New York City’s New Biometric Privacy Law Goes Into Effect July 9, 2021

Seyfarth Shaw LLP

Seyfarth Synopsis: New York City’s new biometric privacy ordinance creates a private right of action for individuals that could subject local businesses to potentially millions of dollars in liability.  Employers who do business in New York City should carefully review this new ordinance as well as any technology they be using that has the potential to collect biometric information.  

As Seyfarth previously blogged, on January 1, 2021, New York City passed a new biometric privacy ordinance.  The ordinance, found here, goes into effect on July 9, 2021.

Overview Of New York City’s Ordinance

The ordinance places new obligations on businesses to notify customers and potential customers if they collect biometric information.  It holds that “[a]ny commercial establishment” that collects “biometric identifier information” from “customers” must disclose such collection “by placing a clear and conspicuous sign near all of the commercial establishment’s customer entrances notifying customers in plain, simple language” that customers’ biometric information is being collected.  A “commercial establishment” is a place of entertainment, a retail store, or a food or drink establishment and a “customer” is a purchaser or lessee, or a prospective purchaser or lessee, of goods or services from a commercial establishment.

The ordinance further makes it “unlawful to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information.”

The law provides that individuals “aggrieved by” a violation of the ordinance may file a private right of action, but places some conditions on this right.

If the individual alleges the business collected their biometric information without making the required disclosures, the individual can only initiate a private action if they first provide written notice to the business of their intent to sue and provide the business 30 days to cure the violation by placing clear and conspicuous notice at their establishment.  If the business does not cure within 30 days, the individual may sue and recover $500 for “each” violation.

If the individual alleges the business shared their biometric information in exchange for something of value or otherwise profited from the “transaction,” then the individual may sue without any prior notice to the business.  The individual may recover $500 for “each” negligent violation of this section and may recover $5,000 for “each” intentional or reckless violation of this section.

Implications For Companies

While the ordinance appears to be straight forward, there are potential areas for expansive interpretation of the law.  For starters, the ordinance’s “aggrieved by” language may permit civil actions over small, technical violations.  Illinois’ Biometric Information Privacy Act (“BIPA”) also limits the private right of action to individuals “aggrieved by” a violation of that Act.  Yet, the Illinois Supreme Court has held that even allegations of mere technical violations of BIPA are sufficient for an individual to be “aggrieved by” a violation.

Furthermore, while the ordinance provides businesses an opportunity to cure, this opportunity  only applies if the individual limits their allegation to the improper collection of biometric information.  If the individual alleges that the business also “shared” the biometric information for “anything of value,” then no notice is required before an individual can assert a claim.  In Illinois, most (if not all) plaintiffs routinely allege both improper collection and improper dissemination as a matter of course.  Accordingly, the opportunity to cure may not prevent many of these actions from ultimately being filed.


Businesses in New York City should be mindful of this new ordinance and act accordingly.  

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Seyfarth Shaw LLP | Attorney Advertising

Written by:

Seyfarth Shaw LLP

Seyfarth Shaw LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.