New York City’s Biometric Identifier Information Law goes into effect on July 9. The law applies to food and drink establishments, places of entertainment, and retail stores in New York City that collect, retain, convert, store, or share biometric identifier information (e.g., retina or iris scans, fingerprints, voiceprints, and hand scans) from customers. According to the law, affected businesses must post clear, conspicuous notices near all customer entrances to their facilities. The law gives aggrieved customers a private right of action, subject to a 30-day notice and cure period, with damages ranging from $500 to $5,000 per violation, along with attorney’s fees.
Effective July 9, under 22-1202(a) of the New York City Administrative Code, commercial establishments in New York City that collect, retain, convert, store, or share biometric identifier information from customers must disclose such collection, retention, conversion, storage, or sharing, as applicable, by placing a clear and conspicuous sign near all customer entrances to their facilities. Such signage must use plain, simple language.
Key elements of the law include:
Definitions
- Commercial Establishments. The definition of commercial establishments is limited to places of entertainment, retail stores, or food and drink establishments.
- Places of Entertainment. Places of entertainment refers to any privately or publicly owned and operated entertainment facility, such as a theater, stadium, arena, racetrack, museum, amusement park, observatory, or other place where attractions, performances, concerts, exhibits, athletic games, or contests are held.
- Biometric identifier information. The term biometric identifier information means a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.
Prohibition on Profiting From Biometrics
- Section 22-1202(b) bars commercial establishments from selling, leasing, trading, sharing, or otherwise profiting from such biometric identifier information.
Private Right of Action
The law includes a private right of action, which provides:
- Notice and Cure Period. Aggrieved persons must give offending parties written notice at least 30 days prior to initiating any action accusing a commercial establishment of violating 22-1202(a). No prior written notice is required for actions alleging a violation of 22-1202(b), which provides that commercial establishments cannot sell, share, or profit in any way from a customer’s biometric information.
- Statutory Damages. Prevailing parties can recover: (i) $500 for each uncured violation of the notice requirement or any negligent violation of the prohibition on the sale/sharing of biometric data; (ii) $5,000 for each intentional or reckless violation of the sale/sharing prohibition; (iii) reasonable attorney’s fees and costs; and (iv) other relief, including an injunction, as the court deems appropriate.
Exemptions
- The law does not apply to government agencies, employees, or agents.
- The disclosure requirement in 22-1202(a) does not apply to financial institutions or businesses collecting biometric identifier information through photographs or video recordings if: (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold, or leased to third parties other than law enforcement agencies.
