Law / United States / 
Delaware
Delaware Personal Data Privacy Act, de-identified data
Del. Code Ann. tit. 6, §§ 12D-102(14), 12D-109
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To treat data as de-identified under the DPDPA, take reasonable measures to ensure that it cannot be associated with an individual (section 12D-102, definition of de-identified data).
- Publicly commit to process the data only in a de-identified fashion and not to attempt to re-identify it (section 12D-102, definition of de-identified data).
- Contractually obligate every recipient of the data to comply with all of the provisions of the chapter that apply to a controller with respect to the data (section 12D-102, definition of de-identified data).
- When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (section 12D-109(d)). From , that oversight must include entering contractual commitments to ensure the proper and limited use of the data.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 12D-102 and 12D-109 state the conditions for treating data as de-identified and a controller's oversight of recipients. They state no log or record duty.
- Kind
- None
- As of
What this law does
Section 12D-102 of title 6 of the Delaware Code treats data as de-identified data only if the controller that possesses it takes reasonable measures to ensure that the data cannot be associated with an individual, publicly commits to process the data only in a de-identified fashion and not to attempt to re-identify it, and contractually obligates any recipients of the data to comply with all of the provisions of the chapter applicable to the controller with respect to the data.
Section 12D-109(a) of title 6 of the Delaware Code provides that nothing in the chapter requires a controller or processor to re-identify de-identified data or pseudonymous data, or to maintain data in identifiable form, in order to be capable of associating an authenticated consumer request with personal data.
Section 12D-109(c) of title 6 of the Delaware Code provides that the consumer rights in section 12D-104(a)(1) to (a)(4) do not apply to pseudonymous data where the controller can demonstrate that the information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing it.
Until , section 12D-109(d) of title 6 of the Delaware Code requires a controller that discloses pseudonymous data or de-identified data to exercise reasonable oversight to monitor compliance with the contractual commitments to which the data is subject and to take appropriate steps to address any breach of those commitments.
From , section 12D-109(d) of title 6 of the Delaware Code requires a controller that discloses pseudonymous data or de-identified data to exercise reasonable oversight that includes entering contractual commitments to ensure the proper and limited use of the data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .