Law / United States / 
Louisiana
Louisiana Data Privacy Act (Act No. 502), sensitive and biometric data
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Treat an identifier deliberately extracted from a photograph, video, or audio recording to identify a specific Louisiana resident as biometric and sensitive data under the LDPA, notwithstanding the recording's own public or non-public origin.
- Obtain a Louisiana consumer's consent before selling sensitive data, if you meet the LDPA's revenue-from-sale applicability threshold.
- Treat genetic data, health diagnosis information, racial or ethnic origin, religious belief, sexuality, immigration status, a known child's data, and precise geolocation as sensitive data requiring heightened handling.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does 'unless such data is generated to identify a specific individual' in R.S. 51:1780.1(3) reach a faceprint or voiceprint extracted from a recording to train a model rather than to identify a person?
- Does location data inferred from an IP address 'directly identif[y] the specific location of an individual' within the 1,750-foot radius in R.S. 51:1780.1(21)?
- Does 'personal data revealing' sexuality in R.S. 51:1780.1(29)(a) reach sexuality that a controller infers from browsing or purchase history, or only what the consumer states?
What it makes you log
Logging duty
The row cites two definitions, biometric data in 51:1780.1(3) and sensitive data in 51:1780.1(29), and they impose no duty to keep a log or record and no audit. The data protection assessment of sensitive data processing sits in R.S. 51:1780.4(E), which this row does not cite. The reach of the whole Act is coded: it applies to a person that does business in the state, and its consumer is a resident.
- Kind
- None
- As of
What this law does
Sensitive data under the LDPA includes personal data revealing racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexuality, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; a known child's personal data; and precise geolocation data.
Biometric data means data generated by automatic measurement of an individual's biological characteristics used to identify a specific individual, such as a fingerprint, voiceprint, or eye retina or iris scan.
The definition excludes a physical or digital photograph, or data generated from a photograph, video, or audio recording, but claws that exclusion back whenever the data is generated to identify a specific individual, so a voiceprint or faceprint deliberately extracted from a recording for identification purposes remains biometric and sensitive data regardless of the recording's own origin or public status.
A person selling sensitive data under the Act's revenue-from-sale applicability threshold must first obtain the consumer's consent.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .