New York City recently adopted a biometric prescription which is to come into effect on July 9, 2021. With this ordinance, NYC joined other cities (like Portland) in regulating the use of biometric information. The ordinance may impact retailers, restaurants and entertainment venues across the city that use security cameras with facial recognition technology or otherwise collect their customers’ biometric identifiers.
Applicability. The law applies to business establishments (like the type detailed above) that collect “biometric credentials” from “customers”. Biometric credentials are defined as physiological or biological characteristics that are used by or on behalf of a business establishment, alone or in combination, identify or help identify, an individual, including, but not limited to: (i) a scan of the retina or iris, (ii) a fingerprint or voice print, (iii) a scan of the geometry of the hand or face, or any other identifying feature. Customers are buyers, tenants or potential buyers or tenants of goods or services of a business establishment. Thus, this ordinance does not apply to biometric information likely to be collected from employees.
Requirements and restrictions. The ordinance requires business establishments to collect, store or share biometric information client publicize the practice by posting a sign near all guest entrances. The sign must be in “clear and simple language” and in a form to be prescribed by the City. Under the ordinance, commercial establishments are also prohibited from selling, renting, trading or sharing in exchange for anything of value, or profiting from the transaction of biometric credentials. .
Enforcement – Private right of action. There is a private right of action in the order. For breaches of the reporting requirement, customers must provide a business with written notice of the deficiency and a 30-day opportunity to correct it. If such an alleged violation has been corrected within this period, no action can be taken. No prior written notice is required for “no-sale” requirement claims. Complainants can recover $ 500 per violation for not hardened breaches of the notification obligation or any negligent breach of the ban on the sale / sharing of biometric data, as well as attorney fees. For intentional or reckless violations of the sell / share ban, complainants can recover $ 5,000 per violation.
Derogations. The ordinance entirely exempts the collection, storage or sharing of biometric information by government agencies, employees and agents. Financial institutions are exempt from the signage requirement, but not from the prohibition on sale. Additionally, business establishments that collect biometric information through photographs or video recordings, but do not use software or applications to identify or help identify individuals based on physiological characteristics. or organic and do not share them with third parties (other than law enforcement), are also exempt from the obligation to signal (but not from the prohibition of sale).
Put it into practice. Businesses that operate a retail store, restaurant, or entertainment venue in New York City must assess whether they are collecting or using biometric information as required by the ordinance. Depending on how this technology is used, there may be requirements to post prominent signage of these practices.
Copyright © 2021, Sheppard Mullin Richter & Hampton LLP.Revue nationale de droit, volume XI, number 168