Same; confidentiality and privacy rights; requirements and procedures

# (a)

The purpose of this section is to set forth this state's policy for the protection of the confidentiality rights of all participants in the system and of the privacy interests of consumers who deal with model 1 sellers.

# (b)

As used in this section:

# (1)

"Confidential taxpayer information" means all information that is protected under this state's laws, rules and regulations and privileges;

# (2)

"personally identifiable information" means information that identifies a person; and

(3) "anonymous data" means information that does not identify a person.

# (c)

A fundamental precept in model 1 is to preserve the privacy of consumers by protecting their anonymity. With very limited exceptions, a certified service provider (CSP) shall perform its tax calculation, remittance and reporting functions without retaining the personally identifiable information of consumers.

# (d)

The secretary shall provide public notification to consumers, including their exempt purchasers, of the department's practices relating to the collection, use and retention of personally identifiable information.

# (e)

When any personally identifiable information that has been collected and retained is no longer required to ensure the validity of exemptions from taxation that are claimed by reason of a consumer's status or the intended use of the goods or services purchased, such information shall no longer be retained by the department.

# (f)

When personally identifiable information regarding an individual is retained by or on behalf of the department, the secretary shall provide reasonable access by such individual to such individual's own information in the department's possession and a right to correct any inaccurately recorded information.

# (g)

If anyone other than this state, or a person authorized by this state's law or the agreement, seeks to discover personally identifiable information, the secretary shall make a reasonable and timely effort to notify the individual of such request.

# (h)

This privacy policy is subject to enforcement by the attorney general.