Law / United States / 
Connecticut
Connecticut Data Privacy Act, sensitive data and biometric data definitions
Conn. Gen. Stat. § 42-515(4), (38)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain a Connecticut consumer's opt-in consent before processing sensitive data, including biometric data generated to uniquely identify the individual.
- Treat a faceprint or voiceprint generated from a video, audio, or photographic recording, for the purpose of identifying a specific individual, as covered biometric and sensitive data. Connecticut's exclusion does not reach data generated for that purpose.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Connecticut (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act
- Guidance body
- Office of the Attorney General of Connecticut
- Open questions
- Is a faceprint or voiceprint that a controller generates from a photograph or recording in order to match or group records, without naming the person, data 'generated to identify a specific individual' within Conn. Gen. Stat. § 42-515(4)?
What it makes you log
Logging duty
The row cites the definitions of sensitive data and biometric data in section 42-515(4) and (38). A definition carries no log, record or documentation duty. The documented assessment that sensitive-data processing triggers is in section 42-522(a), which this row does not cite. The definitions state no territorial clause, so the hook is left empty; the Act's reach is in section 42-516, also uncited here.
- Kind
- None
- As of
What this law does
CTDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, consumer health data, the processing of genetic or biometric data to uniquely identify an individual, a known child's data, victim-of-crime status, and precise geolocation data as sensitive data.
'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw photograph or recording is excluded, but data generated from it (a faceprint, a voiceprint) is brought back inside 'biometric data' the moment it is generated to identify a specific individual.
This clawback is the material finding for Connecticut: a voiceprint or faceprint manufactured from a public-facing recording for identification purposes is covered biometric and sensitive data here.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .