Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party cloud storage services that collect personal information in Delaware? What are the requirements?

Using Third-Party Cloud Storage Services that Collect Personal Information in Delaware

If you are using a third-party cloud storage service that collects personally identifiable information (PII) through the internet about individual users residing in Delaware, then the operator of the service must comply with the requirements outlined in [1.1]. The operator must make its privacy policy conspicuously available on its internet website, online or cloud computing service, online application, or mobile application. The privacy policy must identify the categories of PII that the operator collects through the service about users and the categories of third-party persons with whom the operator may share that PII. The policy must also describe the process by which the operator notifies users of material changes to the privacy policy and disclose how the operator responds to web browser “do not track” signals or other mechanisms that provide users the ability to exercise choice regarding the collection of PII about a user’s online activities over time and across third-party internet websites, online or cloud computing services, online applications, or mobile applications, if the operator engages in that collection.

Additionally, any person who conducts business in Delaware and owns, licenses, or maintains personal information shall implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of personal information collected or maintained in the regular course of business [3.1].

Conclusion

If you are using a third-party cloud storage service that collects PII through the internet about individual users residing in Delaware, then the operator of the service must comply with the requirements outlined in [1.1]. Additionally, any person who conducts business in Delaware and owns, licenses, or maintains personal information shall implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of personal information collected or maintained in the regular course of business [3.1].

Source(s):
Jurisdiction

Delaware