Article contributed by James M. Smedley, Ellenoff Grossman & Schole LLP
On July 9, 2021, New York City implemented new laws applying to the collection and use of biometric data. As millions of now vaccinated individuals flock back to the city’s bars, restaurants and theaters, certain technologies used by these venues are now under new scrutiny and regulation.
NYC’s new “Biometric Identified Information” law (“BII Law”) requires commercial establishments that collect “biometric identifier information” to display signs that such information is being collected. The BII Law further restricts commercial establishments from sharing or selling such biometric identifier information with anyone else. Biometric identifier information includes fingerprints, retina scans, hand print scans, facial recognition, voice identification, or any other physical or biological trait that would serve to identify an individual.
The BII Law has two main requirements: i) a notice requirement; and ii) a restriction on the sale of collected biometric identifier information.
Notice Requirement
The notice requirement applies to all “commercial establishments”, defined as retail stores, food and beverage establishments (restaurants, bars, food trucks/stands) and entertainment venues (concert halls, theaters, museums, stadiums, arenas, amusement parks).
If an establishment is subject to this law, and collects biometric identifier information, then the establishment must place “clear and conspicuous” signage near any and all entrances used by customers. The signage must inform the customers in “plain, simple language” that the establishment collects, stores, retains, shares and/or otherwise uses the biometric identifier information. NYC regulators are tasked with providing additional information on the type and form of the notices, but at present time, no such guidance has been provided. Until then, it is advisable to place signage that would reasonably be understood to be “plain, simple language.”
If an establishment fails to implement such signage, the BII Law allows individuals to provide notice to the establishment, identifying the alleged violation, and a 30-day cure period to the establishment to correct the deficiencies prior to any action being able to be commenced. If cured within the 30-day period, then no further violation shall occur and no action can be initiated. If not cured, the BII Law provides for penalties of $500 per violation, as well as recovery of the claimant’s attorney’s fees, costs and expert
witness fees.
There is a notable exception for biometric identifier information that is collected via photographs or video recordings (such as CCTV), so long as no software or other image analysis processing means are used on the images or video to identify individuals based on such biometric identifier information, and the images and videos are not sold, shared or leased to anyone other than law enforcement organizations or officials. Also, while financial institutions and government facilities and agencies, as well as their employees and agents, are expressly exempted from this notice requirement, they are still subject to the restrictions on sale of such biometric identifier information.
Restriction on Sale
The BII Law also makes it unlawful to “sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information.” Individuals claiming violations of this restriction can bring an action directly against an establishment. However, unlike the signage requirement, there is no pre-suit notification requirement, meaning that establishments do not have the opportunity to cure these violations before an action is commenced. Violations of the restriction on sale of biometric identifier information range from $500 for negligent violations, to $5,000 for intentional or reckless violations, plus the ability in each case to recover attorneys’ fees, costs and expert witness fees.
Ambiguities
There exist several ambiguities in the BII Law as it currently stands. For instance, it is unclear as to whether the restriction on sale, lease, trade or profit from biometric identifier information is limited to only consumers, or whether it also applies to employee information or other individuals (e.g., contractors, bystanders). There is also a question as to whether the sale or profit restriction would apply if an establishment were not profiting from sharing biometric identifier information with another third party. It is likely these issues will need to be addressed by city officials in the future, but erring on the side of caution for the time being should be considered the safest course of action for now.
Conclusion
If your business is located or operates in New York City and is collecting any form of biometric identifier information, it is important to understand fully the implications and ramifications of the new BII Law. Similar laws have gone into effect in other states and cities and have opened up a wide array of litigation, including class actions filed by plaintiffs, looking to catch commercial establishments for violations of these new regulations.
If you have questions or would like additional information on how to best to comply with all applicable laws, please contact any of EGS’ Intellectual Property attorneys or Labor & Employment attorneys to discuss these issues further.
James M. Smedley is a member at Ellenoff Grossman & Schole LLP in and serves as head of the firm’s Intellectual Property and Technology law group. Mr. Smedley’s practice has focused on strategic counseling of companies with respect to protecting and enforcing their intellectual property rights, both domestically and internationally. Representative matters include trademark and patent prosecution, brand protection and enforcement, intellectual property licensing, anti-counterfeiting counseling and privacy/cybersecurity counseling. James Smedley can be reached via email at jsmedley@egsllp.com or by phone at 212-370-1300
