by Benjamin Stein

Not to be outdone by Portland’s facial-recognition ban, New York City recently enacted a biometrics ordinance of its own. That ordinance is scheduled to take effect on July 9, 2021, and will impact – among others – retailers, restaurants, and entertainment venues in the city that use security cameras with facial-recognition technology or otherwise collect biometric identifiers from their customers.

Definition/Scope: The ordinance applies to “biometric identifier information,” which it defines as any “physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.”

Signage Requirement: New York’s ordinance will require commercial establishments (i.e., “a place of entertainment, a retail store, or a food and drink establishment”) that collect, store, or share biometric information from customers to disclose that practice by posting a sign near all customer entrances. The sign must be in “plain, simple language” and a form to be prescribed by the City.

Prohibition on Sale: The ordinance also prohibits a commercial establishment from selling, leasing, sharing in exchange for anything of value, or otherwise profiting from the transaction of biometric identifier information. Note that, while the notice requirement is expressly limited to customer biometrics, the prohibition on sale is worded more broadly and seemingly could extend to employee biometric information.

Enforcement & Statutory Damages: The ordinance provides for a private right of action. (For violations of the customer-notice requirement, though, the customer has to provide the business with written notice of the deficiency and, if the business cures within 30 days, no action can be brought against it.) Plaintiffs can recover $500 per violation for uncured breaches of the notice requirement or any negligent violation of the prohibition on sale/sharing of biometric data, plus attorneys’ fees. For intentional or reckless violations of the sale/sharing prohibition, that jumps to $5,000 per violation.

Exemptions: The law exempts financial institutions, government agents, and “[b]iometric identifier information collected through photographs or video recordings, if: (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold or leased to third-parties other than law enforcement agencies” (which may be redundant, since “biometric identifier information” is defined expressly as information used to identify an individual).

Takeaway: If your company operates a retail store, restaurant, or entertainment venue in New York, now is the time to evaluate whether you are collecting any biometric identifiers, from whom, and what is being done with them.

Note also that, at the state level, New York has introduced legislation that would create a statewide biometric privacy law closely modeled after Illinois Biometric Information Privacy Act - complete with its own fearsome private right of action. That bill was introduced in January and referred to committee, where it remains as of this writing.

Originally published by InfoLawGroup LLP. If you would like to receive regular emails from us, in which we share updates and our take on current legal news please subscribe to InfoLawGroup’s Insights here.