Processes biometric data, in Delaware

Del. Code Ann. tit. 6, section 12B-100 · Read the law's page

• Implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.
• This binds any person, including a government entity, that conducts business in Delaware and owns, licenses, or maintains personal information of a Delaware resident.
• There is no separate compliance runway to build against: the duty has been in force since April 14, 2018, when 81 Del. Laws, c. 129, section 1 took effect 240 days after its August 17, 2017 approval.
• Expect enforcement only from the Delaware Attorney General, through the Director of Consumer Protection, seeking to address a violation and to recover direct economic damages; the chapter does not itself state whether a private plaintiff may also sue.

Del. Code Ann. tit. 6, § 12D-102(3), (30) · Read the law's page

• Treat genetic or biometric data as sensitive data requiring heightened handling under DPDPA.
• Treat a voiceprint or other biometric identifier generated from a recording, for the purpose of identifying a specific individual, as covered biometric data. Delaware's exclusion does not reach data generated for that purpose.
• From January 1, 2027, treat as sensitive data any inference made from personal data, alone or in combination with other data, that is used to reveal or identify a listed category, and also neural data generated by measuring the activity of an individual's central nervous system, a financial account number or log-in credential or a card number that would allow access to a financial account, and a government-issued identification number that applicable law does not require to be publicly displayed (section 12D-102(33)).
• From January 1, 2027, do not process sensitive data unless the consumer consents and the processing is reasonably necessary and proportionate to the disclosed purposes for processing it (section 12D-106(a)(4)).
• From January 1, 2027, do not disclose sensitive data in a sale of personal data unless the disclosure is strictly necessary to provide or maintain a product or service the consumer affirmatively requested, you give clear and conspicuous notice before the sale naming the categories of sensitive data, the purpose and the third parties, you obtain the consumer's consent, and you keep a record of the consent for 5 years (section 12D-106(a)(12)).

Del. Code tit. 6, ch. 12D (84 Del. Laws c. 197) · Read the law's page

• Personal data that is lawfully made available through a government record or that a consumer has lawfully made available to the public through widely distributed media falls outside the DPDPA's definition of personal data, so scraping it does not by itself trigger the Act's duties.
• Delaware's applicability thresholds are 35,000 consumers, or 10,000 consumers with more than 20% of gross revenue from personal-data sales, until January 1, 2027, and 10,000 consumers, or 5,000 with that revenue share, from that date, so check the threshold for the period in question.
• Cite the Delaware Personal Data Privacy Act at Title 6, Chapter 12D, never Chapter 12C, which is a different, older website-privacy-policy law.