Sec. 210. Notice and consent required
313 words·~1 min read·
/bill/119/hr/8014/ih/section-210·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
A covered entity shall provide an individual with notice of the personal information such covered entity collects, processes, maintains, and discloses through a process that is concise and clear and can be objectively shown to meet the threshold established by the Director under section 208(a). Except as provided in paragraphs
(2)and (3), a covered entity may not collect from an individual personal information that creates or increases the risk of foreseeable privacy harms, or process or maintain any such personal information collected from an individual, unless such entity obtains the express consent of such individual to the collecting, processing, or maintaining (or any combination thereof) of such information through a process that is concise and clear and can be objectively shown to meet the threshold established by the Director under section 208(a). Notwithstanding paragraph (1), express consent is not required for collecting, processing, or maintaining personal information if the collecting, processing, or maintaining is, on its face, obvious and necessary to provide a service at the request of the individual and the personal information is collected, processed, or maintained only for such request. Nothing in this paragraph shall be construed to exempt the covered entity from the requirement of subsection
(a)to provide notice to such individual with respect to such collecting, processing, or maintaining. Notwithstanding paragraph (1), except with regard to consent for purposes of section 106, express consent is not required for collecting, processing, or maintaining personal information secured using privacy-preserving computing. Nothing in this paragraph shall be construed to exempt the covered entity from the requirement of subsection
(a)to provide notice to such individual with respect to such collecting, processing, or maintaining. This section does not apply to a service provider if such service provider has a reasonable belief that a covered entity for which it processes, maintains, or discloses personal information is in compliance with this section.