Can I ignore consumer requests for information or deletion in Idaho? What are the requirements?

Consumer Requests for Information or Deletion in Idaho

Under Idaho law, consumers have the right to request information or deletion of their personal financial information held by licensees. Licensees are required to comply with these requests, subject to certain exceptions.

Right to Request Information

Consumers have the right to request information about the personal financial information that a licensee collects, shares, and discloses. Licensees must provide this information to consumers upon request, subject to certain exceptions [IDAPA 18.01.01.350].

Right to Request Deletion

Consumers have the right to request that a licensee delete their personal financial information. Licensees must comply with these requests, subject to certain exceptions [IDAPA 18.01.01.400].

Requirements for Licensees

Licensees must provide consumers with an initial notice of their privacy policies and practices, including the right to request information or deletion, and an opt-out notice if the licensee shares nonpublic personal financial information with nonaffiliated third parties [IDAPA 18.01.01.250]. Licensees must also provide an annual notice of their privacy policies and practices [IDAPA 18.01.01.300].

Licensees must establish and maintain reasonable procedures to protect the confidentiality and security of personal financial information [IDAPA 18.01.01.500]. Licensees must also maintain records of their compliance with these requirements [IDAPA 18.01.01.550].

Exceptions

Licensees are not required to comply with requests for information or deletion in certain circumstances, including:

• To effect, administer, or enforce a transaction that a consumer requests or authorizes [IDAPA 18.01.01.451].
• To perform services for the licensee or functions on the licensee’s behalf, if the licensee enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information [IDAPA 18.01.01.450].
• To comply with a legal obligation [IDAPA 18.01.01.400].

Cancellation of Subscriptions

If a seller makes an automatic subscription renewal offer to a consumer in Idaho, the seller must clearly and conspicuously disclose the automatic subscription renewal terms and the methods that the consumer may use to cancel the subscription [IDST 48-603G]. The seller must provide methods of automatic subscription renewal cancellation that include free online cancellation of the subscription and cancellation in the same manner that the consumer used to subscribe. If a phone number is provided for the purposes of cancellation of the subscription, the number must be toll-free and must be prominently displayed in the disclosure.

Other Exceptions to Notice and Opt-Out Requirements for Disclosure of Nonpublic Personal Financial Information

The requirements for initial notice to consumers, opt-out, and service providers and joint marketing do not apply when a licensee discloses nonpublic personal financial information in certain circumstances, including with the consent or at the direction of the consumer, to protect the confidentiality or security of a licensee’s records pertaining to the consumer, or to comply with federal, state or local laws, rules, and other applicable legal requirements [IDAPA 18.01.01.452].

Form of Opt-Out Notice to Consumers

If a licensee is prescribed to provide an opt-out notice under Subsection 400.01, it will provide a clear and conspicuous notice to each of its consumers that accurately explains the right to opt out under Section 400. The notice will state that the licensee discloses or reserves the right to disclose nonpublic personal financial information about its consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means by which the consumer may exercise the opt-out right [IDAPA 18.01.01.250].

Enforcement

Consumers may bring a private cause of action against licensees for violations of Idaho’s consumer protection laws, including violations of the requirements for consumer requests for information or deletion [IDST 48-1007]. The Idaho Attorney General may also enforce these requirements through administrative and judicial proceedings [IDST 48-606, 48-610].

Therefore, licensees cannot ignore consumer requests for information or deletion in Idaho, subject to certain exceptions. Licensees must provide consumers with an initial notice of their privacy policies and practices, including the right to request information or deletion, and an opt-out notice if the licensee shares nonpublic personal financial information with nonaffiliated third parties. Licensees must also establish and maintain reasonable procedures to protect the confidentiality and security of personal financial information. Licensees are not required to comply with requests for information or deletion in certain circumstances, including to effect, administer, or enforce a transaction that a consumer requests or authorizes, to perform services for the licensee or functions on the licensee’s behalf, if the licensee enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, or to comply with a legal obligation.

Jurisdiction

Idaho

• Privacy