Biometric Identifier Information Law – The Four Questions:
- May commercial establishments collect biometric identifier information of customers? Yes, if they provide appropriate notice.
- May commercial establishments or financial institutions sell, share or exchange for anything of value biometric identifier information of customers? No, except with law enforcement agencies.
- Do security cameras fall under the law’s prohibitions? No, provided software or computer analysis is not used after collection to pull out biometric identifier information.
- Does a commercial establishment need to provide notice to employees to collect biometric identifier information? No, under the rule it does not appear to be necessary.
Biometric Identifier Information Law – In Depth
Additionally, there is a broad prohibition on the sale, trade, lease or exchange for anything of value of BII by arguably any business establishment, including financial institutions.
While the law does allow for audio and video recording as well as photography in commercial establishments, it (1) prohibits subsequent analysis of same by software to pull out BII and (2) prohibits (seemingly categorically) the sale, sharing or leasing of images or video to third parties, except law enforcement agencies.
While the employer-employee relationship is not directly affected by this law unlike New York State’s proposed biometric privacy law, employers should alert their employees to the requirement and change their collection practices in order to avoid exposure to the consumer’s private right of action provided for under the BIIL. Secondly, while not directly spelled out in the law, it seems that employers may not sell their employees’ BII although they may collect same without notice. Lastly, employers should already be aware that New York State already prohibits employers from requiring the fingerprinting of employees as a condition of obtaining employment or continuing employment under NY Labor Law § 201-a.