87-1126.

Act, how construed.

The Data Privacy Act shall not be construed to:

(1) Restrict a controller's or processor's ability to:

(a) Comply with federal, state, or local laws, rules, or regulations;

(b) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities;

(c) Cooperate with any law enforcement agency concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate any federal, state, or local law, rule, or regulation;

(d) Investigate, establish, exercise, prepare for, or defend legal claims;

(e) Provide a product or service specifically requested by a consumer or the parent or guardian of a child, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take action at the request of the consumer before entering into a contract;

(f) Take immediate action to protect an interest that is essential for the life or physical safety of the consumer or of another individual and in which the processing cannot be manifestly based on another legal basis;

(g) Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity;

(h) Preserve the integrity or security of systems or investigate, report, or prosecute those responsible for breaches of system security;

(i) Engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board or similar independent oversight entity that determines:

(i) If the deletion of the information is likely to provide substantial benefits that do not exclusively accrue to the controller;

(ii) Whether the expected benefits of the research outweigh the privacy risks; and

(iii) If the controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification; or

(j) Assist another controller, processor, or third party with any of the requirements under subdivision (1) of this section;

(2) Prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged communication;

(3) Impose a requirement on any controller or processor that adversely affects any right or freedom of any person, including the right of free speech pursuant to the First Amendment to the Constitution of the United States;

(4) Require a controller, processor, third party, or consumer to disclose a trade secret;

(5) Apply to the processing of personal data by any individual in the course of a purely personal or household activity; or

(6) Prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege as part of a privileged communication.