Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I skip obtaining consent to disclose personal information for a business purpose in South Dakota? What are the requirements?

Disclosure of Personal Information for Business Purposes in South Dakota

In South Dakota, obtaining consent is generally required before disclosing personal information for business purposes. However, there are exceptions to this requirement depending on the type of personal information and the purpose of the disclosure.

Authorization to Disclose Nonpublic Personal Health Information [1.1]

An authorization to disclose nonpublic personal health information pursuant to § 20:06:45:27 shall be in written or electronic form and contain all of the following:

  1. The identity of the consumer or customer who is the subject of the nonpublic personal health information;
  2. A general description of the types of nonpublic personal health information to be disclosed;
  3. General descriptions of the parties to whom the licensee discloses nonpublic personal health information, the purpose of the disclosure, and how the information will be used;
  4. The signature of the consumer or customer who is the subject of the nonpublic personal health information or the individual who is legally empowered to grant authority and the date signed; and
  5. Notice of the length of time for which the authorization is valid and that the consumer or customer may revoke the authorization at any time and the procedure for making a revocation.

The authorization shall specify a length of time for which the authorization shall remain valid, which in no event may be for more than 24 months. A consumer or customer who is the subject of nonpublic personal health information may revoke an authorization provided pursuant to § 20:06:45:27 at any time, subject to the rights of an individual who acted in reliance on the authorization prior to notice of the revocation.

Personal Affiliation Information - Public Benefit [4.2]

Personal affiliation information derived from a donation to a nonprofit corporation that is affiliated with a public agency may be disclosed if the donor has not previously requested anonymity from the nonprofit corporation.

Other Exceptions to Notice and Opt-Out Requirements for Disclosure of Nonpublic Personal Financial Information [1.2]

The requirements for initial notice to consumers, opt-out, and service providers and joint marketing do not apply when a licensee discloses nonpublic personal financial information with the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction. Other exceptions include disclosure to protect the confidentiality or security of a licensee’s records pertaining to the consumer, service, product, or transaction; to protect against or prevent actual or potential fraud or unauthorized transactions; for required institutional risk control or for resolving consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer; to persons acting in a fiduciary or representative capacity on behalf of the consumer; to provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating a licensee, persons that are assessing the licensee’s compliance with industry standards, and the licensee’s attorneys, accountants, and auditors; to comply with federal, state, or local laws, rules, and other applicable legal requirements; to comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by federal, state, or local authorities; to respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance, or other purposes as authorized by law; for purposes related to the replacement of a group benefit plan, a group health plan, a group welfare plan, or a workers’ compensation policy.

Exception to Opt-Out Requirements for Disclosure of Nonpublic Personal Financial Information for Service Providers and Joint Marketing [1.3]

The opt-out requirements do not apply when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee provides the initial notice and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, including use under an exception in § 20:06:45:14 or 20:06:45:15 in the ordinary course of business to carry out those purposes.

Requirements for Disclosure

If an exception to the consent requirement applies, there may still be requirements for disclosing personal information for business purposes. For example, an authorization to disclose nonpublic personal health information must contain specific information as outlined in § 20:06:45:27 [1.1].

Conclusion

In general, obtaining consent is required before disclosing personal information for business purposes in South Dakota. However, there are exceptions to this requirement depending on the type of personal information and the purpose of the disclosure. If an exception applies, there may still be requirements for disclosing personal information.

Source(s):
Jurisdiction

South Dakota