Law note · Virginia
Virginia Consumer Data Protection Act, sensitive data and biometric data definitions
VCDPA classifies the processing of genetic or biometric data to uniquely identify a person, along with racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexual orientation, citizenship or immigration status, precise geolocation, and a known child's data, as sensitive data requiring prior opt-in consent.
'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, such as a fingerprint, voiceprint, or eye retina or iris pattern, but the definition carries a blanket, unconditional exclusion for a photograph, video or audio recording, or data generated from either, with no clawback for data generated to identify someone.
A faceprint or voiceprint extracted from a recording for identification purposes therefore falls outside both biometric data and sensitive data under this Act.
What it asks of an app
- Obtain a Virginia consumer's opt-in consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual.
- Do not treat an identifier derived solely from a photograph, video, or audio recording as VCDPA biometric data requiring this consent. The definition excludes any data generated from such a recording, with no exception for data generated to identify someone.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Virginia statute text, Title 59.1 Chapter 53, Code of Virginia