{ "type": "practice-guide", "canonical": "https://openagreements.org/practice-guides/privacy/us/alaska", "links": [ { "rel": "self", "href": "https://openagreements.org/practice-guides/privacy/us/alaska.json", "type": "application/json" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/alaska", "type": "text/html" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/alaska/markdown", "type": "text/markdown" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/alaska/json", "type": "application/json" } ], "data": { "topic": "privacy", "state": "alaska", "frontmatter": { "title": "Alaska Consumer Privacy Law", "description": "Alaska has no comprehensive consumer-privacy statute. Article 1 of the Personal Information Protection Act (AS 45.48.010–.090) governs breach notice and routes violations into the unfair-trade-practices act with a $500 private-damages cap; the Genetic Privacy Act and the federal overlay fill out the rest of this Alaska privacy note.", "state": "Alaska", "lastReviewed": "2026-06-11", "license": "CC BY 4.0", "authors": [ "steven-obiajulu" ], "summary": { "keyLaw": "Alaska Personal Information Protection Act Article 1, AS 45.48.010–.090 — breach notification plus a deemed unfair-trade-practice enforcement bridge; Alaska has no comprehensive consumer-privacy law", "appliesTo": "Any covered person — a person doing business, a governmental agency, or a person with more than 10 employees — that owns or licenses personal information on Alaska residents; no revenue or consumer-volume threshold", "privacyPolicyRequired": "No Alaska statute mandates a general consumer privacy policy or fixes its contents; contents are driven by FTC Act § 5 (a policy that misstates practices is deceptive) and by GLBA, HIPAA, and COPPA where the business is in scope", "privateRightOfAction": "Yes, but tightly capped — a breach-notice violation is an unfair trade practice under AS 45.50.471, with private damages limited to actual economic damages not exceeding $500; the Genetic Privacy Act (AS 18.13) separately allows $5,000 or $100,000 statutory damages", "regulator": "Alaska Attorney General (Department of Law); the Department of Administration enforces breach-notice violations by state agencies", "bottomLine": "Alaska has not enacted a comprehensive consumer-privacy law, so there are no general data-rights, notice-at-collection, consent, or processor-contract duties under state law. The operative law covered here is Article 1 of the Personal Information Protection Act, which requires breach notice in the most expeditious time possible and makes a violation an unfair trade practice — but caps private damages at $500 of actual economic loss. The Genetic Privacy Act is the sharp edge of Alaska law, conditioning DNA collection on informed written consent and backing that with $5,000 or $100,000 statutory damages. Everything else in this Alaska-facing program note comes from the federal and sectoral overlay — FTC Act § 5, GLBA, HIPAA, and COPPA — so build to those plus the breach statute, and the program upgrades rather than restarts if Alaska enacts an omnibus law later.", "lawCoverage": "baseline", "policyMandate": "none", "consumersCanSue": "narrow", "sensitiveDataConsent": "categorySpecific", "universalOptOutSignal": "notRequired" }, "about": [ "Alaska consumer privacy law", "Alaska Personal Information Protection Act Article 1", "Alaska data breach notification AS 45.48.010", "Alaska no comprehensive privacy law", "Alaska privacy policy requirements", "Alaska data breach unfair trade practice", "Alaska data breach private right of action", "Alaska Genetic Privacy Act AS 18.13", "Alaska HB 367 Consumer Data Privacy Act", "Alaska constitutional right of privacy" ], "translations": [ { "language": "中文", "status": "planned" }, { "language": "Español", "status": "planned" }, { "language": "Português", "status": "planned" }, { "language": "Deutsch", "status": "planned" } ] }, "questions": [ { "slug": "which-privacy-laws-apply", "label": "Which privacy laws apply to your business in Alaska?", "heading": "Which privacy laws apply to your business in Alaska?", "answerText": "There is no comprehensive Alaska consumer-privacy law. The operative breach-notification statute covered here is Article 1 of the Alaska Personal Information Protection Act (PIPA), which applies to any covered person — a person doing business, a governmental agency, or a person with more than 10 employees — that owns or licenses personal information on an Alaska resident. It carries no revenue or consumer-volume threshold, and it governs breach response rather than day-to-day data handling. Alongside it sits the Genetic Privacy Act, which conditions DNA collection, analysis, retention, and disclosure on informed and written consent.", "sources": [ { "id": "pipa-covered-person", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.090", "citation": "AS 45.48.090(2).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "PIPA Article 1 applies to any covered person — a person doing business, a governmental agency, or a person with more than 10 employees — with no revenue threshold.", "verbatimQuote": "“covered person” means a (A) person doing business; (B) governmental agency; or (C) person with more than 10 employees;", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-covered-person" }, { "id": "q1-pipa-trigger", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.010", "citation": "AS 45.48.010(a).