Int. No. 217

By Council Members Hanif, Gutiérrez, Rivera, Williams, Sanchez, Louis, Marte, Ossé, Krishnan, Won, Avilés, Salaam, Bottcher, Farías, Nurse, Hudson, De La Rosa, Cabán, Brooks-Powers, Joseph, Menin, Brewer, Abreu, Stevens, Ayala, Banks and Brannan

A Local Law to amend the administrative code of the city of New York in relation to prohibiting places or providers of public accommodation from using biometric recognition technology and protecting any biometric identifier information collected

Be it enacted by the Council as follows:

Section 1. Section 22-1201 of the administrative code of the city of New York, as added by local law number 3 for the year 2021, is amended by repealing definitions for the terms “commercial establishment,” “consumer commodity,” “financial institution,” “food and drink establishment,” “place of entertainment,” and “retail store,” amending the definition for the term “biometric identifier information,” and adding definitions for the terms “biometric recognition technology,” and “place or provider of public accommodation,” to read as follows:

Biometric identifier information. The term “biometric identifier information” means a physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, [or any other identifying characteristic] (iv) gait or movement patterns, or (v) any other similar identifying characteristic that can be used alone or in combination with each other, or with other information, to establish individual identity.

Biometric recognition technology. The term “biometric recognition technology” means a process or system that captures or assists in the capture of biometric identifier information of a person or persons in conjunction with any automated process or system that verifies or identifies, or assists in verifying or identifying, a person or persons based on such biometric identifier information.

[Commercial establishment. The term “commercial establishment” means a place of entertainment, a retail store, or a food and drink establishment.

Consumer commodity.  The term “consumer commodity” means any article, good, merchandise, product or commodity of any kind or class produced, distributed or offered for retail sale for consumption by individuals, or for personal, household or family purposes.]

Customer. The term “customer” means a purchaser or lessee, or a prospective purchaser or lessee, of goods or services from a commercial establishment.

                     [Financial institution. The term “financial institution” means a bank, trust company, national bank, savings bank, federal mutual savings bank, savings and loan association, federal savings and loan association, federal mutual savings and loan association, credit union, federal credit union, branch of a foreign banking corporation, public pension fund, retirement system, securities broker, securities dealer or securities firm, but does not include a commercial establishment whose primary business is the retail sale of goods and services to customers and provides limited financial services such as the issuance of credit cards or in-store financing to customers.

Food and drink establishment. The term “food and drink establishment” means an establishment that gives or offers for sale food or beverages to the public for consumption or use on or off the premises, or on or off a pushcart, stand or vehicle.

Place of entertainment. The term “place of entertainment” means any privately or publicly owned and operated entertainment facility, such as a theater, stadium, arena, racetrack, museum, amusement park, observatory, or other place where attractions, performances, concerts, exhibits, athletic games or contests are held.

Retail store. The term “retail store” means an establishment wherein consumer commodities are sold, displayed or offered for sale, or where services are provided to consumers at retail.]

Place or provider of public accommodation. The term "place or provider of public accommodation" shall have the same meaning as in section 8-102.

§2. Section 22-1202 of the administrative code of the city of New York, as added by local law number 3 for the year 2021, is amended to read as follows:

          § 22-1202 Collection, use, and retention of biometric identifier information and use of biometric recognition technology. a. Any [commercial establishment] place or provider of public accommodation that collects, retains, converts, stores, [or] shares, or otherwise obtains biometric identifier information of customers must disclose such collection, retention, conversion, storage, [or] sharing, or obtaining of biometric identifier information, as applicable, by placing a clear and conspicuous sign near all of the [commercial establishment’s] place or provider of public accommodation’s customer entrances notifying customers in plain, simple language, in a form and manner prescribed by the commissioner of consumer and worker protection by rule, that customers’ biometric identifier information is being collected, retained, converted, stored or shared, as applicable and shall be required to get the written consent of such customer in advance of any collection.

b. It shall be unlawful for any place or provider of public accommodation to use any biometric recognition technology to verify or identify a customer.

c. It shall be unlawful to disclose, sell, lease, trade, or share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information with any third party.

d. Any place or provider of public accommodation in possession of biometric identifier information shall develop a written policy, to be made available to the public upon request, that shall include a retention schedule and guidelines for the permanent destruction of biometric identifier information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied, or within two years of the individual's last interaction with the place or provider of public accommodation, whichever occurs first.

