New Biometric Privacy Laws Going into Effect July 9, 2021
Enacted by the New York City Counsel in January of 2021, the timing of the implementation of these new biometric laws going into effect as of July 9, 2021 coincide nearly perfectly with the full reopening of the City on July 1, 2021. As millions of now vaccinated and maskless individuals are set to return to the city’s unrestricted bars, restaurants, theaters, and other commercial and recreational establishments, technologies used by these venues are now under new scrutiny and regulation.
Known formally as 2021 NYC Local Law No. 3, NYC Admin. Code §§22-1201 – 22-1205, NYC’s new “Biometric Identified Information” law (“BII Law”) requires commercial establishments that collect “biometric identifier information” to display signs that such information is being collected. The BII Law further restricts commercial establishments from sharing or selling such biometric identifier information with third parties. Biometric identifiers include fingerprints, retina scans, hand print scans, facial recognition, voice identification, or any other physical or biological trait that would serve to identify an individual.
The BII Law has two main requirements: i) a notice requirement; and ii) a restriction on the sale of collected biometric identifier information.
Notice Requirement
The notice requirement applies to all “commercial establishments”, which is defined to include retail stores and locations, food and beverage establishments (including not just restaurants and bars, but also food trucks and stands) and entertainment venues (including concert halls, theaters, museums, stadiums, arenas and amusement parks). While the list is non-exhaustive, it is worthy to note that financial institutions and government facilities, agencies, employees and agents are expressly exempted from the law. However, even though financial institutions are exempt from the signage requirement, they are still subject to the restrictions on sale of such biometric identifier information.
If an establishment is subject to the law, and collects biometric identifier information, then the establishment must place “clear and conspicuous” signage near any and all entrances used by customers. The signage must inform the customers in, “plain, simple language” that the establishment collects, stores, retains, shares and/or otherwise uses the biometric identifier information. It is left to the Commissioner of the Department of Consumer and Worker Protection to provide additional information on the type and form of the notices, which will be done via a separate rule.
If an establishment fails to utilize such signage, the BII Law allows individuals to provide notice to the establishment, identifying the alleged violation. The BII law does give a 30-day cure period to the establishment to correct the deficiencies prior to any action being able to be commenced. If cured within the 30-day period, then no further violation shall occur and no action can be initiated. If not cured, the BII Law provides for penalties of $500 per violation, as well as recovery by the plaintiff(s) of attorney’s fees, costs and expert witness fees.
There is a notable exception for biometric identifier information that is collected via photographs or video recordings (such as CCTV), so long as no software or other image analysis processing means are used on the images or video to identify individuals based on such biometric identifier information and the images and videos are not sold, shared or leased to anyone other than law enforcement organizations or officials.
Restriction on Sale of Biometric Identifier Information
Aside from the notice requirement, the BII Law also makes it unlawful to “sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information.” A private right of action exists for individuals claiming violations of this restriction, however, unlike the signage requirement, there is no pre-suit notification requirement, meaning that establishments are not given the right to cure these violations.
Further, violations of the restriction on sale of biometric identifier information range from $500 for negligent violations, to $5,000 for intentional or reckless violations, plus the ability in each case to recover attorney’s fees, costs and expert witness fees. As noted above, there is also no carve-outs for financial institutions, meaning that those establishments are also likely subject to the same sale restrictions as other commercial establishments under the BII Law.
Ambiguities
There exist several ambiguities in the BII Law as it currently stands. For instance, it is unclear as to whether the restriction on sale, lease, trade or profit from biometric identifier information is limited to only consumers, or whether it also applies to employee information or other individuals (e.g., contractors, bystanders). There is also a question as to whether the sale or profit restriction would apply if an establishment were not profiting from sharing biometric identifier information with another third party. It is likely these issues will need to be addressed by city officials in the future, but erring on the side of caution for the time being should be considered the safest course of action for now.
Conclusion
If your business is located or operates in New York City and is collecting any form of biometric identifier information, it is important to understand fully the implications and ramifications of the new BII Law. Similar laws have gone into effect in other states and cities and have opened up a wide array of litigation matters, including class actions filed by plaintiffs looking to catch commercial establishments on violations of these new regulations. Contact counsel familiar with privacy and biometric securities laws to learn more and know how to fully comply with all applicable laws.
If you have questions or would like additional information, please contact any of our Intellectual Property attorneys, Labor & Employment attorneys or the primary EGS attorney with whom you work.