Controller's disclosure of de-identified or pseudonymous data; compliance with contractual commitments

Sec. 3. A controller that discloses pseudonymous data or de-identified data shall exercise reasonable oversight to monitor compliance with any contractual commitments to which the pseudonymous data or de-identified data is subject and shall take appropriate steps to address any breaches of those contractual commitments. As added by P.L.94-2023, SEC.1.