{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 5/1/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
["Question","USA, Missouri"]
["Key Legislation Overview"]
["What is the key legislation?"," The key privacy legislation is: \n\n \n\t Missouri’s Data Breach Notification Statute, RSMO § 407.1500 et. Seq. (“ Data Breach Law ”) \n\t Regulation of Social Security Numbers, RSMO 407.1355 (“ SSN Law ”) \n\t Credit Card Numbers, RSMO 407.433 (“ Credit Card Law ”) \n \n"]
["Key Data Protection Provisions"]
["What data is protected?"," Data Breach Law : \n\n Missouri resident’s “Personal Information” defined as: \n\n \n\t First name/first initial and last name, if in combination with:\n\t \n\t\t Social Security Number; \n\t\t Driver’s License Number; \n\t\t Other unique identifying number created or collected by governmental entities; \n\t\t Financial account, credit card, or debit card number, in combination with any password, PIN code, or other code which would afford access to an individual’s financial account; \n\t\t A unique identifier or routing code, in combination with any password, PIN code, or other code which would afford access to an individual’s financial account; \n\t\t Medical information; or \n\t\t Health insurance information. \n\t \n\t \n \n\n SSN Law : Social Security Numbers \n\n Credit Card Law : Credit Card Numbers \n"]
["Who is subject to privacy obligations?","Any entity which “owns or licenses” (read: holds) Missouri resident’s Personal Information. Entities that hold Personal Information on behalf of others (read: akin to Processor under \nGDPR).\n"]
["What are the principles applicable to personal data processing?"," SSN Law : \n\n Persons may not require: \n\n \n\t Transmission of SSN’s over the internet, unless connection “secure” or SSN encrypted; \n\t Individual to use SSN to access the website, unless in combination with a password, unique personal identifier, or other authentication devices; or \n\t Individual to use SSN as employee number for any type of employment-related activities. \n\t  \n \n"]
["How is the processing of personal data regulated?","Data Breach Law:\n“Unauthorized” disclosure requires data breach notification in accordance with the statute.\nSSN Law:\n\n\nMay not intentionally communicate or otherwise make available to the general public or to an individual's co-workers\nCredit Card Law:\n\n\nNo person other than the cardholder may disclose more than the last five numbers of a credit card number on a sales receipt.\n"]
["How are storage, security and retention of personal data regulated?","“Missouri law does not impose separate security or storage requirements apart from what is described above regarding the regulation of use and disclosure of personal data.”\nI would change this because a number of other states (OR, MA, RI) have WISP requirements within their statutory frameworks that establish minimum requirements for security programs, and other states (NY, OH, and potentially Utah in the near future) have statutes that provide a safe harbor for security programs. Since there is a growing number of states that have separate provisions or entirely separate statutes aimed at data security, I would highlight that Missouri does not.\n"]
["What are the data subjects' rights?","No.\n"]
["Are there restrictions on cross-border data transfers?","N/A\n"]
["Are there any notification requirements for data breaches?","Yes.  Risk-based assessment, with notification required unless assessment determines that identity theft or fraud not reasonably likely to occur.  \nNotification to affected individuals “without unreasonable delay.” Notice to Missouri Attorney General and credit reporting agencies if notice is required for more than 1,000 Missouri residents. \n"]
["Who is the privacy regulator?","Data Breach Law; SSN Law:\n\n\nMissouri Attorney General\nCredit Card Law:\n\n\nState Prosecuting Attorneys\n"]
["What are the consequences of a privacy breach?","Data Breach Law:\n\n\nAttorney General may seek actual damages for a willful and knowing violation of breach notification statute, as well as civil penalty not exceeding USD $150,000 per violation.\nCredit Card Law:\n\nRepeat violations are a class A misdemeanor.\n"]
["How is electronic marketing regulated?","Electronic marketing is governed by \nRSMO 407.1120-407.1132. \nThe statute requires that all unsolicited email marketing messages include a return email address or toll-free phone number so that the recipient of the message can unsubscribe from further messages if desired. \nViolating or assisting in the violation of the section constitutes an unlawful merchandising practice, and damages of the greater of USD $500 or actual damages can be recovered for violations. More information on this statute can be found here: \nhttps://revisor.mo.gov/main/OneSection.aspx?section=407.1120&bid=23281"]
["Are there any recent developments or expected reforms?","No updates – the only privacy-related bill proposed so far this session is updating the state \nSunshine Laws to include social media pages of government officials and governing bodies in the definition of a “public record.”\n"]