Skip to content

Brought to you by

Dentons logo

Privacy and Cybersecurity Law

Coverage and commentary on developments in data protection.

open menu close menu

Privacy and Cybersecurity Law

  • Home
  • About Us

New NYC Biometric Law Takes Effect In Two Weeks – Is Your Organization Ready?

By Peter Stockburger
June 25, 2021
  • General
Share on Facebook Share on Twitter Share via email Share on LinkedIn

On January 10, 2021, the New York City Council enacted a new biometric law requiring certain commercial establishments within New York City that collect “biometric identifier information” to prominently display signage that such information is being collected and prohibiting those establishments from selling or sharing the information with others. The law takes effect on July 9, 2021.

What Kinds Of Establishments Are Covered?

The law applies to places of entertainment (e.g., theaters, stadiums, racetracks, etc.), retail stores, and food and drink establishments (e.g., bars, restaurants, and food trucks or stands).

What Information Is Covered?

“Biometric identifier information” which is defined as a “physiological or biological characteristic…used by or on behalf of a commercial establishment…to identify, or assist in identifying, an individual.” The law gives a non-exhaustive list of examples of information that my fit within this definition assuming they are used to identify or assist in identifying an individual, including eye scans, fingerprints, voiceprints or scans of hand of face geometry.

Who Is Covered?

The law applies to anyone who has their biometric information collected within New York City, regardless of their place of residence. This would ostensibly include tourists.

What Does The New Law Require?

Notice and it prohibits the sale of biometric identifier information.

  • Notice Requirement. Covered commercial establishments must place “clear and conspicuous” signage near all customer entrances informing customers in “plain, simple language” that the establishment is collecting, storing, converting, retaining and/or sharing biometric identifier information. The Commissioner of the Department of Consumer and Worker Protection is expected to issue a form for this notice through a separate rule.
  • Prohibition of Sale. The law makes it unlawful to “sell, lease, trade [or] share in exchange for anything of value” biometric identifier information or otherwise profit from a transaction of such information.

How Can The Law Be Enforced?

The new law provides for a private right of action. For notice violations, there is a 30 day cure period after which a plaintiff may seek $500 in statutory damages per violation and may seek an award of attorneys’ fees, expert fees, and injunctive relief.

For sale violations, there is no cure period and plaintiffs may directly seek the recovery of $500 per negligent violation, plus attorneys’ fees, expert fees, and injunctive relief, and $5,000 per intentional or reckless violation.

Are There Exemptions?

Yes. Government institutes are exempt from the entirety of the law. Financial institutions (which is separately defined) are exempt from the notice provision but are still subject to the prohibition of sale provision. And biometric identifier information collected through photographs or video recordings are exempt from the notice requirement so long as they are not used to identify individuals based on physiological or biological characteristics and the images or video are not shared, sold or leased to third-parties other than to law enforcement agencies.

Key Takeaways

  • Key Takeaway #1 – Know Your Data. Covered organizations that fall within the scope of this law should ensure they understand the scope of biometric data collected within the bounds of New York City, determine whether any such information may be exempt, develop appropriate notice, and build in safeguards to prohibit the sale or sharing of such information in alignment with the new law.
  • Key Takeaway #2 – Think About Broader Compliance. The new New York City biometric law is just one of many biometric laws across the country organizations must consider in their compliance efforts. If your organization collects Illinois resident data within your establishment inside of New York City, for example, you may need to adopt a broader compliance regime that includes express consent.
  • Key Takeaway #3 – Watch Broader New York. The New York City biometric law is part of a larger effort by New York to take a leading role in developing pro-consumer data privacy laws. The New York legislature is considering broader, statewide biometric and consumer data privacy laws. It’s therefore critically important to stay abreast of the changing laws in New York more broadly, as well as the rest of the nation.

Share on Facebook Share on Twitter Share via email Share on LinkedIn
Subscribe and stay updated
Receive our latest blog posts by email.
Stay in Touch
Peter Stockburger

About Peter Stockburger

Peter Stockburger is the office managing partner for the Firm's San Diego office, a member of the Firm's Global Data Privacy and Venture Technology Groups, and co-lead of the Firm's Autonomous Vehicles practice. With a focus on data privacy and security, Peter partners with clients around the globe to leverage data and talent to grow, operate, and protect their business.

All posts Full bio

RELATED POSTS

  • General

ICO Guidance on Artificial Intelligence

By Nick Graham
  • Data Transfers
  • Europe
  • General
  • United States

Agreement For A New Trans-Atlantic Data Privacy Framework Announced

On March 25, 2022, the United States and European Commission announced by joint statement an agreement in principle on a […]

By Allison Bender, Todd Daubert, Simon Elliott, and Michael Kar
  • General

EDPB guidelines on the targeting of social media users

By Rosemarie Schaar and Rosemarie Schaar

About Dentons

Dentons is designed to be different. As the world’s largest law firm with 20,000 professionals in over 200 locations in more than 80 countries, we can help you grow, protect, operate and finance your business. Our polycentric and purpose-driven approach, together with our commitment to inclusion, diversity, equity and ESG, ensures we challenge the status quo to stay focused on what matters most to you. www.dentons.com

Dentons boilerplate image

Twitter

Categories

  • Accountability
  • Asia Pacific
  • Canada
  • Cloud Computing
  • Consumer Protection
  • Cybersecurity
  • Data Breach
  • Data Transfers
  • Employee Privacy
  • Enforcement
  • Europe
  • General
  • Government Information
  • Health Information Privacy
  • Latin America
  • Marketing, Cookies & Spam
  • New and Proposed Laws
  • Privacy Notices
  • Privacy Rights
  • Record Retention
  • Smart Cities
  • United Kingdom
  • United States

Subscribe and stay updated

Receive our latest blog posts by email.

Stay in Touch

Dentons logo

© 2023 Dentons

  • Legal notices
  • Privacy policy
  • Terms of use
  • Cookies on this site