The New York City Council enacted significant biometric privacy legislation that will take effect on July 9, 2021. New Local Law 3 of 2021, creating a Chapter 12 on "Biometric Identifier Information" in the New York City Administrative Code, will restrict "commercial establishments" in New York City in their collection and use of biometric identifiers from customers. While the new law focuses on issues such as the undisclosed use of facial recognition technology in stores and restaurants, it actually sweeps more broadly, sharing several similarities with the Illinois Biometric Information Privacy Act (a statute that has gained national prominence by spawning over 800 class action lawsuits since its passage).
Below are key takeaways from our discussion:
- Biometric privacy laws regulate the use or collection of biometric information (e.g. fingerprints, eye scans, voice prints, hand scans, facial recognition, or other biological or physical traits)
- Over the past five years, support for regulation of biometric data and concerns about biometric privacy have risen, leading to a patchwork of new laws and proposals for increased regulation
- Some laws, like the new biometric privacy law in New York City, provide for a private right of action to recover damages (in some cases, in a specific statutory amount rather than any actual damages) for each violation
- The New York City law applies to commercial establishments, including places of entertainment, retail stores, and food and drink establishments
- Commercial establishments in New York City that collect biometric information must post a conspicuous sign at all customer entrances disclosing that biometric information is being collected
- The New York City law also prohibits commercial establishments selling, leasing, trading, sharing, or otherwise profiting from a transaction in biometric information
- Failure to comply with the New York City law can cost violators from $500 and $5,000 for each violation, plus attorneys' fees