Law / Statute European Union Active / In force May 25, 2018

EU General Data Protection Regulation (GDPR)

Regulation (EU) 2016/679

GDPR Art. 9 covers biometric data used for unique identification; requires lawful basis, DPIA, data-minimization, and erasure rights. Cited by Australian, UK, and Dutch students contesting ProctorU/Proctorio's handling of facial-scan data.
Source
European Parliament & Council
Link
https://gdpr-info.eu/ ↗

Related

Law / Statute

Indiana Consumer Data Protection Act

Indiana's omnibus privacy law covering biometric data.
Law / Statute

Tennessee Information Protection Act (TIPA)

Tennessee's consumer privacy law including biometric protections; applies to proctoring vendors meeting thresholds.
Law / Statute

New Jersey Data Privacy Act

New Jersey's omnibus privacy law including biometric protections.
Law / Statute

New Hampshire Privacy Act (HB 255)

New Hampshire's consumer privacy law covering biometric data.
Law / Statute

Delaware Personal Data Privacy Act

Delaware's consumer privacy statute including biometric data category.