New York City Passes Biometric Law

Written by: Brett Lawrence, Esq. and Alyssa J. Feliciano, Esq.

On July 9, 2021, New York City’s biometric data law (the “Law”) became enforceable. The Law requires specific businesses to notify customers when their biometric data is being collected or shared. The Law further prohibits the selling of biometric data.

Biometric Data Defined

The Law defines biometric data as “a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual.”

The Law provides three non-exhaustive examples of biometric data:

1. 1. Retina or iris scan;
   2. Fingerprint or voiceprint;
   3. Scan of hand or face geometry.

Businesses Impacted

The Law covers any “commercial establishment” within New York City, which consist of:

1. 1. Places of entertainment: Any privately or publicly owned and operated entertainment facility (attractions, concerts, exhibits, athletic games, etc.);
   2. Retail stores;
   3. Food and drink establishments.

Notification Requirement

Commercial establishments must notify customers via clear and conspicuous signs near all their customer entrances in simple and plain language.

Exempted Businesses

Government agencies, employees or agents are completely exempt from the Law.

Financial institutions do not need to comply with the notification requirements.

Commercial establishments will not need to notify customers about video surveillance or images taken as long as the following criteria are met:

1. 1. The images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics; and
   2. The images or video are not transferred to third-parties other than law enforcement agencies.

Private Right of Action

An individual may bring suit for wrongful collection and/or sharing of biometric data. The individual must first notify the commercial establishment about the violation. If the commercial establishment fails to cure the violation within 30 days, the individual may file suit.

An individual may bring suit immediately, without a 30-day notice period, if the commercial establishment sells their biometric data.