Duty LXD-1408
Processes biometric data, in the United States
FTC Act Section 5, Unfair or Deceptive Acts or Practices (privacy and data-security enforcement)since 2 lines
15 U.S.C. Section 45 · Read the law's page
- Do not engage in unfair or deceptive practices when collecting, using, or sharing personal data.
- Assess foreseeable privacy harms before deploying a system that collects or uses biometric identifiers derived from photographs, videos, or voice recordings, and disclose material facts about that collection.
DOJ Data Security Program (Bulk Sensitive Personal Data Rule)since 3 lines
28 CFR Part 202 · Read the law's page
- Do not engage in a prohibited bulk data-brokerage transaction involving bulk U.S. sensitive personal data, including biometric identifiers such as facial images or voice prints, or government-related data, with a country of concern or covered person.
- Apply the required security safeguards to a restricted vendor, employment, or investment transaction that would give a country of concern or covered person access to that data.
- Treat data as in scope even when it is anonymized, pseudonymized, de-identified or encrypted: a collection of sensitive personal data counts toward the bulk threshold in any of those forms (28 CFR 202.206).