Indiana § 23-17-32-7 - Protection of personal information; exceptions

§ 23-17-32-7. Protection of personal information; exceptions

Sec. 7. (a) Except as provided in subsection (b), a public agency shall not do any of the following:

(1) Require or otherwise compel any person or nonprofit organization to provide the public agency with personal information.

(2) Release, publicize, or otherwise publicly disclose personal information in the possession of the public agency.

(3) Request or require a current or prospective:

(A) contractor for; or

(B) grantee of;

the public agency to provide a list of nonprofit organizations to which the current or prospective contractor or grantee has provided financial or nonfinancial support.

(b) Subsection (a) does not apply with respect to any of the following:

(1) Any report or disclosure required under state:

(A) campaign finance law as required by IC 3-9-5;

(B) lobbying disclosure law as required by IC 2-7; or

(C) access to information, including personal information as required by IC 2-5-1.7.

(2) A lawful order or warrant, issued by a court of competent jurisdiction, for the provision, disclosure, or release of personal information.

(3) A lawful request for discovery of personal information in the context of litigation if the following conditions are met:

(A) The requesting party or person demonstrates, by clear and convincing evidence, as determined by the court, a compelling need for the personal information.

(B) The requesting party or person obtains a protective order, issued by the court, barring disclosure of the personal information to any person not named as a party in the litigation.

(4) Admission of personal information as relevant evidence before a court of competent jurisdiction. However, a court may not publicly disclose or release personal information without a specific finding of good cause.

(5) Release by a public agency of personal information that was voluntarily released by:

(A) the person to whom the personal information pertains; or

(B) the nonprofit organization with which the personal information is associated;

to the public.

(6) A collection of information that:

(A) includes the identity of any director, officer, registered agent, or incorporator of a nonprofit organization; and

(B) is part of any report or disclosure required to be filed with the secretary of state under this article or any other statute.

However, information that directly identifies a person as a donor of financial support to a nonprofit organization shall not be collected by or disclosed to the secretary of state.

(7) Disclosure of personal information that is derived from a financial donation to a nonprofit organization that is affiliated with a public agency if:

(A) the disclosure is required by statute; and

(B) the person to whom the personal information pertains has not previously made a request for anonymity to the nonprofit organization.

(8) Information collected in an examination by the state board of accounts under IC 5-11-1-9. The information collected under IC 5-11-1-9 must be directly related to the examination by the state board of accounts or a related proceeding. Information collected under IC 5-11-1-9 may not be disclosed to the public, unless disclosure is expressly required by statute.

(9) A request by the attorney general for information required for an audit, examination, review, or investigation. The request from the attorney general must be directly related to the audit, examination, review, or investigation being completed. Information collected pursuant to an audit, examination, review, or investigation by the attorney general shall not be disclosed to the public, unless disclosure is expressly required by statute.

(10) Information submitted by a vendor to the state comptroller for the purpose of receiving payment from the state under IC 4-13-2-14.8 or IC 5-11-10-1.6. Information that directly identifies a person as a donor of financial support to a nonprofit organization shall not be collected by or disclosed to the state comptroller unless it is voluntarily submitted by the nonprofit organization.

(11) Information requested or submitted for the purpose of licensing a qualified organization under IC 4-32.3-4. The information collected under IC 4-32.3-4 shall not be disclosed to the public, unless disclosure is expressly required by statute.

(12) Personal information that a public agency requests from a nonprofit hospital for a legitimate business purpose of the public agency.

(c) Personal information is considered confidential and is not subject to disclosure under IC 5-14-3.

As added by P.L.221-2023, SEC.2. Amended by P.L.9-2024, SEC.444.