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "PIPA Article 1's core duty attaches when a covered person that owns or licenses personal information on an Alaska resident suffers a breach of the security of the information system.", "verbatimQuote": "If a covered person owns or licenses personal information in any form that includes personal information on a state resident, and a breach of the security of the information system that contains personal information occurs, the covered person shall, after discovering or being notified of the breach, disclose the breach to each state resident whose personal information was subject to the breach.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-q1-pipa-trigger" }, { "id": "q1-gpa-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 18.13.010", "citation": "AS 18.13.010(a)(1).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=18.13.010&secEnd=18.13.100", "proposition": "Alaska's Genetic Privacy Act prohibits collecting a DNA sample, performing or retaining a DNA analysis, or disclosing its results without the person's informed and written consent.", "verbatimQuote": "a person may not collect a DNA sample from a person, perform a DNA analysis on a sample, retain a DNA sample or the results of a DNA analysis, or disclose the results of a DNA analysis unless the person has first obtained the informed and written consent of the person, or the person's legal guardian or authorized representative, for the collection, analysis, retention, or disclosure;", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-q1-gpa-consent" } ] }, { "slug": "privacy-policy-contents", "label": "What must your Alaska privacy policy contain?", "heading": "What must your Alaska privacy policy contain?", "answerText": "No Alaska statute requires a general consumer privacy policy or fixes what it must say. For most businesses, the policy is governed not by a state checklist but by the rule that whatever you publish has to be true: Section 5 of the FTC Act declares unfair or deceptive practices unlawful, and Alaska's UTPCPA reaches misleading conduct and misrepresentations in sales or advertising. A policy mismatch can be pursued under those general deceptive-practices theories. Where a sectoral regime applies, that regime supplies the contents instead — a HIPAA covered entity, for example, must give individuals a notice of the uses and disclosures of their protected health information and of their rights and the entity's duties.", "sources": [ { "id": "fed-ftc5-deceptive", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "FTC Act § 5", "citation": "15 U.S.C. § 45(a)(1).", "url": "https://www.law.cornell.edu/uscode/text/15/45", "deepLink": "https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.", "proposition": "Section 5 of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful.", "verbatimQuote": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-fed-ftc5-deceptive" }, { "id": "ak-utpcpa-deception", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.50.471", "citation": "AS 45.50.471(b)(11)-(12).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.50.471&secEnd=45.50.471", "proposition": "Alaska's UTPCPA includes misleading conduct and misrepresentations in connection with the sale or advertisement of goods or services among unfair or deceptive acts or practices.", "verbatimQuote": "The terms \"unfair methods of competition\" and \"unfair or deceptive acts or practices\" include the following acts", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-ak-utpcpa-deception" }, { "id": "fed-hipaa-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "HIPAA Notice of Privacy Practices", "citation": "45 C.F.R. § 164.520.", "url": "https://www.law.cornell.edu/cfr/text/45/164.520", "deepLink": "https://www.law.cornell.edu/cfr/text/45/164.520#:~:text=an%20individual%20has%20a%20right,respect%20to%20protected%20health%20information", "proposition": "A HIPAA covered entity must give individuals a notice describing the uses and disclosures of their protected health information and their rights and the entity's legal duties.", "verbatimQuote": "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-fed-hipaa-notice" } ] }, { "slug": "vendor-contracts", "label": "What must your contracts with vendors say?", "heading": "What must your contracts with vendors say?", "answerText": "Alaska has no omnibus data-processing-agreement requirement — no state statute prescribes controller-to-processor terms, audit rights, deletion clauses, or subprocessor flow-downs for general private-sector contracts. The one Alaska statute that touches the vendor relationship is PIPA: a vendor that maintains personal information on another business's behalf (an information recipient) is excused from notifying residents directly, but must immediately notify the business that owns or licensed the data (the information distributor) after discovering a breach and cooperate so that business can give the required notices.", "sources": [ { "id": "pipa-recipient-notify", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.070", "citation": "AS 45.48.070(a)-(b).