Privacy & Information Security Law Blog

On January 10, 2021, New York City enacted a new biometrics ordinance that regulates the commercial use and sale of biometric identifier information. Effective July 9, 2021, commercial establishments (i.e., places of entertainment, retail stores or food and drink establishments) that collect, retain, convert, store or share customers’ biometric identifier information must post a clear and conspicuous sign near all customer entrances notifying customers in plain, simple language of this activity. The ordinance also prohibits commercial establishments from selling, leasing, trading, sharing in exchange for anything of value or otherwise profiting from the transaction of biometric identifier information.

Key elements of the biometrics ordinance include:

• Definitions: The ordinance applies to “biometric identifier information,” which it defines as a “physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.”
• Private Right of Action: The ordinance provides for a private right of action, allowing aggrieved persons to recover (1) $500 per violation for uncured breaches of the notice requirement or any negligent violation of the prohibition on sale/sharing of biometric data; (2) $5,000 per intentional or reckless violation of the sale/sharing prohibition; (3) reasonable attorneys’ fees and costs; and (4) other relief, including an injunction, as the court deems appropriate.
• Exemptions: The ordinance exempts financial institutions, government agencies and “[b]iometric identifier information collected through photographs or video recordings, if: (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold or leased to third-parties other than law enforcement agencies.”

In enacting the biometrics ordinance, New York City joins Portland, which, in September 2020, became the first city to regulate facial recognition technologies.