Law / United States / 
Louisiana
Louisiana Data Privacy Act (Act No. 502), deidentified and pseudonymous data
La. R.S. 51:1780.1(12), 1780.4(F), (O)
A de-identification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To treat data as deidentified under the LDPA, take reasonable measures to ensure that it cannot be associated with an individual (La. R.S. 51:1780.4(F)(1)(a)).
- Publicly commit to maintaining and using deidentified data without attempting to reidentify it (La. R.S. 51:1780.4(F)(1)(b)).
- Contractually obligate every recipient of deidentified data to comply with the LDPA (La. R.S. 51:1780.4(F)(1)(c)).
- If you disclose pseudonymous or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments it is subject to, and take appropriate steps to address any breach of them (La. R.S. 51:1780.4(O)(2)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 1780.4(F) and (O)(2) state the conditions for holding or disclosing deidentified data and a duty to oversee recipients' compliance. Neither states a log or record duty.
- Kind
- None
- As of
What this law does
The Louisiana Data Privacy Act defines deidentified data as data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual or a device linked to that individual, where the controller or processor that possesses it meets the listed conditions (section 1780.1(12)).
Under section 1780.4(F)(1), a controller in possession of deidentified data must take reasonable measures to ensure that the data cannot be associated with an individual, publicly commit to maintaining and using it without attempting to reidentify it, and contractually obligate any recipient to comply with the Chapter.
Under section 1780.4(O)(2), a controller that discloses pseudonymous or deidentified data must exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to and take appropriate steps to address any breach of them.
Section 1780.4(O)(1) excludes pseudonymous data from the consumer rights in section 1780.3(A)(2)(a) through (e) and from the controller duties in section 1780.4, where the controller can demonstrate that the information needed to identify the consumer is kept separately and subject to effective technical and organizational controls. The Act takes effect .
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .