NEW YORK–New York City’s credit unions are now just one month away from a new law on the use of biometric data.
Effective July 9, New York City’s "biometric identifier information" law will go into effect and will ban the sale of biometric data but permit the use of biometric identifying technologies with posted notice to consumers in "simple language" to be prescribed by forthcoming rules.
Financial institutions do not have to post notice of the use of the biometric recognition technologies but are subject to the ban on sale of biometric identifier information.
Commercial establishments, however, must post "clear and conspicuous signs" at customer entrances notifying customers that technologies are in use that can identify (or assist in identifying) individuals by voice, eye (retina or iris), finger, hand, face, "or any other identifying characteristic."
Even if the commercial establishment does not actively collect biometric data, notice must still be posted if it "retains, converts, stores or shares biometric identifier information of customers."
The law defines a "customer" includes only a "purchaser or lessee, or a prospective purchaser or lessee, of goods or services;" a notice for collecting or using biometrics of employees is not required.
Can’t ‘Profit’ From Sale
Although the use of biometric identifying technologies is permitted with the required notice, it will be unlawful to sell, lease, trade, or share biometric identifier information in exchange for anything of value or to "otherwise profit from the transaction of biometric information."
One analysis noted that because the section of the law banning sale or exchange is not specifically in relation to "customers," it may be argued that commercial establishments' employees' biometric identifier information is subject to the ban on sale or exchange.
The new law will apply to any "commercial establishment" in the city, which is narrowly defined as a "place of entertainment, a retail store, or a food and drink establishment."
Exemptions
Expressly excluded from all aspects of the new law are "government agencies, employees or agents." Financial institutions do not have to post notice of the use of the biometric recognition technologies but are subject to the ban on sale of biometric identifier information. Financial institutions include traditional banks, savings and loan associations, credit unions, and securities brokers and dealers but do not include those establishments whose primary business is the retail sales of goods or services, even if offering credit cards or in-store financing.
What has bothered many businesses in New York City is the new law also provides a private right of action to "aggrieved" individuals to recover statutory damages of $500 per violation for a commercial establishment's failure to post conspicuous notices, $500 for each negligent violation of the ban on the sale or sharing of biometric data, and $5,000 for each intentional or reckless violation of the ban on selling or sharing biometric identifier information.