Law / United States / 
Oklahoma
Oklahoma Consumer Data Privacy Act, sensitive data categories and biometric data definition
Okla. Stat. tit. 75A, Sec. 300(3), (29)
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain an Oklahoma consumer's opt-in consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual.
- Treat a faceprint or voiceprint generated from a photograph, video, or audio recording, for the purpose of identifying a specific individual, as covered biometric and sensitive data. This Act's exclusion does not reach data generated for that purpose.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does genetic or biometric data fall within "sensitive data" under Okla. Stat. tit. 75A, ยง 300(29) only when the controller's own purpose in processing it is to uniquely identify an individual, or whenever the data is capable of doing so?
What it makes you log
Logging duty
The row cites two definitions of the Oklahoma Consumer Data Privacy Act, biometric data in Sec. 300(3) and sensitive data in Sec. 300(29). Neither paragraph imposes a duty to keep a log or record, names an audit, or gives any party a right to a record. Neither carries a territorial clause: the reach to a resident consumer sits in the definition of consumer in Sec. 300(8) and the applicability test in Sec. 314(A), which this row does not cite. The documented data protection assessment of sensitive-data processing sits in Sec. 309(A), and its availability to the Attorney General in Sec. 309(C), both outside this row.
- Kind
- None
- As of
What this law does
SB 546 Sec. 1 defines sensitive data as a category of personal data that includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data that is processed for the purpose of uniquely identifying an individual; personal data collected from a known child; and precise geolocation data.
The consumer's prior opt-in consent is required before a controller may process sensitive data.
Biometric data means data from automatic measurement of an individual's biological characteristics, such as a fingerprint, voiceprint, or eye retina or iris, or other unique biological pattern or characteristic, used to identify a specific individual; the definition excludes a physical or digital photograph, a video or audio recording, or data generated from either, unless that data is generated to identify a specific individual, at which point it falls back inside the definition.
A faceprint or voiceprint deliberately extracted from a public photograph or recording for identification purposes is therefore biometric data, and sensitive data, under this Act, the same clawback structure as Kentucky's and New Hampshire's comprehensive acts.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .