Law / United States / 
Indiana
Indiana Consumer Data Protection Act, sensitive data and biometric data definitions
Ind. Code §§ 24-15-2-4, 24-15-2-28, 24-15-4-1(5)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- Yes
- Audit expectation
- none
What it requires
- Obtain an Indiana consumer's consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual, or process a known child's sensitive data only under COPPA's consent framework.
- Do not treat an identifier derived solely from a photograph, video, or audio recording as INCDPA biometric data. The definition excludes any data generated from such a recording, with no exception for data generated to identify someone.
- Treat a voiceprint or faceprint captured directly, for example from a live biometric scanner, as sensitive data requiring consent, and treat one extracted from a recording as ordinary personal data instead.
These lines are LexLint's reading of the law's text. Also read by: Office of the Indiana Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.in.gov/attorneygeneral/files/Consumer_Data-Bill-of-Rights.pdf
- Guidance body
- Office of the Indiana Attorney General
- Open questions
- Is a voiceprint that a controller generates from a live audio stream in real time, without first storing a recording, 'data generated from a video or audio recording' excluded from 'biometric data' by Ind. Code § 24-15-2-4(b)(2), or is it generated by 'automatic measurements of an individual's biological characteristics' under subsection (a)(1)?
What it makes you log
Logging duty
Sections 24-15-2-4 and 24-15-2-28 define biometric data and sensitive data, and 24-15-4-1(5) bars processing sensitive data without the consumer's consent. A consent required before processing is a condition of processing; the provisions require no log or record of the consent or of the processing, set no retention period and give no regulator a right to a record. The assessment duty for sensitive data is in IC 24-15-6-1(b)(4), which this row does not cite. The cited sections state no territorial hook.
- Kind
- None
- As of
What this law does
INCDPA classifies racial or ethnic origin, religious belief, a health diagnosis made by a health care provider, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify a specific individual, a known child's data, and precise geolocation data as sensitive data requiring the consumer's consent before processing, except that a known child's sensitive data may instead be processed under COPPA's consent framework.
'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, such as a fingerprint, voiceprint, or retina or iris image, but the definition carries a blanket, unconditional exclusion for a physical or digital photograph, a video or audio recording, or any data generated from either, with no clawback for data generated to identify someone.
A faceprint or voiceprint extracted from a recording therefore falls outside both biometric data and sensitive data under Indiana law, regardless of the purpose for which it was extracted; only a biometric identifier captured directly, such as from a live scanner, triggers this consent duty.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .