New York City’s Biometrics Privacy Law Goes into Effect

Data Privacy is becoming increasingly more difficult to keep tabs on.  It can be regulated federally (i.e. Brazil). It can be regulated by a political and economic union (i.e. the European Union).  It can be regulated by states (i.e. California).  It can also be regulated by cities (i.e. New York City.)

New York City’s biometric privacy act was enacted by the City Council in December of 2020.  New York City mayor Bill de Blasio returned it unsigned on January 10, 2021, which triggered a 180 day countdown to the law going into effect.   It went into effect on July 9, 2021.

The law regulates ‘Biometric Identifier Information’, which is defined as ‘a physiological or biological characteristic that is used by or on behalf of a commercial establishment … to … assist in identifying, an individual … [such as] … (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.‘

The non-intuitive aspect of the definition is that if the relevant physiological or biological characteristic is used by or on behalf of an entity other than a commercial establishment, then it is not ‘Biometric Identifier Information.’

This begs the question, what is a commercial establishment?  A ‘Commercial Establishment’ is defined as ‘a place of entertainment, a retail store, or a food and drink establishment.’ Each of the three elements of a commercial establishment are also defined phrases in the biometric privacy law.

Places of Entertainment are ‘any privately or publicly owned and operated entertainment facility, such as a theater, stadium, arena, racetrack, museum, amusement park, observatory, or other place where attractions, performances, concerts, exhibits, athletic games, or contests are held.’ Retail Stores are any ‘establishment wherein consumer commodities are sold, displayed or offered for sale, or where services are provided to consumers at retail.’ Food and Drink Establishments are any ‘establishment that gives or offers for sale food or beverages to the public for consumption or use on or off the premises, or on or off a pushcart, stand or vehicle.’

These commercial establishments are required to disclose any collection, retention, conversion, storing, or sharing of Biometric Identifier Information of their customers, by placing a clear and conspicuous sign near all of the entrances, notifying customers in plain and simple language of such activities.  Further guidance on the form and manner of the notice is available from the commissioner of consumer and worker protection.

Commercial establishments are also prohibited from selling, leasing, trading, sharing for value, or otherwise profiting from transactions with Biometric Identifier Information.

This law does allow for a private right of action.  Any person whose rights under this law are violated may commence an action on his or her own behalf.  When the commercial establishment is in someway profiting from transacting with Biometric Identifier Information, suit can be brought immediately. However, for other violations, the suing party must provide a written notice to the commercial establishment and provide the establishment 30 days to cure the violation.

Each violation or negligent violation provides statutory damages of $500.  Intentional or reckless violations of the prohibition against profiting from transacting with Biometric Identifier Information provide statutory damages of $5,000.

The takeaway: If your business fits the description of a Commercial Establishment, don’t collect, retain, convert, store, or share Biometric Identifier Information of customers without placing a clear, conspicuous, plain language notice that you do so near all of the customer entrances.  Also, under no circumstances should your Commercial Establishment sell, lease, trade, share in exchange for anything of value, or otherwise profit from the transaction of Biometric Identifier Information.

Take a tour of Clarip’s patented data privacy technology and learn how Clarip can help your enterprise comply with emerging state level data subject rights regulations. Call Clarip today at 1-888-252-5653 or schedule a Demo Online!