Right to impermanence

(a) Limitation on maintaining of personal information A covered entity may not maintain personal information for more time than expressly consented to by an individual whose personal information is being maintained. (b) Consent A covered entity shall obtain express affirmative consent from an individual before maintaining the personal information of such individual for any duration. Such consent may be obtained for categories of personal information and shall give an individual options to affirmatively choose granting a covered entity consent for various durations, at least including— (1) for no longer than needed to complete the specific request or transaction (including a reasonable estimate of such duration by the covered entity); (2) until consent is revoked; and (3) one or more additional durations based on reasonable expectations and norms for maintaining the category of personal information. (c) Exception for implied consent Where the long-term maintaining of personal information is, on its face, obvious and a core feature of the product or service at the request of the individual, and the personal information is maintained only to provide such product or service, subsections (a) and (b) shall not apply.