Delaware Personal Data Privacy Act (6 Del.C. § 12D-106 et seq)

About the Legislation:

A controller must

(1) limit the collection of personal data to what is adequate, relevant, and reasonably necessary to the purposes for which data is processed; (2) not process personal data for purposes that are neither reasonably necessary to, nor compatible with, the disclosed purposes for which such personal data is processed; (3) establish, implement, and maintain reasonable administrative, technical, and physical data security practices; (4) not process sensitive data concerning a consumer without obtaining the consumer’s consent; (5) not process personal data in violation of unlawful discrimination laws; (6) provide an effective mechanism for a consumer to revoke the consumer’s consent; (7) not process a consumer’s personal data for purposes of targeted advertising or sell the consumer’s personal data without consent; and (8) not discriminate against a consumer for exercising consumer rights.

A controller must provide consumers with a reasonably accessible, clear, and meaningful privacy notice. A controller must clearly and conspicuously disclose processing and the manner in which a consumer may exercise the right to opt out of such processing if a controller sells personal data to third parties or processes personal data for targeted advertising.

Private Right of Action: No.
Damages/Enforcement: The Department of Justice enforces, investigates, and prosecutes violations in accordance with subchapter II of Chapter 25 of Title 29.

Read the Legislation

State Association Contact

Josephine Bahn, Member

Aaron Krauss, Member