Law / United States / 
Montana
Montana Consumer Data Privacy Act, sensitive data and biometric data definitions
Mont. Code Ann. § 30-14-2802(4), (28)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain opt-in consent before processing a Montana consumer's genetic or biometric data collected to uniquely identify them.
- Treat a voiceprint or other biometric identifier generated from a recording, for the purpose of identifying a specific individual, as covered biometric data. Montana's exclusion does not reach data generated for that purpose.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a voiceprint or face template that a controller generates from an audio recording or photograph fall outside "biometric data" under section 30-14-2802(4)(b)(iii) when the controller generates it to tell one person's recording from another's, without identifying a specific individual?
What it makes you log
Logging duty
Sections 2802(4) and (28) define biometric data and sensitive data. A definition imposes no record, log or audit duty and sets no retention period. The act's reach test is in section 2803(1), which this row does not cite, so the row names no territorial hook.
- Kind
- None
- As of
What this law does
MCDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, the processing of genetic or biometric data to uniquely identify an individual, a known child's data, and precise geolocation data as sensitive data.
'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw recording is excluded, but data generated from it is covered once generated to identify a specific individual, matching the Connecticut, Oregon, Delaware, and Nebraska structure.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .