Duty LXD-1448
Processes biometric data, in South Carolina
Requirements for disposition of business records containing personal identifying informationsince 3 lines
Disposition of business records, S.C. Code Ann. sec. 37-20-190 · Read the law's page
- Applies to a business that disposes of a business record that contains personal identifying information of a customer. It does not apply to a bank or financial institution subject to and in compliance with the privacy and security provision of the Gramm-Leach-Bliley Act, a health insurer subject to and in compliance with the privacy and security standards of the Health Insurance Portability and Accountability Act of 1996, or a consumer credit-reporting agency subject to and in compliance with the federal Fair Credit Reporting Act.
- When you dispose of a business record that contains personal identifying information of a customer, modify the personal identifying information by shredding, erasing, or other means so that it is unreadable or undecipherable.
- You comply if you contract with a person engaged in the business of disposing of records to make that modification on your behalf.
Age-Appropriate Design Code, sensitive personal data and biometric datasince 3 lines
S.C. Code Ann. sec. 39-80-10(18) (Act No. 96 of 2026, H. 3431) · Read the law's page
- Treat biometric data processed to uniquely identify an individual as sensitive personal data, and state in the annual public report whether, how and for what purpose you collect or process minors' sensitive personal data (sections 39-80-10(18)(g) and 39-80-70(A)(4)).
- Do not assume a recording-derived faceprint or voiceprint is excluded from 'biometric data' here. The chapter never defines the term, so no exclusion or clawback can be confirmed either way from the statutory text.
- Do not treat a minor's biometric data collected without the minor's knowledge as publicly available data, even if drawn from an otherwise public source.