Law / United States / 
Louisiana
Database Security Breach Notification Law, definitions
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Treat a biometric identifier used to authenticate access to a system or account as covered personal information under this statute; its biometric definition is narrower than, and should not be conflated with, the LDPA's own biometric data definition.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does 'unauthorized acquisition of and access to personal information' in R.S. 51:3073(2) require both acquisition and access, so that access without acquisition is not a 'breach of the security of the system'?
- Is the 'biometric data' element of 'personal information' in R.S. 51:3073(4)(a)(v) limited to data the owner or licensee itself uses to authenticate, so that a voiceprint collected for another purpose falls outside it?
- Is 'in combination with' in R.S. 51:3073(4)(a) met when a name and a data element sit in separate records that can be joined?
What it makes you log
Logging duty
The section defines agency, breach of the security of the system, person and personal information, and imposes no duty to keep a log or record. The five-year record of a no-harm determination sits in R.S. 51:3074(I), which this row does not cite. Personal information is limited to the information of an individual resident of this state.
- Kind
- None
- As of
What this law does
Louisiana's pre-existing Database Security Breach Notification Law (La. R.S. 51:3071 to 51:3077), first enacted 2005 (effective ) and last substantively amended 2018, is independent of the LDPA and already in force.
Personal information is an individual's name combined with a Social Security number, driver's license or state ID number, financial account or card number with an access code, passport number, or biometric data used to uniquely authenticate identity when accessing a system or account (a narrower, authentication-scoped biometric definition than the LDPA's, with no recording-derived exclusion or clawback of its own), and excludes publicly available government-record information. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .