NYC proposes regulations for sale of biometrics by businesses

New York City has joined the list of jurisdictions nationwide creating roadblocks to facial recognition and other biometrics. Lawmakers agreed to regulate how most businesses in the Big Apple use biometrics, beginning July 9, 2021.

The ordinance’s primary target is trade in personal data. In fact, it prohibits company owners from profiting in any way from the biometrics they collect. Financial institutions are exempt.

An analysis of the regulation by InfoLawGroup states that it could be argued that it includes sale of employees’ biometric data.

A private right of action, which has been a contentious element in biometrics laws in other states, is granted by the legislation as well.

People can sue for $5,000 and attorney fees for each willful or reckless transaction. They can also sue for $500 plus attorney fees per violation if collected biometrics are negligently traded.

The same goes for situations in which customer notices, required by the ordinance, are not posted.

The ordinance does not prohibit businesses from collecting biometrics. It only seeks to prevent commercialization of the data.

However, proposed New York State legislation would regulate the possession of biometrics by “private entities.” Introduced in the state assembly in January and subsequently referred to the consumer affairs and protection committee, it is being called the Biometric Privacy Act.

It would make organizations create written policies for retaining and destroying biometric data. Destruction would be required when the original reason for possessing the information had been completed, or no more than three years after the person in question had last interacted with the organization.

Most sides of the debate about use of biometrics appear ready to engage in a dialog about how to move forward with secure, rights-focused uses that still leave room for businesses to profit from the technology.

In January, the Electronic Frontier Foundation, one of the oldest organizations advocating for free speech and privacy online, issued a statement saying that, “It does not follow that all private use of facial recognition technology undermines human rights.”

Article Topics

biometric data  |  biometrics  |  commercial applications  |  data collection  |  data protection  |  data storage  |  legislation  |  privacy