Law / United States / 
Delaware
Delaware Personal Data Privacy Act, consumer rights
Del. Code Ann. tit. 6, § 12D-104
In force since .
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Give a Delaware consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Offer a Delaware consumer an opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects, and honor universal opt-out preference signals as of . Until the profiling opt-out reaches only solely-automated decisions; from it reaches automated decisions.
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.
- From , include in your response to an access request any inferences about the consumer derived from their personal data, and whether you or a processor is processing it for profiling to make a decision that produces a legal or similarly significant effect concerning the consumer (section 12D-104(a)(1)).
- From , on request give a consumer a list of the third parties, not only the categories of third parties, to which you have disclosed their personal data, unless the data is pseudonymous, you cannot compile the list with reasonable effort (in which case disclose all third parties to which you disclose personal data) or listing a third party would reveal a trade secret (section 12D-104(a)(5)).
- From , do not disclose in response to an access request the consumer's Social Security number, driver's license, state identification card or other government-issued identification number, financial account number, health insurance or medical identification number, account password, security question or answer, or biometric data; tell the consumer, with sufficient particularity, that you process them (section 12D-104(c)(6)).
These lines are LexLint's reading of the law's text. Also read by: Delaware Department of Justice, Fraud and Consumer Protection Division (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://attorneygeneral.delaware.gov/fraud/personal-data-privacy-portal/frequently-asked-questions/
- Guidance body
- Delaware Department of Justice, Fraud and Consumer Protection Division
- Open questions
- From , does the profiling opt-out in Section 12D-104(a)(6)c., which reaches profiling in furtherance of 'automated decisions', extend to profiling that informs a decision a person makes?
What it makes you log
What the log must hold
Decision basis, Affected person reference
Logging duty
A controller that obtained personal data from a source other than the consumer is deemed to have complied with a request to delete if it retains a record of the deletion request and the minimum data needed to keep the data deleted, and a controller may deny an opt-out request only on a good faith, reasonable and documented belief that the request is fraudulent. Both clauses are routes to compliance rather than free-standing duties, and neither sets a period, names a regulator's access or lists fields. The controller's burden of demonstrating that a request is manifestly unfounded, excessive or repetitive (c)(3) is an allocation of proof in a dispute over a fee and is not read as a record. The appeal process in (d) requires a written explanation to the consumer and states no record kept. The documented assessment that carries an audit sits in section 12D-108, which the row does not cite.
- Kind
- Implicit
- As of
- Provision
- 6 Del. C. § 12D-104(c)(4), (c)(5)
- Trigger
- consent_or_optout
What this law does
DPDPA gives a Delaware consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects. Until , the profiling opt-out reaches only solely-automated decisions. From , the profiling opt-out reaches decisions that are automated, not only those that are solely automated.
A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available. From , the right to confirm and access also reaches any inferences about the consumer derived from the personal data, and whether a controller or processor is processing the consumer's personal data for profiling to make a decision that produces a legal or similarly significant effect concerning the consumer.
Until , a consumer may obtain a list of the categories of third parties to which the controller has disclosed the consumer's personal data.
From , a consumer may obtain a list of the third parties to which the controller has disclosed the consumer's personal data, unless the data is pseudonymous, the controller cannot compile the list with reasonable effort and so must disclose all third parties to which it discloses personal data, or listing a third party would reveal a trade secret.
From , a controller may not disclose in response to an access request the consumer's Social Security number, driver's license, state identification card or other government-issued identification number, financial account number, health insurance or medical identification number, account password, security question or answer, or biometric data, and may only inform the consumer, with sufficient particularity, that it processes them.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .