On January 10, 2021, the New York City Council enacted a new biometric law requiring certain commercial establishments within New York City that collect “biometric identifier information” to prominently display signage that such information is being collected and prohibiting those establishments from selling or sharing the information with others. The law takes effect on July 9, 2021.
What Kinds Of Establishments Are Covered?
The law applies to places of entertainment (e.g., theaters, stadiums, racetracks, etc.), retail stores, and food and drink establishments (e.g., bars, restaurants, and food trucks or stands).
What Information Is Covered?
“Biometric identifier information” which is defined as a “physiological or biological characteristic…used by or on behalf of a commercial establishment…to identify, or assist in identifying, an individual.” The law gives a non-exhaustive list of examples of information that my fit within this definition assuming they are used to identify or assist in identifying an individual, including eye scans, fingerprints, voiceprints or scans of hand of face geometry.
Who Is Covered?
The law applies to anyone who has their biometric information collected within New York City, regardless of their place of residence. This would ostensibly include tourists.
What Does The New Law Require?
Notice and it prohibits the sale of biometric identifier information.
- Notice Requirement. Covered commercial establishments must place “clear and conspicuous” signage near all customer entrances informing customers in “plain, simple language” that the establishment is collecting, storing, converting, retaining and/or sharing biometric identifier information. The Commissioner of the Department of Consumer and Worker Protection is expected to issue a form for this notice through a separate rule.
- Prohibition of Sale. The law makes it unlawful to “sell, lease, trade [or] share in exchange for anything of value” biometric identifier information or otherwise profit from a transaction of such information.
How Can The Law Be Enforced?
The new law provides for a private right of action. For notice violations, there is a 30 day cure period after which a plaintiff may seek $500 in statutory damages per violation and may seek an award of attorneys’ fees, expert fees, and injunctive relief.
For sale violations, there is no cure period and plaintiffs may directly seek the recovery of $500 per negligent violation, plus attorneys’ fees, expert fees, and injunctive relief, and $5,000 per intentional or reckless violation.
Are There Exemptions?
Yes. Government institutes are exempt from the entirety of the law. Financial institutions (which is separately defined) are exempt from the notice provision but are still subject to the prohibition of sale provision. And biometric identifier information collected through photographs or video recordings are exempt from the notice requirement so long as they are not used to identify individuals based on physiological or biological characteristics and the images or video are not shared, sold or leased to third-parties other than to law enforcement agencies.
Key Takeaways
- Key Takeaway #1 – Know Your Data. Covered organizations that fall within the scope of this law should ensure they understand the scope of biometric data collected within the bounds of New York City, determine whether any such information may be exempt, develop appropriate notice, and build in safeguards to prohibit the sale or sharing of such information in alignment with the new law.
- Key Takeaway #2 – Think About Broader Compliance. The new New York City biometric law is just one of many biometric laws across the country organizations must consider in their compliance efforts. If your organization collects Illinois resident data within your establishment inside of New York City, for example, you may need to adopt a broader compliance regime that includes express consent.
- Key Takeaway #3 – Watch Broader New York. The New York City biometric law is part of a larger effort by New York to take a leading role in developing pro-consumer data privacy laws. The New York legislature is considering broader, statewide biometric and consumer data privacy laws. It’s therefore critically important to stay abreast of the changing laws in New York more broadly, as well as the rest of the nation.