e. Any place or provider of public accommodation that collects, retains, converts, stores, shares, or otherwise obtains biometric identifier information of any person shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the biometric identifier information including, but not limited to: conducting assessments of risks in network and software design; conducting assessments of risks in information processing, transmission and storage; making reasonable efforts to detect, prevent and respond to attacks or system failures; regularly testing and monitoring the effectiveness of key controls, systems and procedures; and implementing protections against unauthorized access to or use of biometric identifier information during or after the collection, transportation and destruction or disposal of the information.

f. Any place or provider of public accommodation that collects, retains, converts, stores, shares, or otherwise obtains biometric identifier information of customers shall provide the opportunity to any such customer to request that such place or provider of public accommodation erase such biometric identifier information of such customer.

g. Any place or provider of public accommodation that collects, retains, converts, stores, shares, or otherwise obtains biometric identifier information shall not refuse service to any customer because the customer exercised rights pursuant to this section, including, but not limited to, by denying goods or services to the consumer; charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; or providing a different level of quality of goods or services to the customer.

§3. Section 22-1203 of the administrative code of the city of New York, as added by local law number 3 for the year 2021, is amended to read as follows:

§ 22-1203 Private right of action. A person who is aggrieved by a violation of this chapter may commence an action in a court of competent jurisdiction on [his or her] such person’s own behalf against an offending party. At least 30 days prior to initiating any action against a [commercial establishment] place or provider of public accommodation for a violation of subdivision a of section 22-1202, the aggrieved person shall provide written notice[.] to the [commercial establishment] place or provider of public accommodation setting forth such person’s allegation. If, within 30 days, the [commercial establishment] place or provider of public accommodation cures the violation and provides the aggrieved person an express written statement that the violation has been cured and that no further violations shall occur, no action may be initiated against the [commercial establishment] place or provider of public accommodation for such violation. If a [commercial establishment] place or provider of public accommodation continues to violate subdivision a of section 22-1202, the aggrieved person may initiate an action against such [establishment] place or provider. No prior written notice is required for actions alleging a violation of subdivision b or c of section 22-1202. A prevailing party may recover:

1.                     For each violation of subdivision a of section 22-1202, damages of $500;

2.                     For each negligent violation of subdivision b or c of section 22-1202, damages of $500;

3.                     For each intentional or reckless violation of subdivision b or c of section 22-1202, damages of $5,000;

4.                     Reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses; and

5.                     Other relief, including an injunction, as the court may deem appropriate.

§4. Section 22-1204 of the administrative code of the city of New York, as added by local law number 3 for the year 2021, is amended to read as follows:

§ 22-1204 Applicability. a. Nothing in this chapter shall apply to the collection, storage, sharing or use of biometric identifier information by government agencies, employees or agents.

b. The [disclosure required] requirements of subdivision [a] e of section 22-1202 shall not apply to[:]

[1. Financial institutions.

2. Biometric identifier information collected through photographs or video recordings, if: (i) the images or videos collected are not analyzed by software or applications that identify, or that assist with the identification of, individuals based on physiological or biological characteristics, and (ii) the images or video are not shared with, sold or leased to third-parties other than law enforcement agencies.] any place or provider of public accommodation that is subject to, and in compliance with, any of the following data security requirements: (i) regulations promulgated pursuant to title v of the financial services modernization act of 1999; (ii) regulations implementing the health insurance portability and accountability act of 1996 and the health information technology for economic and clinical health act of 2009; and (iii) part 500 of title 23 of the New York codes, rules and regulations, regarding cybersecurity.

c. Where the specific services sought by a customer from a place or provider of public accommodation cannot be performed without the collecting and processing of biometric identifier information, the agreement by the customer to engage such services shall be deemed consent for the purposes of subdivision a of section 22-1202. This exemption shall not apply to any security or sale system that is ancillary to the specific services sought by the customer.

§ 5. This local law takes effect 180 days after it becomes law, provided that where the provisions of section 22-1202 of the administrative code of the city of New York, as added by section two of this local law, cannot be applied consistently with currently applicable contracts, such provisions shall only apply with respect to contracts entered into or renewed after the effective date of this local law.

Session 13

LS #9052, 10415

1/21/2024

Session 12

IB

LS #9052, 10415

4/11/2023