Overview
Just as retail stores, bars, restaurants, and entertainment venues in New York City have been authorized to relax COVID restrictions, they will soon have to confront a new set of requirements—this time focused on their collection of customers' biometric information. On July 9, 2021, New York City's new law addressing the collection and use of biometric identifier information will go into effect. The NYC Biometric Law is part of a broader trend of state and local governments adopting laws to regulate business’ collection and use of biometric information.
The NYC Biometric Law requires "[a]ny commercial establishment that collects, retains, converts, stores or shares biometric identifier information of customers" to provide notice of such practices by "placing a clear and conspicuous sign near all of the commercial establishment’s customer entrances notifying customers in plain, simple language…that customers' biometric identifier information is being collected, retained, converted, stored or shared, as applicable." The sign must adhere to a "a form and manner prescribed by the commissioner of consumer and worker protection by rule."
In addition, the NYC Biometric Law prohibits "sell[ing], leas[ing], trad[ing], [or] shar[ing] in exchange for anything of value or otherwise profit[ing] from the transaction of biometric identifier information."
"Commercial establishment" is defined as "a place of entertainment, a retail store, or a food and drink establishment." The law does not apply to financial institutions.
"Biometric identifier information" is defined as "a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic." Significantly, the law's notice requirement does not apply "to [b]iometric identifier information collected through photographs or video recordings, if (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold or leased to third-parties other than law enforcement agencies."
The NYC Biometric Law contains a private right of action. Private plaintiffs may seek both monetary damages and injunctive relief. For violations of the notice requirement only, commercial establishments are provided with a 30-day cure period. For each violation of the notice requirement, businesses may be liable for damages of $500. Each negligent violation of the prohibition on selling, leasing, trading, or sharing biometric identifier information for anything of value or profit may result in damages of $500, while each intentional or reckless violation may lead to damages of $5,000. Plaintiffs may also recover reasonable attorney’s fees and costs.