12 Jul New York City Passes Biometric Law
Written by: Brett Lawrence, Esq. and Alyssa J. Feliciano, Esq.
On July 9, 2021, New York City’s biometric data law (the “Law”) became enforceable. The Law requires specific businesses to notify customers when their biometric data is being collected or shared. The Law further prohibits the selling of biometric data.
Biometric Data Defined
The Law defines biometric data as “a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual.”
The Law provides three non-exhaustive examples of biometric data:
- Retina or iris scan;
- Fingerprint or voiceprint;
- Scan of hand or face geometry.
The Law covers any “commercial establishment” within New York City, which consist of:
- Places of entertainment: Any privately or publicly owned and operated entertainment facility (attractions, concerts, exhibits, athletic games, etc.);
- Retail stores;
- Food and drink establishments.
Commercial establishments must notify customers via clear and conspicuous signs near all their customer entrances in simple and plain language.
Government agencies, employees or agents are completely exempt from the Law.
Financial institutions do not need to comply with the notification requirements.
Commercial establishments will not need to notify customers about video surveillance or images taken as long as the following criteria are met:
- The images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics; and
- The images or video are not transferred to third-parties other than law enforcement agencies.
Private Right of Action
An individual may bring suit for wrongful collection and/or sharing of biometric data. The individual must first notify the commercial establishment about the violation. If the commercial establishment fails to cure the violation within 30 days, the individual may file suit.
An individual may bring suit immediately, without a 30-day notice period, if the commercial establishment sells their biometric data.