Collection of personally identifiable information -- requirements
(1) A government website operator may not collect personally identifiable information online from a website user unless the operator complies with the provisions of this section.
(2) A government website operator shall ensure that the website:
(a) identifies who operates the website;
(b) provides the address and telephone number at which the operator may be contacted as well as an electronic means for contacting the operator; and
(c) generally describes the operator's information practices, including policies to protect the privacy of the user and the steps taken to protect the security of the collected information.
(3) In addition to the requirements of subsection (2), if the personally identifiable information may be used for a purpose other than the express purpose of the website or may be given or sold to a third party, except as required by law, then the operator shall ensure that the website includes:
(a) a clear and conspicuous notice to the user that the information collected could be used for other than the purposes of the website;
(b) a general description of the types of third parties that may obtain the information; and
(c) a clear, conspicuous, and easily understood online procedure requiring an affirmative expression of the user's permission before the information is collected.
(1) A government website operator may not collect personally identifiable information online from a website user unless the operator complies with the provisions of this section.
(2) A government website operator shall ensure that the website:
(2) (a) identifies who operates A government operator shall ensure the website; information delivery system or platform:
(i) identifies who operates the system;
(ii) provides both physical and electronic means for contacting the operator; and
(iii) generally describes the operator's information practices, including policies to protect the privacy of the user and the steps taken to protect the security of the collected information; and
(b) provides If the address and telephone number at which the operator may be contacted as well as department determines that an electronic means for contacting agency is not in compliance with the operator; state security policies, framework, controls, standards, procedures, and guidelines provided for in 2-17-534, the department may take appropriate action, in its sole discretion, up to and including terminating the information technology resource and requiring the use of an alternative information technology resource.
(c) generally describes the operator's information practices, including policies to protect the privacy of the user and the steps taken to protect the security of the collected information.
(3) In addition to the requirements of subsection (2), (2)(a), if the personally identifiable information may be used for a purpose other than the express purpose of for the website collection or may be given or sold to a third party, except as required by law, then the operator shall ensure that the website information technology resource includes:
(a) a clear and conspicuous notice to the user that the information collected could be used for other than the purposes of the website; collection;
(b) a general description of the types of third parties that may obtain the information; and
(c) a clear, conspicuous, and easily understood online procedure requiring an affirmative expression of the user's permission before the information is collected.
Collection of personally identifiable information -- – requirements
| EnactedEn. SectionSec. 3, ChapterCh. 219, Laws ofL. 2001 (HB 281 - Lindeen, Monica (D) HD 7) |