Sec. 102. Transparency
374 words·~2 min read·
/bill/117/s/2499/is/section-102·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
A covered entity that processes covered data shall, with respect to such data, publish a privacy policy that is— disclosed, in a clear and conspicuous manner, to an individual prior to or at the point of the collection of covered data from the individual; and made available, in a clear and conspicuous manner, to the public. The privacy policy required under subsection
(a)shall include the following: The identity and the contact information of the covered entity (including the covered entity's points of contact for privacy and data security inquiries) and the identity of any affiliate to which covered data may be transferred by the covered entity. The categories of covered data the covered entity collects. The processing purposes for each category of covered data the covered entity collects. Whether the covered entity transfers covered data, the categories of recipients to whom the covered entity transfers covered data, and the purposes of the transfers. A general description of the covered entity’s data retention practices for covered data and the purposes for such retention. How individuals can exercise their rights under section 103. A general description of the covered entity’s data security practices. The effective date of the privacy policy. A privacy policy required under subsection
(a)shall be made available in all of the languages in which the covered entity provides a product or service that is subject to the policy, or carries out activities related to such product or service. If a covered entity makes a material change to its privacy policy, it shall notify the individuals affected before further processing or transferring of previously collected covered data and, except as provided in section 108, provide an opportunity to withdraw consent to further processing or transferring of the covered data under the changed policy. The covered entity shall provide direct notification, where possible, regarding a material change to the privacy policy to affected individuals, taking into account available technology and the nature of the relationship. Where the ownership of an individual’s device is transferred directly from one individual to another individual, a covered entity may satisfy its obligation to disclose a privacy policy prior to or at the point of collection of covered data by making the privacy policy available under subsection (a)(2).