New York City, a global hub for business and technology, has taken a significant step in safeguarding the privacy of its residents with the introduction of the Biometric Identifier Information Law. This law, also known as Local Law 56, aims to regulate the collection and use of biometric data within the city.
The law enforces strict requirements for businesses and provides remedies for consumers to take on establishments that violate them.
What biometric data is covered?
New York City’s law applies when a business is using “a physiological or biological characteristic” to identify people. These traits can include:
- a retina or iris scan,
- a fingerprint or voiceprint,
- a scan of hand or face geometry, or
- any other identifying characteristic.1
(A) Notice Requirement for “Commercial Establishments”
The Biometric Identifier Information Law applies to every “commercial establishment” within New York City. It covers “a place of entertainment, a retail store, or a food and drink establishment.”2 (Query whether it includes a digital platform that is a place of entertainment, based in New York?)
The law encompasses businesses that collect, store, or share biometric data from customers. This includes but is not limited to:
- Retail Stores: Any physical store that uses facial recognition technology or other biometric methods to identify and track customers.
- Hospitality Industry: Hotels and restaurants that use biometric data for guest check-ins.
- Entertainment Venues: Stadiums, theaters, and concert halls that implement biometric access control systems.
- Fitness Centers: Gyms and fitness studios using biometric data for member authentication.
Businesses must place a “clear and conspicuous sign” by the establishment's “entrances notifying customers in plain, simple language … that customers' biometric identifier information is being collected, retained, converted, stored or shared”.3
(B) Transacting in Biometric Data
The prohibition also bars business from transacting in biometrics data: “It shall be unlawful to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information.”4
For example, in Gross v. Madison Square Garden, the plaintiffs alleged that Madison Square Garden (home of the NBA's Knicks and the NHL's Rangers) use biometric data to deploy "facial recognition technology to selectively remove attorneys and their clients who have commenced litigation against MSG from its venues, thus profiting by deterring litigation and reducing its litigation expenses." On this basis, a Magistrate Judge for the Southern District of New York recommended that MSG's motion to dismiss be denied.5 (The decision is currently on appeal to the District Judge.)
Remedies
If a business fails to comply with (a) the clear signage requirements, an individual can notify the business and then sue if the business still hasn’t complied after 30 days. And if the business is (b) profiting from the biometric data, the customer can sue without the 30-day waiting period. Either way, the customer may be able to recover statutory damages and attorneys’ fees, and gain an injunction ordering the business to conform with the law.6
Conclusion
New York City's Biometric Identifier Information Law is a significant step towards protecting the privacy and data security of its residents.
1 N.Y.C. Admin. Code § 22-1201.
2 N.Y.C. Admin. Code § 22-1201.
3 N.Y.C. Admin. Code § 22-1202(a).
4 N.Y.C. Admin. Code § 22-1202(b).
5 Gross v. Madison Square Garden Ent. Corp., No. 23 Civ. 3380, 2024 WL 103235, at *1, *5 (S.D.N.Y. Jan. 9, 2024).
6 N.Y.C. Admin. Code § 22-1203.
[View source.]
