Processes biometric data, in Arkansas

Ark. Code Ann. section 4-110-104(b) · Read the law's page

• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you acquire, own, or license, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• This binds a person or business, a term defined to include a state agency, that acquires, owns, or licenses personal information about an Arkansas resident.
• This duty is separate from the same section's duty to take all reasonable steps to destroy or arrange for destruction of a customer's records containing personal information no longer retained, and from the Act's own breach-notification duty, researched as this jurisdiction's privacy row.
• There is no dedicated regulator or stated penalty amount for a violation of this duty; only the Arkansas Attorney General may bring an enforcement action, under the Arkansas Deceptive Trade Practices Act. Whether that Act's private-suit provision also reaches a violation of this duty has not been confirmed either way; treat it as an open question rather than a cleared risk.

Ark. Code Ann. secs. 4-110-101 to 4-110-108 · Read the law's page

• Implement and maintain reasonable security procedures and practices to protect Arkansas residents' personal information, and dispose of records containing it in a manner that renders the information unreadable or undecipherable.
• Notify each affected Arkansas resident of a breach of security without unreasonable delay.
• Notify the Arkansas Attorney General if the breach affects more than 1,000 individuals, at the same time as consumer notice or within 45 days of determining a reasonable likelihood of harm, whichever occurs first.
• Treat faceprint and voiceprint data as personal information capable of triggering this Act's security and breach duties. PIPA names them directly with no exclusion for data derived from a photograph or recording.
• Do not assume PIPA violations are shielded from private suit. Section 4-110-108 gives the Attorney General enforcement under the Deceptive Trade Practices Act and no private action; whether the private action in section 4-88-113(f), written for a violation as defined in that Act's own chapter, reaches a PIPA violation is an open question.