Law note · Alabama
Alabama Personal Data Protection Act (HB 351), sensitive data and biometric consent
Once in force, APDPA will require a controller to obtain an Alabama consumer's consent before processing sensitive data, defined to include racial or ethnic origin, religious belief, a mental or physical health diagnosis, sex life or sexual orientation, citizenship or immigration status, precise geolocation, a known child's personal data, and the processing of genetic or biometric data for the purpose of uniquely identifying an individual.
'Biometric data' means data generated by automatic measurements of biological characteristics, such as a fingerprint, voiceprint, retina, or iris, used to identify a specific individual, and the definition expressly excludes a digital or physical photograph and an audio or video recording, but claws that exclusion back for any data generated from a photograph or recording once that data is used to identify a specific individual.
What it asks of an app
- This duty does not yet bind. APDPA's effective date is May 1, 2027.
- Once effective, obtain an Alabama consumer's consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual, racial or ethnic origin, religious belief, a health diagnosis, sexual orientation, citizenship or immigration status, or precise geolocation.
- Do not treat a raw photograph, or an audio or video recording, as biometric data under this Act on its own. Data generated from a photograph or recording becomes biometric data once it is used to identify a specific individual; the exclusion does not survive that use.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: enrolled bill text, Alabama Legislative Information System (ALISON)