Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I sell personal information without obtaining consent in Indiana? What are the requirements?

Based on the context documents, it is generally not permissible to sell personal information without obtaining consent in Indiana.

Requirements for Disclosure of Personal Information

IC 9-14-13-8 states that highly restricted personal information may only be disclosed with the express written consent of the person to whom the information pertains. In the absence of such consent, the person requesting the information must provide proof of identity and represent that the use of the information will be strictly limited to certain authorized purposes [1.1].

IC 9-14-13-9 further requires the bureau to satisfy certain conditions before disclosing personal information, including ascertaining the correct identity of the requesting person, ensuring that the use of the information will be only as authorized, and obtaining the consent of the person who is the subject of the information [1.3].

IC 12-20-7-1 requires each applicant and adult member of the applicant’s household seeking township assistance to consent to a disclosure and release of information about the applicant and the applicant’s household before township assistance may be provided by the township trustee. The consent must be made by signing a form prescribed by the state board of accounts and must include certain information, such as the types of information being solicited and the names of individuals, agencies, and township trustee offices that will receive the information. Information that is declared to be confidential by state or federal statute may not be obtained under the consent form prescribed by this section [2.1].

IC 24-4-14-8 makes it an infraction to dispose of the unencrypted, unredacted personal information of a customer without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable. The offense is a Class C infraction, but it is a Class A infraction if the person violates this section by disposing of the unencrypted, unredacted personal information of more than one hundred customers or has a prior unrelated judgment for a violation of this section [5.1].

460 INAC 14-5-6 requires an applicant’s or eligible individual’s informed consent before disclosing any information regarding a diagnosis or the treatment of any individual for drug or alcohol abuse, mental illness, or HIV, AIDS, or any other infectious disease. The informed consent must identify or describe the individual whose information is being requested, the nature and scope of the information to be disclosed, the person, agency, or other entity authorized to make the disclosure, the person, agency, or other entity to which the disclosure is to be made, and if the request is for disclosure of information regarding alcohol or drug abuse diagnosis or treatment, mental illness, HIV, AIDS, or other infectious disease, a description of how the information is to be used. Informed consent remains valid until the date, event, or condition specified for its expiration unless otherwise revoked by the applicant or eligible individual [4.1].

460 INAC 14-5-5 requires an applicant’s or eligible individual’s informed consent prior to viewing or obtaining copies of records of services by the individual or individual’s representative, provision of copies of any record of services, or the information contained in such records, to any individual, program, or entity other than the division, including, but not limited to, the CAP, disclosure of any information regarding a diagnosis or the treatment of any individual for drug or alcohol abuse, mental illness, or HIV, AIDS, or any other infectious disease, or the disclosure of the individual’s full Social Security number to any individual or entity other than an agency of federal, state, or local government [4.2].

Exception to Opt Out Requirements

760 INAC 1-67-12 provides an exception to the opt-out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing. The opt-out requirements in sections 6 and 9 of this rule do not apply when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee provides the initial notice in accordance with section 3 of this rule and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, including use under an exception in section 13 or 14 of this rule in the ordinary course of business to carry out those purposes. Informed consent is required in all cases prior to the disclosure of any information regarding a diagnosis or the treatment of any individual for drug or alcohol abuse, mental illness, or HIV, AIDS, or any other infectious disease [3.2].

IC 9-14-13-7 allows the bureau to disclose certain personal information that is not highly restricted personal information if the person requesting the information provides proof of identity and represents that the use of the personal information will be strictly limited to certain authorized purposes [1.2].

Therefore, based on the context documents, it is generally not permissible to sell personal information without obtaining consent in Indiana. The requirements for obtaining consent vary depending on the type of personal information and the purpose of the disclosure.

Source(s):
Jurisdiction

Indiana