Sec. 105. Right to controls
357 words·~2 min read·
/bill/116/s/2968/is/section-105·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
A covered entity, upon the verified request of an individual, shall export the individual’s covered data, except for derived data, without licensing restrictions— in a human-readable format that allows the individual to understand such covered data of the individual; and in a structured, interoperable, and machine-readable format that includes all covered data or other information that the covered entity collected to the extent feasible. A covered entity— shall not transfer an individual’s covered data to a third party if the individual objects to the transfer; and shall allow an individual to object to the covered entity transferring covered data of the individual to a third party through a process established under the rule issued by the Commission pursuant to paragraph (2).
Not later than 18 months after the date of enactment of this Act, the Commission shall issue a rule under section 553 of title 5, United States Code, establishing one or more acceptable processes for covered entities to follow in allowing individuals to opt out of transfers of covered data. The processes established by the Commission pursuant to this subparagraph shall— be centralized, to the extent feasible, to minimize the number of opt-out designations of a similar type that a consumer must make; include clear and conspicuous opt-out notices and consumer friendly mechanisms to allow an individual to opt out of transfers of covered data; allow an individual that objects to a transfer of covered data to view the status of such objection; allow an individual that objects to a transfer of covered data to change the status of such objection; be privacy protective; and be informed by the Commission’s experience developing and implementing the National Do Not Call Registry.
A covered entity— shall not process the sensitive covered data of an individual without the individual’s prior, affirmative express consent; shall not transfer the sensitive covered data of an individual without the individual’s prior, affirmative express consent; shall provide an individual with a consumer-friendly means to withdraw affirmative express consent to process the sensitive covered data of the individual; and is not required to obtain prior, affirmative express consent to process or transfer publicly available information.