{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":29,"n_cols":2,"rows_kept":29,"cut":false,"hidden":false,"merged":[]}
["Question","USA, Missouri"]
["Key Legislation Overview"]
["1. What is the key legislation?"," The key privacy legislation is: \n\n \n\t Missouri’s Data Breach Notification Statute, RSMO § 407.1500 et. Seq. (“ Data Breach Law ”) \n\t Regulation of Social Security Numbers, RSMO 407.1355 (“ SSN Law ”) \n\t Credit Card Numbers, RSMO 407.433 (“ Credit Card Law ”) \n \n"]
["2. What are the key decisions applying that legislation?"]
["Key Data Protection Provisions"]
["1. How are “personal data” and “sensitive data” defined?"]
["2. How is the defined data protected?"]
["3. Who is subject to privacy obligations?","Any entity which “owns or licenses” (read: holds) Missouri resident’s Personal Information. Entities that hold Personal Information on behalf of others (read: akin to Processor under \nGDPR).\n"]
["4. How is “data processing” defined?"]
["5. What are the principles applicable to personal data processing?"," SSN Law : \n\n Persons may not require: \n\n \n\t Transmission of SSN’s over the internet, unless connection “secure” or SSN encrypted; \n\t Individual to use SSN to access the website, unless in combination with a password, unique personal identifier, or other authentication devices; or \n\t Individual to use SSN as employee number for any type of employment-related activities. \n\t  \n \n"]
["6. How is the processing of personal data regulated?","Data Breach Law:\n“Unauthorized” disclosure requires data breach notification in accordance with the statute.\nSSN Law:\n\n\nMay not intentionally communicate or otherwise make available to the general public or to an individual's co-workers\nCredit Card Law:\n\n\nNo person other than the cardholder may disclose more than the last five numbers of a credit card number on a sales receipt.\n"]
["7. How are storage, security and retention of personal data regulated?","“Missouri law does not impose separate security or storage requirements apart from what is described above regarding the regulation of use and disclosure of personal data.”\nI would change this because a number of other states (OR, MA, RI) have WISP requirements within their statutory frameworks that establish minimum requirements for security programs, and other states (NY, OH, and potentially Utah in the near future) have statutes that provide a safe harbor for security programs. Since there is a growing number of states that have separate provisions or entirely separate statutes aimed at data security, I would highlight that Missouri does not.\n"]
["8. What are the data subjects' rights under the data legislation?","No.\n"]
["9. What are the consent requirements for data subjects?"]
["10. How is authorization for use of data handled?"]
["11. Are cross-border data transfers regulated? If so, what are the restrictions on cross-border data transfers?","N/A\n"]
["12. How are data \"incidents\" and \"breaches\" defined?"]
["13. Are there any notification requirements for incidents and/or data breaches?","Yes.  Risk-based assessment, with notification required unless assessment determines that identity theft or fraud not reasonably likely to occur.  \nNotification to affected individuals “without unreasonable delay.” Notice to Missouri Attorney General and credit reporting agencies if notice is required for more than 1,000 Missouri residents. \n"]
["14. Who is/are the privacy regulator(s)?","Data Breach Law; SSN Law:\n\n\nMissouri Attorney General\nCredit Card Law:\n\n\nState Prosecuting Attorneys\n"]
["15. What are the consequences of a data breach?","Data Breach Law:\n\n\nAttorney General may seek actual damages for a willful and knowing violation of breach notification statute, as well as civil penalty not exceeding USD $150,000 per violation.\nCredit Card Law:\n\nRepeat violations are a class A misdemeanor.\n"]
["16. How is electronic marketing regulated?","Electronic marketing is governed by \nRSMO 407.1120-407.1132. \nThe statute requires that all unsolicited email marketing messages include a return email address or toll-free phone number so that the recipient of the message can unsubscribe from further messages if desired. \nViolating or assisting in the violation of the section constitutes an unlawful merchandising practice, and damages of the greater of USD $500 or actual damages can be recovered for violations. More information on this statute can be found here: \nhttps://revisor.mo.gov/main/OneSection.aspx?section=407.1120&bid=23281"]
["17.\tAre there sector-specific or industry-specific privacy requirements?"]
["18.\tWhat are the requirements for appointing Data Protection Officers or similar roles?"]
["19.\tWhat are the record-keeping and documentation obligations?"]
["20.\tWhat are the requirements for conducting Data Protection Impact Assessments (DPIAs)?"]
["21.\tWhat are the requirements for third-party vendor management and data sharing?"]
["22.\tWhat are the penalties and enforcement mechanisms for non-compliance?"]
["23.\tWhat are the ongoing compliance and audit requirements?"]
["24. Are there any recent developments or expected reforms?","No updates – the only privacy-related bill proposed so far this session is updating the state \nSunshine Laws to include social media pages of government officials and governing bodies in the definition of a “public record.”\n"]