Int. No. 1170-A

By Council Members Torres, Rosenthal, Rivera, Moya, Rose, Cornegy, Louis, Gibson, Kallos, Menchaca, Ayala and Barron

A Local Law to amend the administrative code of the city of New York, in relation to requiring businesses to notify customers of the use of biometric identifier technology and prohibiting the sale of biometric identifier information

Be it enacted by the Council as follows:

Section 1. Title 22 of the administrative code of the city of New York is amended by adding a new chapter 12 to read as follows:

CHAPTER 12

BIOMETRIC IDENTIFIER INFORMATION

§ 22-1201 Definitions.

§ 22-1202 Collection, use, and retention of biometric identifier information.

§ 22-1203 Private right of action.

§ 22-1204 Applicability.

§ 22-1205 Outreach and education.

§ 22-1201 Definitions. As used in this chapter, the following terms have the following meanings:

Biometric identifier information. The term “biometric identifier information” means a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.

Commercial establishment. The term “commercial establishment” means a place of entertainment, a retail store, or a food and drink establishment.

Consumer commodity.  The term “consumer commodity” means any article, good, merchandise, product or commodity of any kind or class produced, distributed or offered for retail sale for consumption by individuals, or for personal, household or family purposes.

Customer. The term “customer” means a purchaser or lessee, or a prospective purchaser or lessee, of goods or services from a commercial establishment.

 Financial institution. The term “financial institution” means a bank, trust company, national bank, savings bank, federal mutual savings bank, savings and loan association, federal savings and loan association, federal mutual savings and loan association, credit union, federal credit union, branch of a foreign banking corporation, public pension fund, retirement system, securities broker, securities dealer or securities firm, but does not include a commercial establishment whose primary business is the retail sale of goods and services to customers and provides limited financial services such as the issuance of credit cards or in-store financing to customers.

Food and drink establishment. The term “food and drink establishment” means an establishment that gives or offers for sale food or beverages to the public for consumption or use on or off the premises, or on or off a pushcart, stand or vehicle.

Place of entertainment. The term “place of entertainment” means any privately or publicly owned and operated entertainment facility, such as a theater, stadium, arena, racetrack, museum, amusement park, observatory, or other place where attractions, performances, concerts, exhibits, athletic games or contests are held.

Retail store. The term “retail store” means an establishment wherein consumer commodities are sold, displayed or offered for sale, or where services are provided to consumers at retail.

          § 22-1202 Collection, use, and retention of biometric identifier information. a. Any commercial establishment that collects, retains, converts, stores or shares biometric identifier information of customers must disclose such collection, retention, conversion, storage or sharing, as applicable, by placing a clear and conspicuous sign near all of the commercial establishment’s customer entrances notifying customers in plain, simple language, in a form and manner prescribed by the commissioner of consumer and worker protection by rule, that customers’ biometric identifier information is being collected, retained, converted, stored or shared, as applicable.

b. It shall be unlawful to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information.

§ 22-1203 Private right of action. A person who is aggrieved by a violation of this chapter may commence an action in a court of competent jurisdiction on his or her own behalf against an offending party. At least 30 days prior to initiating any action against a commercial establishment for a violation of subdivision a of section 22-1202, the aggrieved person shall provide written notice. to the commercial establishment setting forth such person’s allegation. If, within 30 days, the commercial establishment cures the violation and provides the aggrieved person an express written statement that the violation has been cured and that no further violations shall occur, no action may be initiated against the commercial establishment for such violation. If a commercial establishment continues to violate subdivision a of section 22-1202, the aggrieved person may initiate an action against such establishment. No prior written notice is required for actions alleging a violation of subdivision b of section 22-1202. A prevailing party may recover:

1. For each violation of subdivision a of section 22-1202, damages of $500;

2. For each negligent violation of subdivision b of section 22-1202, damages of $500;

3. For each intentional or reckless violation of subdivision b of section 22-1202, damages of $5,000;

4. Reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses; and

5. Other relief, including an injunction, as the court may deem appropriate.

§ 22-1204 Applicability. a. Nothing in this chapter shall apply to the collection, storage, sharing or use of biometric identifier information by government agencies, employees or agents.

b. The disclosure required by subdivision a of section 22-1202 shall not apply to:

1. Financial institutions.

2. Biometric identifier information collected through photographs or video recordings, if: (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold or leased to third-parties other than law enforcement agencies.

§ 22-1205 Outreach and education. The chief privacy officer shall conduct or facilitate, with any other relevant agency or office, outreach and education efforts, through guidance posted on city websites or through such other means as may be feasible, to inform commercial establishments likely to be affected by this chapter about its requirements.

§ 2. This local law takes effect 180 days after it becomes law.

SIL/BAM

LS #5625

12/2/2020