Notice and consent required

(a) Notice A covered entity shall provide an individual with notice of the personal information such covered entity collects, processes, maintains, and discloses through a process that is concise and clear and can be objectively shown to meet the threshold established by the Director under section 208(a). (b) Consent (1) Express consent required Except as provided in paragraphs (2) and (3), a covered entity may not collect from an individual personal information that creates or increases the risk of foreseeable privacy harms, or process or maintain any such personal information collected from an individual, unless such entity obtains the express consent of such individual to the collecting, processing, or maintaining (or any combination thereof) of such information through a process that is concise and clear and can be objectively shown to meet the threshold established by the Director under section 208(a). (2) Exception for implied consent Notwithstanding paragraph (1), express consent is not required for collecting, processing, or maintaining personal information if the collecting, processing, or maintaining is, on its face, obvious and necessary to provide a service at the request of the individual and the personal information is collected, processed, or maintained only for such request. Nothing in this paragraph shall be construed to exempt the covered entity from the requirement of subsection (a) to provide notice to such individual with respect to such collecting, processing, or maintaining. (3) Exemption for privacy-preserving computing Notwithstanding paragraph (1), except with regard to consent for purposes of section 106, express consent is not required for collecting, processing, or maintaining personal information secured using privacy-preserving computing. Nothing in this paragraph shall be construed to exempt the covered entity from the requirement of subsection (a) to provide notice to such individual with respect to such collecting, processing, or maintaining. (c) Service providers excluded This section does not apply to a service provider if such service provider has a reasonable belief that a covered entity for which it processes, maintains, or discloses personal information is in compliance with this section.