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "A vendor holding personal information on another business's behalf need not notify residents itself, but must immediately notify the business that owns or licensed the data, cooperate by sharing relevant non-confidential information, and allow that business to comply as if the breach occurred on its own system.", "verbatimQuote": "If a breach of the security of the information system containing personal information on a state resident that is maintained by an information recipient occurs, the information recipient is not required to comply with AS 45.48.010 — 45.48.030.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-recipient-notify" }, { "id": "fed-glba-safeguards", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "GLBA Safeguards Rule", "citation": "16 C.F.R. § 314.4(f)(2).", "url": "https://www.law.cornell.edu/cfr/text/16/314.4", "deepLink": "https://www.law.cornell.edu/cfr/text/16/314.4#:~:text=Requiring%20your%20service%20providers%20by,implement%20and%20maintain%20such%20safeguards", "proposition": "The GLBA Safeguards Rule requires a financial institution to oversee its service providers, including by requiring them by contract to implement and maintain appropriate safeguards for customer information.", "verbatimQuote": "Requiring your service providers by contract to implement and maintain such safeguards", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-fed-glba-safeguards" }, { "id": "fed-hipaa-baa", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "HIPAA Business Associate Contracts", "citation": "45 C.F.R. § 164.504(e)(2).", "url": "https://www.law.cornell.edu/cfr/text/45/164.504", "deepLink": "https://www.law.cornell.edu/cfr/text/45/164.504#:~:text=A%20contract%20between%20the%20covered,with%20respect%20to%20such%20information%3B", "proposition": "HIPAA requires a written business-associate contract that establishes permitted uses and disclosures, requires safeguards, breach reporting, and downstream-subcontractor flow-down terms.", "verbatimQuote": "A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that: (A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and (B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. (ii) Provide that the business associate will: (A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; (B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract; (C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410; (D) In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-fed-hipaa-baa" } ] }, { "slug": "breach-notification", "label": "When must you notify people of a data breach in Alaska?", "heading": "When must you notify people of a data breach in Alaska?", "answerText": "After discovering or being notified of a breach, a covered person must disclose it to each Alaska resident whose personal information was subject to the breach. The notice must be made in the most expeditious time possible and without unreasonable delay — Alaska sets no fixed day count — allowing only the time needed to determine the breach's scope and restore the system's integrity, or a delay requested in connection with a criminal investigation. There is one exception: notice is not required if, after an appropriate investigation and written notification to the attorney general, the covered person determines there is not a reasonable likelihood of harm to consumers — a determination that must be documented and kept for five years.", "sources": [ { "id": "pipa-trigger", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.010", "citation": "AS 45.48.010(a).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "A covered person that owns or licenses personal information on Alaska residents must, after discovering or being notified of a breach, disclose the breach to each affected resident.", "verbatimQuote": "If a covered person owns or licenses personal information in any form that includes personal information on a state resident, and a breach of the security of the information system that contains personal information occurs, the covered person shall, after discovering or being notified of the breach, disclose the breach to each state resident whose personal information was subject to the breach.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-trigger" }, { "id": "pipa-timing", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.010", "citation": "AS 45.48.010(b).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "The disclosure must be made in the most expeditious time possible and without unreasonable delay, allowing only for scope determination, system restoration, and the statute's law-enforcement delay.", "verbatimQuote": "An information collector shall make the disclosure required by (a) of this section in the most expeditious time possible and without unreasonable delay, except as provided in AS 45.48.020 and as necessary to determine the scope of the breach and restore the reasonable integrity of the information system.