, services and solutioning do not apply to any county or city board of education, the Alabama Educational Television Commission, entities that originated within the State Department of Education, the Alabama Community College System, or any public four-year institution of higher education.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .