Sec. 104. Rights to consent
315 words·~1 min read·
/bill/117/s/2499/is/section-104A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Except as provided in section 108, a covered entity shall not, without the prior, affirmative express consent of an individual— transfer sensitive covered data of the individual to a third party; or process sensitive covered data of the individual. In obtaining the affirmative express consent of an individual to process the sensitive covered data of the individual as required under subsection (a)(2), a covered entity shall provide the individual with notice that shall— include a clear description of the processing purpose for which the sensitive covered data will be processed; clearly identify any processing purpose that is necessary to fulfill a request made by the individual; include a prominent heading that would enable a reasonable individual to easily identify the processing purpose for which consent is sought; and clearly explain the individual’s right to provide or withhold consent.
A covered entity shall not transfer the covered data of an individual to a third-party without affirmative express consent from the individual or the individual’s parent or guardian if the covered entity has actual knowledge that the individual is between 13 and 16 years of age. Except as provided in section 108, a covered entity shall provide an individual with the ability to opt out of the collection, processing, or transfer of such individual’s covered data before such collection, processing, or transfer occurs.
A covered entity shall not infer that an individual has provided affirmative express consent to a processing purpose from the inaction of the individual or the individual's continued use of a service or product provided by the covered entity. A covered entity shall provide an individual with a clear and conspicuous means to withdraw affirmative express consent. The Commission may promulgate regulations under section 553 of title 5, United States Code, to establish clear and conspicuous procedures for allowing individuals to provide or withdraw affirmative express consent for the collection of sensitive covered data.