Sec. 105. Minimizing data collection, processing, and retention
184 words·~1 min read·
/bill/117/s/2499/is/section-105A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Except as provided in section 108, a covered entity shall not collect, process, or transfer covered data beyond— what is reasonably necessary, proportionate, and limited to provide or improve a product, service, or a communication about a product or service, including what is reasonably necessary, proportionate, and limited to provide a product or service specifically requested by an individual or reasonably anticipated within the context of the covered entity’s ongoing relationship with an individual; what is reasonably necessary, proportionate, or limited to otherwise process or transfer covered data in a manner that is described in the privacy policy that the covered entity is required to publish under section 102(a); or what is expressly permitted by this Act or any other applicable Federal law.
Not later than 1 year after the date of enactment of this Act, the Commission shall issue guidelines recommending best practices for covered entities to minimize the collection, processing, and transfer of covered data in accordance with this section. Notwithstanding section 404 of this Act, nothing in this section supersedes any other provision of this Act or other applicable Federal law.