New York City’s new “Biometric Identifier Information” law (“BII Law”) is now in effect and restricts the collection, use and sale of “biometric identifier information” by businesses in New York City. Biometric identifiers include fingerprints, retina scans, hand print scans, facial recognition, voice identification, or any other physical or biological trait that would serve to identify an individual.
The BII Law has two main components: (i) a notice requirement applicable to “commercial establishments” and (ii) a restriction on the sale of collected biometric identifier information applicable to all businesses.
Notice Requirement for Commercial Establishments
If a “commercial establishment” – i.e., retail stores, food and beverage establishments (including food trucks and stands) and entertainment venues (including publicly or privately-owned concert halls, theaters, museums, stadiums, arenas and amusement parks) – collects, retains, converts, stores, or shares customer biometric identifier information, then the establishment must place “clear and conspicuous” signage near any and all entrances used by customers stating customers in “plain, simple language” that the establishment collects, stores, retains, shares and/or otherwise uses biometric identifier information. Financial institutions are not considered “commercial establishments” for the purposes of the notice requirement. Additional information on the type and form of the notice will be forthcoming from the NYC Department of Consumer and Worker Protection (formerly the Department of Consumer Affairs).
Written consent is not required to collect and use customers’ biometric identifier information. Further, there is a notable exception for biometric identifier information that is collected via photographs or video recordings (such as CCTV), so long as no software or other image analysis processing means are used to identify individuals based on biometric identifier information, and further the images and videos are not sold, shared or leased to anyone other than law enforcement.
Restriction on Sale of Biometric Identifier Information Applicable to All Businesses
Aside from the notice requirement, the BII Law also makes it unlawful for any business in New York City – not just “commercial establishments” – to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information. Unlike the notice requirement, the BII Law does not carve out any type of business from this restriction, other than government agencies.
Consequences of Violation
The BII Law provides for a private right of action, meaning that an individual may file a lawsuit or other claim against any business that violates the requirements of the BII Law. Available damages include $500 for each violation of the provisions requiring notice to customers, and $500 for each “negligent” violation and $5,000 for each “intentional or reckless” violation of the prohibition against exchanging biometric identifier information for value. In addition, violators can be liable for reasonable attorneys’ fees and litigation expenses.
Importantly, however, before filing a lawsuit or other claim based on the failure of a commercial establishment to post the required signage, individuals must provide notice of the violation to the commercial establishment. The BII Law then provides for a 30-day cure period in which the commercial establishment can cure the deficiency by posting the required signage. If the business posts the required signage within the 30-day cure period, then no action can be initiated.
There is no corresponding notice-and-cure period for businesses that violate the prohibition against exchanging biometric identifier information for something of value.
Ambiguities
There are several ambiguities in the BII Law as it currently stands. For instance, it is unclear as to whether the restriction on sale, lease, trade or profit from biometric identifier information is limited to only consumers, or whether it also applies to employee information or other individuals (e.g., contractors, bystanders). There is also a question as to whether the restriction on sharing biometric identifier information with another third party would apply if an establishment were not profiting from sharing such information.
It is likely these issues will be addressed by the City in the future, but for now we recommend that employers who collect or use employees’ biometric identifier information, such as in connection with a timekeeping system, provide the same notice to employees as is required to be provided to consumers, and that businesses otherwise err on the side of caution when it comes to biometric identifier information.
* * *
If your business is located in New York City and is collecting any form of biometric identifier information, it is important to understand fully the implications and ramifications of the new BII Law. Similar laws have gone into effect in other states and cities and have opened up a wide array of litigation matters, including class actions filed by plaintiffs looking to catch commercial establishments on violations of these new regulations.
