Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Louisiana: House bill for Consumer Privacy Act introduced to Legislature

On April 2, 2024, House Bill 947 for the Louisiana Consumer Privacy Act was introduced in the Louisiana State Legislature and the title of the bill was read on the same date. In particular, the bill is pending House referral. The bill, among other things, would provide for consumer rights and controller and processor responsibilities with regard to data privacy.

What is the scope of the bill?

The bill would apply to a controller or processor who conducts business in Louisiana or produces a product or service that is targeted to consumers who are residents of Louisiana who satisfy both of the following:

  • has an annual revenue of $25 million or more; and
  • satisfies any of the following criteria:
    • during a calendar year, controls or processes the personal data of at least 100,000 consumers; or
    • derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes the personal data of 25,000 or more consumers.

Notably, the bill states that it would not apply to a 'covered entity,' a non-profit organization or governmental entity, or a third party under contract with a governmental entity when the third party is acting on its behalf.

What are the key provisions of the bill?

More specifically, the bill defines key terms such as 'biometric data,' 'consumer,' 'child,' 'controller,' 'covered entity,' 'personal data,' and 'sensitive data'. Moreover, the bill would grant consumers rights including the right to opt out of the processing of personal data for the purposes of either targeted advertising or the sale of personal data.

The bill lays down various controller and processor obligations, including:

  • a timeline for responding to consumer rights requests;
  • having a contract in place between the controller and processor;
  • the requirement for a controller to provide a privacy notice; and
  • conducting a data protection assessment for processing activities that present a heightened risk of harm to a consumer.

If enacted, the bill would come into force on December 31, 2024.

You can read the bill here and track its progress here.

Update: April 5, 2024

Bill referred to House Committee on Commerce

On April 3, 2024, the bill was referred to the House Committee on Commerce.

You can read the bill here and track its progress here.

Feedback