Biometric Identifier Information Law – The Four Questions:
- May commercial establishments collect biometric identifier information of customers? Yes, if they provide appropriate notice.
- May commercial establishments or financial institutions sell, share or exchange for anything of value biometric identifier information of customers? No, except with law enforcement agencies.
- Do security cameras fall under the law’s prohibitions? No, provided software or computer analysis is not used after collection to pull out biometric identifier information.
- Does a commercial establishment need to provide notice to employees to collect biometric identifier information? No, under the rule it does not appear to be necessary.
Biometric Identifier Information Law – In Depth
New York City’s little-publicized Biometric Identifier Information Law (“BIIL”) takes effect on July 9, 2021. The law prohibits commercial establishments, which are defined as places of entertainment, retail stores, or food and drinks establishments from, collecting, using or retaining biometric identifier information (“BII”) without previous disclosure by clear and conspicuous signage in the form prescribed by the commissioner of consumer and worker protection by rule. BII as defined as any physiological or biological characteristic “that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.”
Additionally, there is a broad prohibition on the sale, trade, lease or exchange for anything of value of BII by arguably any business establishment, including financial institutions.
While the law does allow for audio and video recording as well as photography in commercial establishments, it (1) prohibits subsequent analysis of same by software to pull out BII and (2) prohibits (seemingly categorically) the sale, sharing or leasing of images or video to third parties, except law enforcement agencies.
While the employer-employee relationship is not directly affected by this law unlike New York State’s proposed biometric privacy law, employers should alert their employees to the requirement and change their collection practices in order to avoid exposure to the consumer’s private right of action provided for under the BIIL. Secondly, while not directly spelled out in the law, it seems that employers may not sell their employees’ BII although they may collect same without notice. Lastly, employers should already be aware that New York State already prohibits employers from requiring the fingerprinting of employees as a condition of obtaining employment or continuing employment under NY Labor Law § 201-a.