Law note · Connecticut
Connecticut Data Privacy Act, sensitive data and biometric data definitions
CTDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, consumer health data, the processing of genetic or biometric data to uniquely identify an individual, a known child's data, victim-of-crime status, and precise geolocation data as sensitive data.
'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw photograph or recording is excluded, but data generated from it (a faceprint, a voiceprint) is brought back inside 'biometric data' the moment it is generated to identify a specific individual.
This clawback is the material finding for Connecticut: a voiceprint or faceprint manufactured from a public-facing recording for identification purposes is covered biometric and sensitive data here.
What it asks of an app
- Obtain a Connecticut consumer's opt-in consent before processing sensitive data, including biometric data generated to uniquely identify the individual.
- Treat a faceprint or voiceprint generated from a video, audio, or photographic recording, for the purpose of identifying a specific individual, as covered biometric and sensitive data. Connecticut's exclusion does not reach data generated for that purpose.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Connecticut statute text, Chapter 743jj, Connecticut General Statutes