Third Party Disclosure Requests
With the passage of Oregon Consumer Privacy Act and the Minnesota Consumer Data and Privacy Act, businesses in those states must provide consumers with a list of third parties with whom they share consumer data starting July 1st, 2024
Definition of a Third Party
A third party is a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller. Vendors with a data processing agreement, such as a third-party SaaS tool, are exempt from third-party disclosure.
Public agencies, public authorities, business partners, social media networks, advertising companies (behavioral advertising), and entities during a merger, acquisition, or insolvency.
Managing Third Parties in DataGrail
DataGrail is able to help you manage a list of third parties. This list can be governed on the application's settings page and used in DataGrail's email templates for third-party disclosures.
- Navigate to Settings
- Select Third-Party Disclosures
- Add third parties in the text box. Each line will be a new bullet point.
Customers can also add a list of systems (if LDM is configured) or a list of Integrations to their list by utilizing the buttons below the text box
- Once the list of third parties has been added, click Save List. This information will be utilized in a variable as part of the custom email template, triggered when a request is processed.
The Custom Email Template for processing a third-party disclosure request is named "Third Party Disclosure Request Results."
The third Party Email Template will utilize the variable %third_party_disclosure_list%
within the custom email template, which can be found in email templates.
Adding a Third Party to the List
The Third Party Disclosures page can be used to manually add third parties to the list by typing in an entry. Each entry should be added as a new line, and the formatting will automatically add a bullet point to each line. The list will update every time it is saved, and the custom email template sent to the requestor will dynamically pull the variable at the time of processing.
There is also an option to add a list of integrations connected to the platform or systems from Live Data Map (note: if you have not purchased Live Data Map, this option will not appear). This should be used as a starting point but may not constitute a comprehensive list. Third-party lists should be reviewed by legal counsel.
Third-Party Disclosure Requests Ticket Cycle
Configuring Policies with Third-Party Disclosures
DataGrail has added a new privacy right called "Third-Party Disclosures." This privacy right can be added similarly to any other privacy right to any policy. To have a policy with this privacy right added or the privacy right added to an existing policy, contact support@datagrail.io.
Ticket Creation in Request Manager
Once the privacy right is configured as part of a request policy, consumers can request the third-party disclosure via the intake form or any other configured intake method in DataGrail. Requests will be processed like any other request in DataGrail and will follow all the platform configurations.
Third Party Disclosure ticket processing
Third-party disclosures do run access on connected integrations in the Extraction Phase. Requests will move through the configured settings. For example, if verification is required, the request will only move to the Pending Action phase once verification is complete. When the request is processed in the Pending Action phase, confirm the email to be sent (which will be based on what is configured on the Third Party Disclosures page), and proceed.
Custom Email Templates and Third-Party Disclosure Variable
Custom email templates can be managed in Settings. There, you can customize messaging to the requestor and utilize the %third_party_disclosure%
Variable to send the list.
Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material.