As you may know, the use of facial recognition technology has been growing rapidly in a wide variety of public life, such as in retail locations and entertainment venues. Accompanying the growth in the use of this technology is a rise in concern about how the information acquired by its use is stored, shared and used by those who possess it. While legislation addressing such concerns has been limited to date (Illinois, Texas and the state of Washington currently have such legislation), a new addition to the New York City Administrative Code (2021 NYC Local Law No. 3, NYC Admin. Code Sections 22-1201 – 22-1205)(the “NYC Law”) will go into effect on July 9, and similar legislation has been proposed in both houses of the New York State legislature. It is imperative that businesses that operate in New York City and use such technology become familiar with the requirements of the NYC Law, and businesses elsewhere in New York State that use such technology are advised to be aware of the likelihood that they too may be subject to similar legislation in the not too distant future. Set forth below is a short summary of the scope and terms of the NYC Law.
To What Businesses Does the NYC Law Apply?
The NYC Law applies to what are referred to as “commercial establishments” operating within New York City, namely a place of entertainment, a retail store, or a food and drink establishment. A “place of entertainment” is any privately or publicly owned and operated entertainment facility, such as a theater, stadium, arena, racetrack, museum, amusement park, observatory, or other place where attractions, performances, concerts, exhibits, athletic games or contests are held. A “retail store” is an establishment wherein consumer commodities are sold, displayed or offered for sale, or where services are provided to consumers at retail. A “food and drink establishment” is an establishment that gives or offers for sale food or beverages to the public for consumption or use on or off the premises, or on or off a pushcart, stand or vehicle.
What Type of Information is Covered by the NYC Law?
The NYC Law is concerned with “biometric identifier information,” which is a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.
Whose Biometric Identified Information is Covered by the NYC Law?
As the NYC Law does not state otherwise (such as, for example, by stating it only applies to residents of the City), it presumably applies to any individual whose biometric identifier information is collected within New York City, regardless of where they live or where their information is retained or used.
What Does the NYC Law Require?
The NYC Law has two requirements. First, any commercial establishment that collects, retains, converts, stores or shares biometric identifier information of customers must disclose such collection, retention, conversion, storage or sharing, as applicable, by placing a clear and conspicuous sign near all of its customer entrances notifying customers in plain, simple language, in a form and manner to be prescribed by the Commissioner of Consumer and Worker Protection, that customers’ biometric identifier information is being collected, retained, converted, stored or shared, as applicable (the “Notice Requirement”). A “customer” is a purchaser or lessee, or a prospective purchaser or lessee, of goods or services from a commercial establishment.
Second, the NYC Law makes it unlawful to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information (the “Sale Prohibition”). The language of the Sale Prohibition would appear to permit sharing of biometric identifier information without consideration, such as between affiliated entities. It is unclear whether an entity located outside New York City that receives biometric identifier information without charge from an entity within New York City is subject to the NYC Law (the NYC Law could have, for example, provided that to be permitted, any such transfer would have to be made subject to an agreement by the receiving person to hold such information in accordance with the NYC Law).
Is There an Individual Right of Action to Enforce the NYC Law?
Yes, in what may prove to be a fertile new practice area for class action attorneys (given the small amount of damages available to any one individual, combined with the right to recover legal fees), the NYC Law provides that a person who is aggrieved by a violation of the law may bring an action on his or her own behalf against an offending party. At least 30 days prior to initiating any action against a commercial establishment for a violation of the Notice Requirement, the aggrieved person must give written notice to the commercial establishment setting forth such person’s claim. If, within 30 days, the commercial establishment cures the violation and provides the aggrieved person an express written statement that the violation has been cured and that no further violations will occur, no action may be initiated against the commercial establishment for such violation. If a commercial establishment continues to violate subdivision the Notice Requirement, the aggrieved person may then initiate an action against such establishment. No prior written notice is required for actions alleging a violation of the Sale Prohibition.
A prevailing party may recover damages of $500 for each violation of the Notice Requirement and each negligent violation of the Sale Prohibition, damages of $5,000 for each intentional or reckless violation of the Sale Prohibition, and, with respect to any violation, reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses. A court may also award injunctive relief and such other relief as it may deem appropriate.
Are There Any Exceptions?
Yes. First, the NYC Law does not apply to the collection, storage, sharing or use of biometric identifier information by government agencies, employees or agents.
Second, the Notice Requirement does not apply to financial institutions, which are defined as a bank, trust company, national bank, savings bank, federal mutual savings bank, savings and loan association, federal savings and loan association, federal mutual savings and loan association, credit union, federal credit union, branch of a foreign banking corporation, public pension fund, retirement system, securities broker, securities dealer or securities firm. The term “financial institution” does not include a commercial establishment whose primary business is the retail sale of goods and services to customers and provides limited financial services such as the issuance of credit cards or in-store financing to customers (for example, an auto dealership). Note, however, that the Sale Prohibition does apply to financial institutions.
Third, the Notice Requirement does not apply to biometric identifier information collected through photographs or video recordings, if: (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold or leased to third-parties other than law enforcement agencies. This exception permits the continued use of, for example, in-store security cameras without the need to comply with the Notice Requirement (assuming the two requirements described above are satisfied).