New York City Biometrics Law Takes Effect in July 2021
This post has been updated — scroll to end to view.
Following the municipal ban on the use of facial recognition technology in Portland, Oregon, New York City's more expansive "biometric identifier information" law, set to go into effect July 9, 2021, will ban the sale of biometric data but permit the use of biometric identifying technologies with posted notice to customers in "simple language" to be prescribed by forthcoming rules.
Scope
Specifically, the law requires that a "commercial establishment" post "clear and conspicuous signs" at customer entrances notifying customers that technologies are in use that can identify (or assist in identifying) individuals by voice, eye (retina or iris), finger, hand, face, "or any other identifying characteristic." Even if the commercial establishment does not actively collect biometric data, notice must still be posted if it "retains, converts, stores or shares biometric identifier information of customers." A "customer" includes only a "purchaser or lessee, or a prospective purchaser or lessee, of goods or services;" a notice for collecting or using biometrics of employees is not required.
Although the use of biometric identifying technologies is permitted with the required notice, it will be unlawful to sell, lease, trade, or share biometric identifier information in exchange for anything of value or to "otherwise profit from the transaction of biometric information." Because the section of the law banning sale or exchange is not specifically in relation to "customers," it may be argued that commercial establishments' employees' biometric identifier information is subject to the ban on sale or exchange.
The new law will apply to any "commercial establishment" in the city, which is narrowly defined as a "place of entertainment, a retail store, or a food and drink establishment." "Place of entertainment" includes theaters, stadiums, museums, amusement parks, or places where concerts and exhibits or athletic games are held. "Retail stores" are places where consumer commodities or services are sold at retail. "Food and drink establishments" are places offering the public food or beverages for consumption on or off premises, including "pushcarts, stands, or vehicles."
Exemptions, Penalties, and Notice Requirements
Expressly excluded from all aspects of the new law are "government agencies, employees or agents." Financial institutions do not have to post notice of the use of the biometric recognition technologies but are subject to the ban on sale of biometric identifier information. Financial institutions include traditional banks, savings and loan associations, credit unions, and securities brokers and dealers but do not include those establishments whose primary business is the retail sales of goods or services, even if offering credit cards or in-store financing.
Perhaps more troubling for businesses in New York City is that the new law also provides a private right of action to "aggrieved" individuals to recover statutory damages of $500 per violation for a commercial establishment's failure to post conspicuous notices, $500 for each negligent violation of the ban on the sale or sharing of biometric data, and $5,000 for each intentional or reckless violation of the ban on selling or sharing biometric identifier information.
Individuals may also recover attorneys' fees and costs or expenses, and a court may order injunctive relief. If the complaint relates to the failure to post notice, the "aggrieved person" must first provide written notice to the business, which then has 30 days to cure the violation and thus prevent any action from being initiated. No prior notice (or opportunity to cure) is required to bring an action for alleged violations of the ban on sale or exchange of biometric information.
Notably, the new law will not require commercial establishments to post notice where biometric data is collected through "photographs or video recordings," as long as no software or applications are used to analyze the images and videos to identify individuals based on "physiological or biological characteristics," and the "images or video" are not shared, sold, or leased to anyone other than law enforcement.
We will provide updates as we learn about the form of notice that New York's Commissioner of Consumer and Worker Protection prescribes by rule. A statewide law regulating the collection and use of biometrics has been pending before the New York Assembly's Consumer Affairs Protection Committee since January. Federal biometric privacy law has been proposed but not enacted. The FTC, however, has pursued those using facial recognition technologies and other AI-enabled applications where notice and consent have not been properly given or obtained.
Update July 2021: New York's Commissioner of Consumer and Worker Protection has prescribed the form of “Biometric Identifier Information Disclosure.” Signs must be posted at customer entrances: Biometric Identifier Information Disclosure Sign (nyc.gov).