Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party marketing automation tools that collect personal information in Idaho? What are the requirements?

Using Third-Party Marketing Automation Tools that Collect Personal Information in Idaho

Yes, you can use third-party marketing automation tools that collect personal information in Idaho, but you must comply with the state’s laws and regulations regarding the disclosure and acquisition of personal information.

Under IDST 28-51-105, a city, county, state agency, individual, or commercial entity that owns or licenses computerized data that includes personal information about a resident of Idaho must conduct a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused if it becomes aware of a breach of the security of the system. If the investigation determines that the misuse of information about an Idaho resident has occurred or is reasonably likely to occur, the agency, individual, or commercial entity must give notice as soon as possible to the affected Idaho resident. Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach, to identify the individuals affected, and to restore the reasonable integrity of the computerized data system.

Requirements

If you are using third-party marketing automation tools that collect personal information in Idaho, you must ensure that you comply with the following requirements:

  1. Provide an initial notice and an opt-out notice to consumers [2.1][2.2][2.3][2.5].
  2. Give consumers a reasonable opportunity to opt out of the disclosure [2.1][2.2][2.3][2.5].
  3. Ensure that you do not disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless the consumer has not opted out [2.1][2.2][2.3][2.5].

Exceptions

There are exceptions to the notice and opt-out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions, service providers and joint marketing, and other purposes [2.1][2.3][2.5].

Conclusion

To summarize, you can use third-party marketing automation tools that collect personal information in Idaho, but you must comply with the state’s laws and regulations regarding the disclosure and acquisition of personal information. You must provide an initial notice and an opt-out notice to consumers, give them a reasonable opportunity to opt out of the disclosure, and ensure that you do not disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless the consumer has not opted out. There are exceptions to these requirements for processing and servicing transactions, service providers and joint marketing, and other purposes.

Source(s):
Jurisdiction

Idaho