New York City's Biometric Identifier Information Law (BII Law), which went into effect on July 9, 2021, addresses the collection and use of biometric identifier information (BII) by commercial establishments to track customer activity. "Commercial establishment" includes retail stores, food and drink establishments, and places of entertainment. Under the BII Law, covered businesses that use biometric identifying technology in their establishments are banned from selling biometric data and are required to notify customers by posting conspicuous signage. The BII Law creates a private right of action against violators and imposes statutory damages for each violation.

BII Law is Less Stringent than the Illinois Biometric Information Privacy Act

The BII Law (1) bans the sale of biometric data, and (2) imposes a notice requirement on covered businesses that use biometric identifying technology in their establishments. Notice must be provided at commercial establishments only when biometric information is collected from a customer. The Illinois Biometric Information Privacy Act (BIPA), increasingly popular with the plaintiffs' bar, prohibits the sale or sharing of biometric identifier information and requires private entities that collect such data to provide written notice explaining their retention period and why they are collecting such data. Both the BII Law and BIPA include a broad definition of BII, regulate the use, collection, and retention of BII, and provide a private right of action for individuals aggrieved. BIPA claimants can recover potentially astronomical damages for a private entity's inadvertent use or disclosure of biometric data.

Blanket comparisons to BIPA are not warranted because the BII Law is less stringent than BIPA and BIPA is further reaching. Both the BII Law and BIPA impart restrictions on the collection and use of biometric data, including data such as fingerprints, face scans, or voiceprints. However, BIPA generally applies to any "private entity" and the BII Law regulates "commercial establishments." BIPA's private entity is defined much more broadly than the NYC BII Law's commercial establishment, and thus regulates a greater range of establishments than NYC's BII Law.

New York City's BII Law provides a 30-day cure period for certain violations and permits the collection of biometric data without written consent, which may result in less litigation than Illinois' BIPA. Nonetheless, it is essential for New York businesses subject to the BII Law to be aware of its requirements and consider whether their current insurance policy covers potential BII Law liabilities. 

Insurance Policies May Cover NYC's BII Law-Related Claims

Insurance policies that may cover BII Law-related claims include commercial general liability (CGL), employment practices liability (EPL), and cyber insurance policies.

CGL policies provide defense and indemnity coverage for "personal and advertising injury" the definition of which may cover claims for BII Law violations. Policies cover employment practices claims and often include coverage of claims for EPL employment-related invasions of privacy, which may also extend to cover BII Law-related claims. Cyber insurance policies frequently cover liability arising out of technology-related wrongful acts. Because there is a wide variation in the terms of cyber-insurance coverage, these policies need to be reviewed carefully. In some cases, the unlawful collection and disclosure of confidential information can be excluded from cyber insurance policies.

How to Determine Your Protection

Policyholders should review their coverage and prior to securing a policy, seek advice as to what exactly their existing policy covers.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.