New York City’s Biometrics Law Set to Take Businesses by Surprise

June 9, 2021Alerts

A new biometric data collection law will go into effect in New York City next month that is likely to catch many businesses unprepared and not in compliance.

This new law applies to any business operating a “place of entertainment, a retail store, or a food and drink establishment” (definitions are below) in New York City, where that business collects biometric identifiers from ”customer,” which the law defines as “a purchaser [ ] or a prospective purchaser of goods or services”. These businesses must post a clear and conspicuous sign near all customer entrances notifying customers in plain, simple language, that customers’ biometric identifier information is being collected, retained, converted, stored or shared, as applicable. Financial institutions are exempt from the signage requirement.

Additionally, any business collecting customer biometric identifier information is prohibited from selling, leasing, trading, sharing in exchange for anything of value, or otherwise profiting from the transaction of biometric identifier information.

The phrase “biometric identifier information” means a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic. The last part will likely be the subject of much litigation. It may be surprising to learn how many retail establishments are using this technology. For example, a Nest security camera can identify a person by using face scan.

The law appears to exclude biometric data collected from employees, such as biometric data used in conjunction with clocking in and out of an employer’s time keeping system.  Yet, employers continue to be subject to stringent federal and state laws requiring them to accurately track employee work time. 

Unfortunately, there is a private right of action in the statute permitting recovery of:

  • for each violation of the law (i.e., either failure to post notice of collection and/or improper sale or sharing of biometric information), damages of $500;
  • for each intentional or reckless violation of the prohibition on sale or sharing of biometric information, damages of $5,000;
  • reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses; and
  • other relief, including an injunction, as the court may deem appropriate

If your business is subject to this new law, it is important to get into compliance now. While there is a cure period related to the signage obligations, it will be more costly to later prove the correction or practices than just comply from the outset.

Definitions:

Food and drink establishment. The term “food and drink establishment” means an establishment that gives or offers for sale food or beverages to the public for consumption or use on or off the premises, or on or off a pushcart, stand or vehicle.

Place of entertainment. The term “place of entertainment” means any privately or publicly owned and operated entertainment facility, such as a theater, stadium, arena, racetrack, museum, amusement park, observatory, or other place where attractions, performances, concerts, exhibits, athletic games or contests are held.

Retail store. The term “retail store” means an establishment wherein consumer commodities are sold, displayed or offered for sale, or where services are provided to consumers at retail.