Summary

A governmental entity must provide a privacy notice to an individual when the governmental entity requests or collects personal data from the individual. If the personal data collected is a public record, the privacy notice is limited to a statement that the individual's personal data may be available to the public. Otherwise, the privacy notice must describe:

• all intended purposes and uses of the personal data;
• the consequences of refusing to provide the personal data;
• the classes of persons and governmental entities:

• with whom the governmental entity shares personal data; or
• to whom the governmental entity sells personal data; and

• the record series in which the personal data is included.

The GDPA describes how the privacy notice must be provided and specifies that the governmental entity may only use the personal data as described in the privacy notice.

The GDPA also allows an individual to request a privacy notice for any personal data the individual previously provided to the governmental entity.