Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I sell personal information without obtaining consent in Idaho? What are the requirements?

Based on the documents provided, in Idaho, personal information cannot be sold without obtaining consent or authorization from the consumer, except in certain circumstances listed in IDAPA 18.01.01.452 [1.1].

According to IDAPA 18.01.01.400 [1.4], a licensee cannot disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless the licensee has provided the consumer with an initial notice and an opt-out notice, and the consumer does not opt-out. However, there are exceptions to this requirement listed in IDAPA 18.01.01.452 [1.1], such as when the consumer consents to the disclosure or when the disclosure is necessary to protect against fraud or unauthorized transactions.

IDAPA 18.01.01.401 [1.2] limits the redisclosure and reuse of nonpublic personal financial information. If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution, the licensee may disclose the information only to the affiliates of the financial institution from which the licensee received the information and to its affiliates. If a licensee discloses nonpublic personal financial information to a nonaffiliated third party, the third party may disclose that information only to the licensee’s affiliates, to the third party’s affiliates, or to any other person if the disclosure would be lawful if the licensee made it directly to that person.

IDAPA 18.01.01.450 [1.3] provides an exception to opt-out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing. The opt-out requirements do not apply when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee provides the initial notice in accordance with Section 100 and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information.

It is important to note that Idaho law requires agencies, individuals, or commercial entities that own or license computerized data that includes personal information about a resident of Idaho to conduct a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused if they become aware of a breach of the security of the system. If the investigation determines that the misuse of information about an Idaho resident has occurred or is reasonably likely to occur, the agency, individual, or commercial entity shall give notice as soon as possible to the affected Idaho resident [2.1].

Therefore, it is recommended to obtain consent or authorization from the consumer before selling their personal information in Idaho. The requirements for obtaining consent or authorization may vary depending on the type of personal information being sold and the purpose of the sale. It is also important to comply with the redisclosure and reuse limits and the opt-out requirements, unless an exception applies. It is recommended to consult with a legal professional to ensure compliance with all applicable laws and regulations.

References:

  • [1.1]: IDAPA 18.01.01.452
  • [1.2]: IDAPA 18.01.01.401
  • [1.3]: IDAPA 18.01.01.450
  • [2.1]: IDST 28-51-105
  • [1.4]: IDAPA 18.01.01.400
Source(s):
Jurisdiction

Idaho