New York City Council Header
File #: Int 1170-2018    Version: * Name: Requiring businesses to notify customers of the use of biometric identifier technology.
Type: Introduction Status: Laid Over in Committee
Committee: Committee on Consumer Affairs and Business Licensing
On agenda: 10/17/2018
Enactment date: Law number:
Title: A Local Law to amend the administrative code of the city of New York, in relation to requiring businesses to notify customers of the use of biometric identifier technology
Sponsors: Ritchie J. Torres, Rafael L. Espinal, Jr., Helen K. Rosenthal, Carlina Rivera , Francisco P. Moya, Deborah L. Rose, Robert E. Cornegy, Jr., Rory I. Lancman, Farah N. Louis, Vanessa L. Gibson
Council Member Sponsors: 10
Summary: This bill would require businesses to notify customers if they are collecting biometric identifier information, such as scans of their faces, irises, or fingerprints, and if so, the length of time the information is retained, any relevant privacy policy, and whether the information is shared with third-parties.
Indexes: Agency Rule-making Required
Attachments: 1. Summary of Int. No. 1170, 2. Int. No. 1170, 3. October 17, 2018 - Stated Meeting Agenda with Links to Files, 4. Committee Report 10/7/19, 5. Hearing Testimony 10/7/19, 6. Hearing Testimony 10/7/19 additional, 7. Hearing Transcript 10/7/19
Date Ver.Prime SponsorAction ByActionResultAction DetailsMeeting DetailsMultimedia
10/7/2019*Ritchie J. Torres Committee on Housing and Buildings Laid Over by Committee  Action details Meeting details Not available
10/7/2019*Ritchie J. Torres Committee on Housing and Buildings Hearing Held by Committee  Action details Meeting details Not available
10/7/2019*Ritchie J. Torres Committee on Technology Laid Over by Committee  Action details Meeting details Not available
10/7/2019*Ritchie J. Torres Committee on Technology Hearing Held by Committee  Action details Meeting details Not available
10/7/2019*Ritchie J. Torres Committee on Consumer Affairs and Business Licensing Laid Over by Committee  Action details Meeting details Not available
10/7/2019*Ritchie J. Torres Committee on Consumer Affairs and Business Licensing Hearing Held by Committee  Action details Meeting details Not available
10/17/2018*Ritchie J. Torres City Council Referred to Comm by Council  Action details Meeting details Not available
10/17/2018*Ritchie J. Torres City Council Introduced by Council  Action details Meeting details Not available

Int. No. 1170

 

By Council Members Torres, Espinal, Rosenthal, Rivera, Moya, Rose, Cornegy, Lancman, Louis and Gibson

 

A Local Law to amend the administrative code of the city of New York, in relation to requiring businesses to notify customers of the use of biometric identifier technology

 

Be it enacted by the Council as follows:

 

Section 1. Chapter 5 of title 20 of the administrative code of the city of New York is amended by adding a new subchapter 20 to read as follows:

SUBCHAPTER 20

BIOMETRIC IDENTIFIER INFORMATION

§ 20-828 Definitions.

§ 20-829 Disclosure of collection of biometric identifier information.

§ 20-830 Enforcement.

§ 20-831 Private right of action.

§ 20-832 Exceptions.

§ 20-833 Outreach and education.

 

§ 20-828 Definitions. As used in this subchapter, the following terms have the following meanings:

Biometric identifier information. The term “biometric identifier information” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, any of which is collected, retained, converted, stored or shared to identify an individual.

Commercial establishment. The term “commercial establishment” means any premises used for the purpose of carrying on or exercising any trade, business, profession, vocation, or commercial or charitable activity, including but not limited to hospitals, places of entertainment, and food or restaurant establishments.

Customer. The term “customer” means a purchaser or lessee, or a prospective purchaser or lessee, of goods or services from a commercial establishment.

Place of entertainment. The term “place of entertainment” means any privately or publicly owned and operated entertainment facility, such as a theater, stadium, arena, racetrack, museum, amusement park, observatory, or other place where attractions, performances, concerts, exhibits, athletic games, or contests are held.

§ 20-829 Disclosure of collection of biometric identifier information. Any commercial establishment that collects, retains, converts, stores or shares biometric identifier information of customers must disclose such collection, retention, conversion, storage or sharing in the following manner:

a. By placing a clear and conspicuous sign near all of the commercial establishment’s entrances notifying in plain, simple language, in a form and manner prescribed by the commissioner by rule, that biometric identifier information is being collected, retained, converted, stored or shared; and

b. By making available online:

1. The amount of time for which the commercial establishment retains or stores biometric identifier information;

2. The kind of biometric identifier information the commercial establishment collects, retains, converts, stores or shares from its customers;

3. Any privacy policy governing, and any purpose for, the commercial establishment’s collection, retention, conversion, storage or sharing of biometric identifier information of customers, including but not limited to, any protective measures the commercial establishment utilizes to safeguard biometric identifier information; and

4. Whether the commercial establishment shares biometric identifier information with third-parties.

§ 20-830 Enforcement. Whenever the commissioner has reason to believe that a commercial establishment has violated any provision of this subchapter or any rule or regulation promulgated thereunder, the commissioner may, upon proof of violation, direct payment of a civil penalty in the amount of $500 for each day that the commercial establishment is in violation of this subchapter or the rules promulgated thereunder.

§ 20-831 Private right of action. a. Any person who biometric identifier information was collected, retained, converted, stored or shared in violation of this subchapter may commence an action in a court of competent jurisdiction on his or her own behalf against a commercial establishment that is alleged to have violated this subchapter. A prevailing party may recover for each violation:

1. Against a private entity that negligently violates a provision of this subchapter, damages of $1,000;

2. Against a private entity that intentionally or recklessly violates a provision of this subchapter, damages of $5,000;

3. Reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses; and

4. Other relief, including an injunction, as the court of competent jurisdiction may deem appropriate.

b. In any action brought pursuant to this section, the commissioner may intervene as a matter of right.

§ 20-832 Exceptions. Nothing in this subchapter shall apply to the collection, capturing, conversion, storage, sharing or use of biometric identifier information by government agencies, employees or agents.

§ 20-833 Outreach and education. The commissioner shall conduct outreach and education efforts to inform commercial establishments likely to be affected by this subchapter about its requirements.

§ 2. This local law takes effect 180 days after it becomes law; provided, however, that the commissioner of consumer affairs may promulgate rules necessary for the implementation of this local law prior to such effective date.

 

 

SIL

LS #5625

07/24/2018