Sec. 11. Rules of construction
641 words·~3 min read·
/bill/119/hr/8413/ih/section-11·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Nothing in this Act may be construed to restrict the ability of a controller or processor to do any of the following: Cooperate with a law enforcement agency with respect to conduct or activity that the controller or processor reasonably and in good faith believes may violate a Federal, State, or local law, rule, or regulation. Investigate, establish, exercise, prepare for, or defend a legal claim. Provide a product or service specifically requested by a consumer or a parent of a consumer (if the consumer is a child or teen).
Perform a contract to which a consumer or a parent of a consumer (if the consumer is a child or teen) is a party, including by fulfilling the terms of a written warranty. Take immediate steps to protect an interest that is essential to the life or physical safety of a consumer or of another individual. Prevent, detect, protect against, or respond to a security incident, including a data security incident, identity theft, fraud, harassment, malicious or deceptive activity, or any other similar illegal activity.
Preserve the integrity or security of systems. Investigate, report, or prosecute a person responsible for any such security incident. Engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to any applicable Federal or State ethics or privacy law and is approved, monitored, and governed by an institutional review board (or similar independent oversight entity) that considers the following: If the deletion of the personal data of a consumer is likely to provide substantial benefits that do not exclusively accrue to the controller.
If the controller has implemented reasonable safeguards to mitigate privacy and data security risks to a consumer associated with research, including any risks associated with re-identification of the personal data of the consumer. If the expected benefits of the research outweigh such privacy and data security risks. Nothing in this Act may be construed to restrict the ability of a controller or processor to collect, use, or retain the personal data of a consumer to do any of the following:
Conduct internal research to develop, improve, or repair a product, service, or technology. Effectuate a product recall. Identify and repair any technical error that impairs the functionality of a product, service, or technology. Perform an internal operation that— is reasonably aligned with the expectations of a consumer; is reasonably anticipated based on the relationship of a consumer with the controller; or is otherwise compatible with processing data to— provide a product or service specifically requested by a consumer or a parent of a consumer (if the consumer is a child or teen); or perform a contract to which a consumer or a parent of a consumer (if the consumer is a child or teen) is a party.
Nothing in this Act may be construed to prevent a controller or processor from providing the personal data of a consumer to a person covered by an evidentiary privilege under Federal or State law as part of a privileged communication. A controller or processor that discloses the personal data of a consumer to another controller or processor in compliance with the requirements of this Act does not violate this Act if the controller or processor that receives and processes such personal data violates this Act if, at the time of disclosing the personal data, the disclosing controller or processor did not have knowledge that the receiving controller or processor intended to commit such a violation.
Nothing in this Act may be construed as a requirement imposed on a controller or processor that adversely affects the privacy or any other right or freedom of any person, including the right to freedom of speech under the Constitution of the United States, or that applies to the processing of personal data by a person in the course of a purely personal or household activity.