Duty LXD-1427
Processes biometric data, in Louisiana
Each law's tag says when it binds: since in force from , in 7 weeks not yet in force
Database Security Breach Notification Law, definitionssince 1 line
La. R.S. 51:3073 · Read the law's page
- Treat a biometric identifier used to authenticate access to a system or account as covered personal information under this statute; its biometric definition is narrower than, and should not be conflated with, the LDPA's own biometric data definition.
Database Security Breach Notification Law, reasonable security procedures and destruction dutysince 5 lines
La. R.S. 51:3074(A), (B) · Read the law's page
- This binds any person conducting business in Louisiana, or any person or state or local agency, that owns or licenses computerized data including personal information; unlike the Louisiana Data Privacy Act, it carries no revenue, volume, or sale-percentage threshold.
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect personal information from unauthorized access, destruction, use, modification, or disclosure.
- Take all reasonable steps to destroy or arrange for the destruction of records containing personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable.
- Expect a violation of either duty to be enforceable as an unfair trade practice, by the Attorney General for injunctive relief and, because R.S. 51:3074(J)'s deeming clause carries no exclusion of R.S. 51:1409, by a private action from a harmed Louisiana resident for actual damages, trebled if the violation was knowing after Attorney General notice, plus attorney fees and costs.
- Do not conflate this pre-existing safeguards duty with the Louisiana Data Privacy Act's own controller security-of-processing duty at R.S. 51:1780.4(A)(1)(b), a separate, later-enacted comprehensive-regime clause documented under this jurisdiction's privacy topic rather than here.
Louisiana Human Genomic Security Act of 2025: prohibition on certain human genetic sequencerssince 1 line
La. R.S. 51:3183 · Read the law's page
- If you are a medical facility or research facility in Louisiana, do not put into service any new or additional human genetic sequencer, or operational and research software used for human genetic analysis, produced by the government of a foreign adversary (the People's Republic of China including Hong Kong, Cuba, Iran, North Korea or Russia), a state-owned company of a foreign adversary or a foreign adversary company.
Louisiana Data Privacy Act (Act No. 502), sensitive and biometric datafrom , in 7 weeks3 lines
La. R.S. 51:1780.1(3), (29) · Read the law's page
- Treat an identifier deliberately extracted from a photograph, video, or audio recording to identify a specific Louisiana resident as biometric and sensitive data under the LDPA, notwithstanding the recording's own public or non-public origin.
- Obtain a Louisiana consumer's consent before selling sensitive data, if you meet the LDPA's revenue-from-sale applicability threshold.
- Treat genetic data, health diagnosis information, racial or ethnic origin, religious belief, sexuality, immigration status, a known child's data, and precise geolocation as sensitive data requiring heightened handling.