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-timing" }, { "id": "pipa-le-delay", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.020", "citation": "AS 45.48.020.", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "Notice may be delayed if a law enforcement agency determines that disclosure would interfere with a criminal investigation, with notice resuming once the agency clears it in writing.", "verbatimQuote": "An information collector may delay disclosing the breach under AS 45.48.010 if an appropriate law enforcement agency determines that disclosing the breach will interfere with a criminal investigation. However, the information collector shall disclose the breach to the state resident in the most expeditious time possible and without unreasonable delay after the law enforcement agency informs the information collector in writing that disclosure of the breach will no longer interfere with the investigation.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-le-delay" }, { "id": "pipa-harm-exception", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.010", "citation": "AS 45.48.010(c).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "Resident notice is excused only if, after an appropriate investigation and written notification to the attorney general, the covered person determines there is no reasonable likelihood of harm; the determination must be documented for five years, and the attorney-general notification is non-public.", "verbatimQuote": "Notwithstanding (a) of this section, disclosure is not required if, after an appropriate investigation and after written notification to the attorney general of this state, the covered person determines that there is not a reasonable likelihood that harm to the consumers whose personal information has been acquired has resulted or will result from the breach. The determination shall be documented in writing, and the documentation shall be maintained for five years. The notification required by this subsection may not be considered a public record open to inspection by the public.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-harm-exception" }, { "id": "pipa-breach-def", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.090", "citation": "AS 45.48.090(1).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "A breach of the security is the unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information that compromises its security, confidentiality, or integrity.", "verbatimQuote": "“breach of the security” means unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information that compromises the security, confidentiality, or integrity of the personal information maintained by the information collector;", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-breach-def" }, { "id": "pipa-personal-info", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.090", "citation": "AS 45.48.090(7).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "Personal information is a resident's name combined with an unencrypted or unredacted data element such as a Social Security number, driver's license or state ID number, account or card number plus any required personal code, or passwords and access codes for financial accounts — and encryption is no safe harbor if the key was also accessed or acquired.", "verbatimQuote": "\"personal information\" means information in any form on an individual that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired, and that consists of a combination of (A) an individual's name; in this subparagraph, \"individual's name\" means a combination of an individual's (i) first name or first initial; and (ii) last name; and (B) one or more of the following information elements: (i) the individual's social security number; (ii) the individual's driver's license number or state identification card number; (iii) except as provided in (iv) of this subparagraph, the individual's account number, credit card number, or debit card number; (iv) if an account can only be accessed with a personal code, the number in (iii) of this subparagraph and the personal code; in this sub-subparagraph, \"personal code\" means a security code, an access code, a personal identification number, or a password; (v) passwords, personal identification numbers, or other access codes for financial accounts.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-personal-info" }, { "id": "pipa-methods", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.030", "citation": "AS 45.48.030.", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "Notice is given by written document or qualifying electronic means, with a substitute route (email, website posting, and statewide media) available where notice would cost over $150,000, the affected class exceeds 300,000 residents, or contact information is insufficient.", "verbatimQuote": "An information collector shall make the disclosure required by AS 45.48.010 (1) by a written document sent to the most recent address the information collector has for the state resident; (2) by electronic means if the information collector's primary method of communication with the state resident is by electronic means or if