Law / United States / 
Delaware
Delaware Personal Data Privacy Act, sensitive data and biometric data definitions
Del. Code Ann. tit. 6, § 12D-102(3), (30)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Treat genetic or biometric data as sensitive data requiring heightened handling under DPDPA.
- Treat a voiceprint or other biometric identifier generated from a recording, for the purpose of identifying a specific individual, as covered biometric data. Delaware's exclusion does not reach data generated for that purpose.
- From , treat as sensitive data any inference made from personal data, alone or in combination with other data, that is used to reveal or identify a listed category, and also neural data generated by measuring the activity of an individual's central nervous system, a financial account number or log-in credential or a card number that would allow access to a financial account, and a government-issued identification number that applicable law does not require to be publicly displayed (section 12D-102(33)).
- From , do not process sensitive data unless the consumer consents and the processing is reasonably necessary and proportionate to the disclosed purposes for processing it (section 12D-106(a)(4)).
- From , do not disclose sensitive data in a sale of personal data unless the disclosure is strictly necessary to provide or maintain a product or service the consumer affirmatively requested, you give clear and conspicuous notice before the sale naming the categories of sensitive data, the purpose and the third parties, you obtain the consumer's consent, and you keep a record of the consent for 5 years (section 12D-106(a)(12)).
These lines are LexLint's reading of the law's text. Also read by: Delaware Department of Justice, Fraud and Consumer Protection Division (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://attorneygeneral.delaware.gov/fraud/personal-data-privacy-portal/frequently-asked-questions/
- Guidance body
- Delaware Department of Justice, Fraud and Consumer Protection Division
- Open questions
- Is only genetic or biometric data 'used to uniquely identify an individual' sensitive data, as the Department of Justice's FAQs state, or does the Section 12D-102 definition of 'sensitive data', which lists 'Genetic or biometric data' without that qualifier, reach all genetic and biometric data?
What it makes you log
Logging duty
Sections 12D-102(3) and (30) define biometric data and sensitive data and impose no duty, so no record, log or audit follows from the cited text. The duties that do carry a record sit in sections the row does not cite: the documented data protection assessment (section 12D-108, produced to the Attorney General on request) and the 5-year record of consent to a sale of sensitive data (section 12D-106(a)(12)d., from ) are coded on the general row. The definitions state no territorial reach.
- Kind
- None
- As of
What this law does
DPDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis (including pregnancy), sex life, sexual orientation, transgender or nonbinary status, citizenship or immigration status, genetic or biometric data, a known child's data, and precise geolocation data as sensitive data.
'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw recording is excluded, but data generated from it is covered once generated to identify a specific individual, matching the Connecticut, Oregon, Montana, and Nebraska structure.
From , the definition of sensitive data, renumbered as section 12D-102(33), also includes inferences made based on personal data, alone or in combination with other data, that are used to reveal or identify any listed category. From , the first category reaches data that reveals or identifies racial, national or ethnic origin, and a mental or physical health condition, diagnosis, treatment or status, and treatment or status as transgender or nonbinary.
From , the definition adds neural data that is generated by measuring the activity of an individual's central nervous system.
From , the definition also adds a consumer's financial account number, financial account log-in information, or credit card or debit card number that would allow access to a financial account, and a government-issued identification number, including a Social Security number, passport number, state identification card number or driver's license number, that applicable law does not require to be publicly displayed.
From , the definition of biometric data is renumbered as section 12D-102(4). From , section 12D-106(a)(4) bars a controller from processing sensitive data unless the consumer consents and the processing is reasonably necessary and proportionate to the disclosed purposes for processing it.
From , section 12D-106(a)(12) bars a controller from disclosing sensitive data in a sale of personal data unless the disclosure is strictly necessary to provide or maintain a product or service the consumer affirmatively requested, the controller gives clear and conspicuous notice before the sale, obtains the consumer's consent and keeps a record of the consent for 5 years.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .