New York Biometric Identification Information Act goes into effect July 9th. The law applies to food and beverage stores, entertainment venues, and retail stores in New York City that collect, store, convert, store, or share biometric identification information (e.g., retinal or iris scans, fingerprints, voice prints, and hand scans). of customers. According to the law, affected companies must post clear, noticeable notices near all customer entrances to their facilities. The law gives injured customers a private right to sue with 30 days’ notice and a grace period, with damages between $ 500 and $ 5,000 per violation and legal fees.
Effective July 9th, pursuant to Section 22-1202 (a) of the New York City Administrative Act, New York City businesses that collect, store, transform, store, or disclose biometric identification information from customers must disclose, or share, such collection, storage, conversion, storage , if applicable, by placing a clear and prominent sign near all customer entrances to their facilities. This signage must use plain, simple language.
Essential elements of the law are:
- Commercial establishments. The definition of commercial establishments is limited to entertainment venues, retail stores, or catering establishments.
- Places of entertainment. Entertainment venues refers to any private or public entertainment facility such as theaters, stadiums, arenas, race tracks, museums, amusement parks, observatories, or any other location where attractions, performances, concerts, exhibitions, sports games, or competitions are held.
- Biometric identifier information. The term biometric identifier information means a physiological or biological characteristic used by or on behalf of a commercial entity, individually or in combination, to identify or help identify an individual, including, but not limited to: (i ) a retinal or iris scan, (ii) a fingerprint or voice print, (iii) a scan of the hand or face geometry, or any other identifying feature.
Prohibition of the use of biometrics
- Section 22-1202 (b) prohibits commercial establishments from selling, renting, trading, sharing, or otherwise using such biometric identifier information.
Private right of action
The law contains a private right of action that provides for the following:
- Notice and healing period. Aggrieved parties must give written notice to the offending parties at least 30 days prior to commencement of a lawsuit alleging a commercial establishment of violating 22-1202 (a). Actions alleging violation of 22-1202 (b) do not require prior written notice stating that commercial entities may not sell, share, or benefit in any way from a customer’s biometric information.
- Statutory Compensation. Dominant parties may reclaim: (i) US $ 500 for any unhealed disclosure breach or negligent breach of prohibition on sale / disclosure of biometric information; (ii) $ 5,000 for each willful or negligent breach of the No Sale / Transfer; (iii) reasonable attorney fees and expenses; and (iv) other remedies, including an injunction, as the court deems appropriate.
- The law does not apply to government agencies, employees, or agents.
- The disclosure requirement in 22-1202 (a) does not apply to financial institutions or companies that collect biometric identification information through photos or video recordings if: (i) the collected images or videos are not analyzed by software or applications that identify or assist with identification by persons based on physiological or biological characteristics, and (ii) the images or videos will not be shared, sold or rented to any third party other than law enforcement agencies.