Share
Effective July 9, 2021, the City of New York’s Biometric Identifier Law went into effect. The law (i) prohibits the sale or exchange “for anything of value” of “biometric identifier information”, and (ii) requires “commercial establishments” that collect or store biometric identifier information to provide a “clear and conspicuous” notice of the collection at the establishment’s entrance to notify customers “in plain, simple language” of the collection.
Prohibitions. The law states:
a. Any commercial establishment that collects, retains, converts, stores or shares biometric identifier information of customers must disclose such … by placing a clear and conspicuous sign near all of the commercial establishment’s customer entrances notifying customers in plain, simple language, in a form and manner prescribed by the commissioner of consumer and worker protection by rule, that customers’ biometric identifier information is being collected, retained, converted, stored or shared, as applicable.
b. It shall be unlawful to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information.
The law defines “biometric identifier information” as “a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.” It defines a “commercial establishment” as “a place of entertainment, a retail store, or a food and drink establishment,” each its own defined term as follows:
- Place of entertainment – “any privately or publicly owned and operated entertainment facility, such as a theater, stadium, arena, racetrack, museum, amusement park, observatory, or other place where attractions, performances, concerts, exhibits, athletic games or contests are held”;
- Retail store – “an establishment wherein consumer commodities are sold, displayed or offered for sale, or where services are provided to consumers at retail”; and
- Food and drink establishment – “an establishment that gives or offers for sale food or beverages to the public for consumption or use on or off the premises, or on or off a pushcart, stand or vehicle.”
As stated in the law, the NYC Commissioner of Consumer and Worker Protection will issue further guidance detailing the law’s exact requirements.
Private Right of Action. The law provides a private right of action with a cure provision for the signage requirement only, stating that:
- Any person may commence an action “on his or her own behalf against an offending party”’
- That at least 30 days prior to initiating any such action, the claimant must provide written notice to the commercial establishments of the alleged violations, and
- If, within those 30 days, the commercial establishment cures the violations and provides “an express written statement that the violation has been cured and that no further violations shall occur,” the claimant may not initiate the action.
- No prior written notice is required for actions alleging the unlawful sale of biometric identifier information.
A prevailing party may recover damages in the amount of $500 per violation for an establishment’s failure to post a conspicuous notice, $500 for each negligent violation of the ban on the sale or sharing of biometric data, and $5,000 for each intentional or reckless violation of the ban on selling or sharing biometric identifier information.
Exemptions. The law applies only to “commercial establishments,” as defined, and their customers. Thus, the law does not apply to government agencies or employees, and agents. Financial institutions also are exempted for the law.
Finally, the law does not apply to “biometric identifier information collected through photographs or video recordings, if: (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold or leased to third-parties other than law enforcement agencies.” Thus, traditional CCTV security cameras appear to be exempt from the signage requirement, provided that commercial enterprises do not use software to analyze the photos or videos collected, and do not disseminate the images or videos to third parties other than law enforcement.
Final observation. Although the NYC Commissioner of Consumer and Worker Protection will issue guidance, and the city’s “chief privacy officer shall conduct or facilitate … outreach and education efforts” on city websites and “other means” to educate commercial establishments, it is best that companies address the law’s requirements today.
(1) If you collect biometric identifier information, post a sign. (2) If you sell or exchange “for any value” biometric identifier information, stop. (3) If you have questions, contact a privacy attorney.
A more comprehensive biometric privacy bill remains pending in the New York State legislature.
Insurance and reinsurance
United States