making the disclosure by the electronic means is consistent with the provisions regarding electronic records and signatures required for notices legally required to be in writing under 15 U.S.C. 7001 et seq. (Electronic Signatures in Global and National Commerce Act); or (3) if the information collector demonstrates that the cost of providing notice would exceed $150,000, that the affected class of state residents to be notified exceeds 300,000, or that the information collector does not have sufficient contact information to provide notice, by (A) electronic mail if the information collector has an electronic mail address for the state resident; (B) conspicuously posting the disclosure on the Internet website of the information collector if the information collector maintains an Internet website; and (C) providing a notice to major statewide media.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-methods" }, { "id": "pipa-cra-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.040", "citation": "AS 45.48.040(a).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "If more than 1,000 Alaska residents must be notified, the information collector must also notify the nationwide consumer credit reporting agencies of the timing, distribution, and content of the notices.", "verbatimQuote": "If an information collector is required by AS 45.48.010 to notify more than 1,000 state residents of a breach, the information collector shall also notify without unreasonable delay all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis and provide the agencies with the timing, distribution, and content of the notices to state residents.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-cra-notice" }, { "id": "pipa-waiver", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.060", "citation": "AS 45.48.060.", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "The breach-notification article cannot be waived by contract — any waiver is void and unenforceable.", "verbatimQuote": "A waiver of AS 45.48.010 — 45.48.090 is void and unenforceable.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-waiver" } ] }, { "slug": "genetic-data", "label": "Does Alaska have special rules for DNA and genetic data?", "heading": "Does Alaska have special rules for DNA and genetic data?", "answerText": "Yes — and they are the strictest privacy rules on Alaska's books. Under the Genetic Privacy Act, a person may not collect a DNA sample, perform a DNA analysis, retain a sample or its results, or disclose the results without first obtaining the person's informed and written consent. The statute goes further than consent: a DNA sample and the results of its analysis are the exclusive property of the person sampled or analyzed. Violations carry a private right of action with statutory damages of $5,000 — or $100,000 if the violation produced profit or monetary gain — and knowing violations are a class A misdemeanor.", "sources": [ { "id": "gpa-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 18.13.010", "citation": "AS 18.13.010(a)(1).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=18.13.010&secEnd=18.13.100", "proposition": "The Genetic Privacy Act prohibits collecting a DNA sample, performing or retaining a DNA analysis, or disclosing its results without the person's prior informed and written consent.", "verbatimQuote": "a person may not collect a DNA sample from a person, perform a DNA analysis on a sample, retain a DNA sample or the results of a DNA analysis, or disclose the results of a DNA analysis unless the person has first obtained the informed and written consent of the person, or the person's legal guardian or authorized representative, for the collection, analysis, retention, or disclosure;", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-gpa-consent" }, { "id": "gpa-property", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 18.13.010", "citation": "AS 18.13.010(a)(2).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=18.13.010&secEnd=18.13.100", "proposition": "Alaska law makes a DNA sample and the results of its analysis the exclusive property of the person sampled or analyzed.", "verbatimQuote": "a DNA sample and the results of a DNA analysis performed on the sample are the exclusive property of the person sampled or analyzed.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-gpa-property" }, { "id": "gpa-pra", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 18.13.020", "citation": "AS 18.13.020.", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=18.13.010&secEnd=18.13.100", "proposition": "The Genetic Privacy Act gives the person a civil action with statutory damages of $5,000, or $100,000 if the violation resulted in profit or monetary gain to the violator, on top of actual damages.", "verbatimQuote": "A person may bring a civil action against a person who collects a DNA sample from the person, performs a DNA analysis on a sample, retains a DNA sample or the results of a DNA analysis, or discloses the results of a DNA analysis in violation of this chapter. In addition to the actual damages suffered by the person, a person violating this chapter shall be liable to the person for damages in the amount of $5,000 or, if the violation resulted in profit or monetary gain to the violator, $100,000.