New York City’s law has two broad aims. First, it imposes a notice and disclosure requirement on businesses that collect consumer biometric information. Second, it prohibits the exchange of consumer biometric information for anything of value.
Under this new law, “‘biometric identifier information’ means a physiological or biological characteristic that is used by or on behalf of a commercial establishment . . . to identify, or assist in identifying, an individual.” The definition also provides a non-exhaustive list of examples, including “(i) a retina or iris scan, (ii) a fingerprint or voiceprint, [and] (iii) a scan of hand or face geometry, or any other identifying characteristic.” Further, the law is applicable to any “commercial establishment,” or “place of entertainment, a retail store, or a food and drink establishment.” Interestingly, a “place of entertainment” is broadly defined as “any privately or publicly owned and operated entertainment facility such as a theatre, stadium, arena, racetrack, museum, amusement park and observatory, or other place where attractions, performances, concerts, exhibits, athletic games or contests are held.” The law also encompasses consumer retail stores and restaurants (including food trucks and/or food vendors).
Notably, a “‘customer’ means a purchaser or lessee, or a prospective purchaser or lessee, of goods or services from a commercial establishment[,]” and is applicable to any consumer (not just a New York City or New York State resident).
The below will briefly outline some of the key requirements and prohibitions imposed by New York City’s law.
1. Collection notice requirement:
A commercial establishment that “collects, retains, converts, stores or shares biometric identifier information of customers” must place a “clear and conspicuous sign” near all consumer entrances that, in plain language, discloses the collection, retention, or sharing of biometric information. This notice is required even if an establishment does not actively collect biometric identifier information.
This provision is not applicable to financial institutions, which are broadly defined but is applicable to “commercial establishment[s]” that primarily sell goods and services, where the issuance of credit cards or in-store financing is incidental or limited. Likewise, it is inapplicable to instances where the biometric information is not “analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics” and is not sold or leased to third parties (unless the third-party is a law enforcement agency).