Major United States Municipalities are lining up to limit the ability of the private sector to use technologies to collect biometric identifiers and information. While Portland, Oregon, was perhaps the most dramatic, banning the use of face recognition technologies earlier this year, New York City will see a significant change on this front later this week. Effective this Friday, July 9, 2021, any commercial establishment in New York City that collects, retains, converts, stores or shares biometric identifier information of customers must disclose such activity using clear and conspicuous signage near all customer entrances. Moreover, it will be unlawful to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information under the new NYC law.
Given these significant new restrictions, it is worth digging in to the requirements and consequences of the NYC law (New York City Administrative Code, Title 22, Chapter 12). First, what is biometric identifier information? Under the new law, it is a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.
What is a commercial establishment? Importantly, it includes:
- places of entertainment (such as theaters, stadiums, arenas, racetracks, museums, amusement parks, observatories, and other places where attractions, performances, concerts, exhibits, athletic games or contests are held, whether publicly or private owned);
- retail stores (e., establishments wherein consumer commodities are sold, displayed or offered for sale, or where services are provided to consumers at retail); and
- food and drink establishments (establishments that give or offer for sale food or beverages to the public for consumption or use on or off the premises, or on or off a pushcart, stand or vehicle).
The signage requirements do not apply to financial institutions or biometric identifier information collected through photographs or video recordings, if: (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold or leased to third-parties other than law enforcement agencies.
The NYC law covers establishments of all sizes throughout the city, including those that may be using technology to automatically take temperatures if those scanners are capturing retina or iris scans or face geometry. Now is the time to look at the technology you are using and make sure you are either limiting the functionality as necessary or that you have the appropriate signage and are not going to share such information with anyone else for value or profit.
Why bother? The NYC law includes a private right of action (with a 30 day cure period) that allows an individual to seek $500 for each failure to provide notice, $500 for each negligent violation, and $5,000 for each intentional or reckless violation of the restriction on sales, sharing for value, or otherwise profiting from the transaction of the biometric identifier information. The plaintiff also has the right to recover "reasonable" attorneys' fees.
NYC won't be the last to take such action. As recently as late May, the Baltimore City Council Public Safety and Government Operations Committee passed an ordinance (Council Bill 21-0001) that would bar the private sector from obtaining, retaining, accessing, or using certain face surveillance technology or any information obtained from certain face surveillance technology. The Ordinance was approved by the City Council and sent to the Mayor on June 14.
Originally published 5 July 2021.
This post first appeared in Frankfurt Kurnit's Focus on the Data blog (www.focusonthedata.com). It provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.
