Duty LXD-2663
Makes employment decisions, in Louisiana
Each law's tag says when it binds: since in force from , in 7 weeks not yet in force
Database Security Breach Notification Law, reasonable security procedures and destruction dutysince 5 lines
La. R.S. 51:3074(A), (B) · Read the law's page
- This binds any person conducting business in Louisiana, or any person or state or local agency, that owns or licenses computerized data including personal information; unlike the Louisiana Data Privacy Act, it carries no revenue, volume, or sale-percentage threshold.
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect personal information from unauthorized access, destruction, use, modification, or disclosure.
- Take all reasonable steps to destroy or arrange for the destruction of records containing personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable.
- Expect a violation of either duty to be enforceable as an unfair trade practice, by the Attorney General for injunctive relief and, because R.S. 51:3074(J)'s deeming clause carries no exclusion of R.S. 51:1409, by a private action from a harmed Louisiana resident for actual damages, trebled if the violation was knowing after Attorney General notice, plus attorney fees and costs.
- Do not conflate this pre-existing safeguards duty with the Louisiana Data Privacy Act's own controller security-of-processing duty at R.S. 51:1780.4(A)(1)(b), a separate, later-enacted comprehensive-regime clause documented under this jurisdiction's privacy topic rather than here.
Genetic information and privacy in the workplace: employer limits on collecting, using and disclosing employee genetic informationin force4 lines
La. R.S. 23:368 · Read the law's page
- If you are an employer, labor organization or employment agency, do not discharge, refuse to hire, limit, segregate, classify or otherwise discriminate against an employee because of protected genetic information, or information about a request for or the receipt of genetic services.
- Do not require, collect or purchase an employee's protected genetic information, or information about a request for or receipt of genetic services, except as the section's exceptions allow: an applicant with a conditional offer or an employee where the information is used exclusively to assess whether further medical evaluation is needed, therapeutic services the employer provides with the employee's prior knowing, voluntary and written authorization, or authorized genetic monitoring of toxic substances.
- Do not disclose an employee's protected genetic information except to the employee on request, to a qualifying health researcher, as a federal or state statute, legislative subpoena or court order requires (giving the individual notice to challenge a subpoena or order secured without their knowledge), or to executive branch officials investigating compliance.
- Keep protected genetic information out of general personnel files and treat it as confidential medical records kept separate from them.
Louisiana Data Privacy Act (Act No. 502), consumer rightsfrom , in 7 weeks4 lines
La. R.S. 51:1780.3 · Read the law's page
- Give a Louisiana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy, once the LDPA takes effect .
- Offer a Louisiana consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
- Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available, and respond to an appeal of a refusal within 60 days.
- Do not include a contract term waiving or limiting a Louisiana consumer's LDPA rights; such a term is void and unenforceable.