Law / United States / 
New Hampshire
New Hampshire Data Privacy Act, sensitive data and biometric data definitions
RSA 507-H:1, IV, XXVIII; RSA 507-H:6
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain a New Hampshire consumer's opt-in consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual, racial or ethnic origin, religious belief, a health condition, sexual orientation, citizenship or immigration status, a known child's data, or precise geolocation.
- Treat a voiceprint or faceprint you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data. New Hampshire's exclusion for recording-derived data does not reach data generated for that purpose, even where the source recording was itself publicly available.
These lines are LexLint's reading of the law's text. Also read by: New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.doj.nh.gov/data-privacy-enforcement
- Guidance body
- New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau
- Open questions
- Does a controller that uses a face template or voiceprint to verify that a person is the account holder process biometric data 'for the purpose of uniquely identifying an individual' under RSA 507-H:1, XXVIII?
What it makes you log
Logging duty
RSA 507-H:1, IV and XXVIII define biometric and sensitive data, and RSA 507-H:6 limits collection, requires consent before processing sensitive data, requires reasonable data security practices and a privacy notice, and requires a revocation mechanism. A consent that must be obtained is a condition of processing and the section names no record of it, and a notice and security practices are policies. No cited provision requires a log or a record. The record-like clauses of the Act sit in RSA 507-H:4, III(d) (a documented belief that an opt-out request is fraudulent), RSA 507-H:7 and 507-H:10, VII (a processor's information to show compliance and a controller's burden for an exemption) and RSA 507-H:8 (documented data protection assessments produced to the Attorney General), and this row cites none of them. The scope clause in RSA 507-H:2 is not cited, so no territorial hook is taken.
- Kind
- None
- As of
What this law does
NHDPA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, a health condition, sexual orientation, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data requiring the consumer's opt-in consent.
"Biometric data" means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual; the definition excludes a photograph, or data from an audio or video recording, only until that data is generated to identify a specific individual, at which point the exclusion lifts and the data is biometric, and sensitive, data.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .