Law / United States / 
Nebraska
Nebraska Data Privacy Act, sensitive data and biometric data definitions
Neb. Rev. Stat. § 87-1102(3), (30)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Treat genetic or biometric data processed to uniquely identify a Nebraska consumer as sensitive data requiring heightened handling under NDPA.
- Treat a voice print or other biometric identifier generated from a recording, for the purpose of identifying a specific individual, as covered biometric data. Nebraska's exclusion does not reach data generated for that purpose.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Is a faceprint or voiceprint that a controller generates from a photograph or recording in order to match or group records, without naming the person, data 'generated to identify a specific individual' within Neb. Rev. Stat. § 87-1102(3)(b)(i)?
What it makes you log
Logging duty
The cited subdivisions define biometric data and sensitive data. A definition imposes no duty, and the row's sections state no log, record or audit. The records the Act does require, the documented data protection assessment (87-1116) and the processor's information to demonstrate compliance (87-1115), sit in sections the row does not cite. The Act applies to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents (87-1103(1)(a)), and a consumer is defined as a Nebraska resident (87-1102(7)); both prongs of the applicability clause are coded as hooks and the residence definition is named here.
- Kind
- None
- As of
What this law does
NDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, a known child's data, and precise geolocation data as sensitive data.
'Biometric data' means data generated to identify a specific individual through automatic measurement of a biological characteristic, including a fingerprint, voice print, retina image, or iris image, and is structured slightly differently in wording from the Connecticut, Oregon, Montana, and Delaware definitions (opening with the identification purpose rather than excluding then clawing back), but reaches the same operative result: a raw recording is excluded, except when generated to identify a specific individual.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .