Law / United States / 
Virginia
Virginia Consumer Data Protection Act, sensitive data and biometric data definitions
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- Yes
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Obtain a Virginia consumer's opt-in consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual.
- Do not treat an identifier derived solely from a photograph, video, or audio recording as VCDPA biometric data requiring this consent. The definition excludes any data generated from such a recording, with no exception for data generated to identify someone.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Virginia (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf
- Guidance body
- Office of the Attorney General of Virginia
- Open questions
- Is a voiceprint or faceprint extracted from a recording to identify a specific person 'data generated therefrom' that Va. Code § 59.1-575 excludes from 'biometric data', although the definition also covers biological characteristics used 'to identify a specific individual'?
What it makes you log
Logging duty
Section 59.1-575 defines terms, among them sensitive data, biometric data, consumer, personal data and data protection assessment, and creates no duty of its own, so it requires no log or record. The data protection assessment duty that the Act documents and produces to the Attorney General is in section 59.1-580, which this row does not cite. The only reach in the definitions is that a consumer is a resident of the Commonwealth.
- Kind
- None
- As of
What this law does
VCDPA classifies the processing of genetic or biometric data to uniquely identify a person, along with racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexual orientation, citizenship or immigration status, precise geolocation, and a known child's data, as sensitive data requiring prior opt-in consent.
'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, such as a fingerprint, voiceprint, or eye retina or iris pattern, but the definition carries a blanket, unconditional exclusion for a photograph, video or audio recording, or data generated from either, with no clawback for data generated to identify someone.
A faceprint or voiceprint extracted from a recording for identification purposes therefore falls outside both biometric data and sensitive data under this Act.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .