Another New Biometric Privacy Law as New York City Law Becomes Effective

Illinois, Texas and Washington have had biometric privacy laws for a number of years.  Now, increasing concerns regarding the collection of biometric information about consumers and employees, and a desire for greater transparency from business into the collection of consumer related information, have led a number of other states and local governments to consider regulating the use of biometrics. The most recent one is New York City, whose law becomes effective this month. 

Starting July 9, 2021, the New York City law “requiring businesses to notify customers of the use of biometric identifier technology and prohibiting the sale of biometric information” becomes effective.  Although originally introduced in late 2018, the bill went through several rounds of committee hearings and amendments before finally being adopted in January 2021.

Under the law, “biometric identifier information” is defined as “a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to:  (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.”  The law requires commercial establishments that collect, retain, convert, store or share such biometric identifier information to disclose this to their customers by placing a clear and conspicuous sign (using plain and simple language) near all of the commercial establishment’s customer entrances.  Commercial establishments that collect such biometric identifier information are prohibited from selling it to third parties.

While the law does not apply to financial institutions or to biometric identifier information that is “…collected through photographs or video recordings, if (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold or leased to third-parties other than law enforcement agencies”, it does apply to New York City food and drink establishments, retail stores, and places of entertainment.

The law allows for a private right of action for an individual against a commercial establishment.  Businesses that fail to cure within 30 days can be subject to fines of $500 - $5000, reasonable attorney’s fees and costs (including expert witness fees and other litigation expenses) and other relief as deemed appropriate by the court.

The Paul Hastings Data Privacy and Cybersecurity Solutions Group continues to monitor the ever-evolving biometric privacy law landscape.