Law note · Indiana
Indiana Consumer Data Protection Act (INCDPA), publicly available information exemption
What it asks of an app
- Personal data that is lawfully made available through a government record, or that a consumer or widely distributed media has lawfully made available to the public, falls outside the INCDPA's definition of personal data.
- If you meet the INCDPA's 100,000-consumer threshold, expect enforcement only from the Indiana Attorney General; the Act carries no private right of action.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
What we found
IC 24-15-2-19(b) defines personal data to exclude de-identified data, aggregate data, or publicly available information.
IC 24-15-2-26 defines publicly available information as information that is lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer to whom the information pertains, or by a person to whom the consumer has disclosed it, the same three-way structure several peer states use.
As in those states, the exemption excludes scraped government-record and public-media personal data from the statute's scope by definition rather than by carve-out. IC 24-15-1-1(a)(1) applies the Act to a person conducting business in Indiana or targeting Indiana residents that, during a calendar year, controls or processes personal data of at least 100,000 consumers. Enforcement is Attorney-General-only; there is no private right of action.