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-gpa-pra" }, { "id": "gpa-misdemeanor", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 18.13.030", "citation": "AS 18.13.030(a), (c).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=18.13.010&secEnd=18.13.100", "proposition": "A knowing violation of the Genetic Privacy Act is the crime of unlawful DNA collection, analysis, retention, or disclosure — a class A misdemeanor.", "verbatimQuote": "A person commits the crime of unlawful DNA collection, analysis, retention, or disclosure if the person knowingly collects a DNA sample from a person, performs a DNA analysis on a sample, retains a DNA sample or the results of a DNA analysis, or discloses the results of a DNA analysis in violation of this chapter", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-gpa-misdemeanor" }, { "id": "gpa-consent-form", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 18.13.010", "citation": "AS 18.13.010(c).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=18.13.010&secEnd=18.13.100", "proposition": "A general medical-records authorization does not satisfy the Genetic Privacy Act's informed written consent requirement; the Department of Health may adopt a uniform consent form, use of that form provides a liability safe harbor, and consent may be revoked or amended at any time.", "verbatimQuote": "A general authorization for the release of medical records or medical information may not be construed as the informed and written consent required by this section. The Department of Health may by regulation adopt a uniform informed and written consent form to assist persons in meeting the requirements of this section. A person using that uniform informed and written consent is exempt from civil or criminal liability for actions taken under the consent form. A person may revoke or amend their informed and written consent at any time.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-gpa-consent-form" }, { "id": "gpa-dna-analysis-def", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 18.13.100", "citation": "AS 18.13.100(2).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=18.13.010&secEnd=18.13.100", "proposition": "DNA analysis means genetic typing and testing for genetic characteristics, but excludes routine physical measurements and common clinical tests such as drug, alcohol, cholesterol, HIV, chemical, blood, urine, and widely accepted diagnostic tests.", "verbatimQuote": "\"DNA analysis\" means DNA or genetic typing and testing to determine the presence or absence of genetic characteristics in an individual, including tests of nucleic acids or chromosomes in order to diagnose or identify a genetic characteristic; \"DNA analysis\" does not include a routine physical measurement, a test for drugs, alcohol, cholesterol, or the human immunodeficiency virus, a chemical, blood, or urine analysis, or any other diagnostic test that is widely accepted and in use in clinical practice;", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-gpa-dna-analysis-def" }, { "id": "gpa-exceptions", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 18.13.010", "citation": "AS 18.13.010(b).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=18.13.010&secEnd=18.13.100", "proposition": "The consent requirement does not apply to DNA samples collected for the state DNA-registration system, law-enforcement identification purposes, paternity determination, newborn screening, or emergency medical treatment.", "verbatimQuote": "The prohibitions of (a) of this section do not apply to DNA samples collected and analyses conducted (1) under AS 44.41.035 or comparable provisions of another jurisdiction; (2) for a law enforcement purpose, including the identification of perpetrators and the investigation of crimes and the identification of missing or unidentified persons or deceased individuals; (3) for determining paternity; (4) to screen newborns as required by state or federal law; (5) for the purpose of emergency medical treatment.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-gpa-exceptions" } ] }, { "slug": "consumer-lawsuit", "label": "Can a consumer sue your business in Alaska over privacy?", "heading": "Can a consumer sue your business in Alaska over privacy?", "answerText": "Yes, but for breach-notice violations the recovery is unusually small. PIPA builds a bridge into Alaska's consumer-protection act: a violation of the breach-notification article by a non-governmental information collector is an unfair or deceptive act or practice under the Unfair Trade Practices and Consumer Protection Act. But the bridge comes with a cap — in a private action over a PIPA violation, damages are limited to actual economic damages, and under the main private-action section they may not exceed $500. The state's recovery is capped too: in place of ordinary UTPCPA civil penalties, the information collector is liable for up to $500 for each resident who was not notified, with a $50,000 total ceiling. The exposure that is not capped sits in the Genetic Privacy Act, whose private action carries $5,000 or $100,000 statutory damages per violation.", "sources": [ { "id": "pipa-udap-bridge", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.080", "citation": "AS 45.48.080(b).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "A breach-notification violation by a non-governmental information collector is deemed an unfair or deceptive act or practice under the Unfair Trade Practices and Consumer Protection Act.", "verbatimQuote": "If an information collector who is not a governmental agency violates AS 45.48.010 — 45.48.090 with regard to the personal information of a state resident, the violation is an unfair or deceptive act or practice under AS 45.50.471 — 45.50.561.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-udap-bridge" }, { "id": "pipa-damages-cap", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.080", "citation": "AS 45.48.080(b)(2).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "In a private UTPCPA action over a PIPA violation, damages are limited to actual economic damages — capped at $500 under the main private-action section.", "verbatimQuote": "damages that may be awarded against the information collector under (A) AS 45.50.531 are limited to actual economic damages that do not exceed $500; and (B) AS 45.50.537 are limited to actual economic damages.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-damages-cap" }, { "id": "pipa-ag-penalty", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.48.080", "citation": "AS 45.48.080(b)(1).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090", "proposition": "In place of ordinary UTPCPA civil penalties, a violating information collector is liable to the state for up to $500 per resident not notified, with a $50,000 total ceiling.", "verbatimQuote": "the information collector is not subject to the civil penalties imposed under AS 45.50.551 but is liable to the state for a civil penalty of up to $500 for each state resident who was not notified under AS 45.48.010 — 45.48.090, except that the total civil penalty may not exceed $50,000", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-pipa-ag-penalty" }, { "id": "utpa-unlawful", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.50.471", "citation": "AS 45.50.471(a).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.50.471&secEnd=45.50.471", "proposition": "The UTPCPA declares unfair methods of competition and unfair or deceptive acts or practices in trade or commerce unlawful — the foundation for attorney-general privacy enforcement in Alaska.", "verbatimQuote": "Unfair methods of competition and unfair or deceptive acts or practices in the conduct of trade or commerce are declared to be unlawful.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-utpa-unlawful" }, { "id": "utpa-private-action", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.50.531", "citation": "AS 45.50.531(a).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.50.531&secEnd=45.50.535", "proposition": "The UTPCPA's ordinary private remedy is three times actual damages or $500, whichever is greater, for each unlawful act or practice — the baseline from which PIPA's cap carves down.", "verbatimQuote": "A person who suffers an ascertainable loss of money or property as a result of another person's act or practice declared unlawful by AS 45.50.471 may bring a civil action to recover for each unlawful act or practice three times the actual damages or $500, whichever is greater.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-utpa-private-action" }, { "id": "utpa-injunction", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 45.50.535", "citation": "AS 45.50.535(a)-(b).", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.50.531&secEnd=45.50.535", "proposition": "Any victim of an unlawful act under the UTPCPA — whether or not the person suffered actual damages — may sue to enjoin its continuation after giving written notice.", "verbatimQuote": "Subject to (b) of this section and in addition to any right to bring an action under AS 45.50.531 or other law, any person who was the victim of the unlawful act, whether or not the person suffered actual damages, may bring an action to obtain an injunction prohibiting a seller or lessor from continuing to engage in an act or practice declared unlawful under AS 45.50.471", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-utpa-injunction" }, { "id": "q6-gpa-pra", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "AS 18.13.020", "citation": "AS 18.13.020.", "url": "https://www.akleg.gov/basis/statutes.asp?media=print&secStart=18.13.010&secEnd=18.13.100", "proposition": "The Genetic Privacy Act's private right of action carries statutory damages of $5,000 — or $100,000 where the violation produced profit or monetary gain — on top of actual damages, with no PIPA-style cap.", "verbatimQuote": "In addition to the actual damages suffered by the person, a person violating this chapter shall be liable to the person for damages in the amount of $5,000 or, if the violation resulted in profit or monetary gain to the violator, $100,000.", "anchor": "https://openagreements.org/practice-guides/privacy/us/alaska#src-q6-gpa-pra" } ] } ] } }