On January 6, 2021, a bipartisan group of New York legislators proposed the Biometric Privacy Act, a new law that would provide for protection of consumers' biometric information. The bill would require entities that possess biometric information or identifiers to obtain specific consumer consent for collecting, capturing, purchasing or trading such information, and would be privately-actionable as well.
Under the bill, biometric identifiers include: "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Biometric information means "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual." Entities that possess such information would need to develop written policies that are made available to the public, as well as inform consumers and receive written consent prior to the collection, capture, purchase or trade of the biometrics. That consent would have to be based on disclosures regarding the specific purpose and length of term for which the biometric identifier or information is being collected, stored and used.
Further, covered entities would need to safely store, transmit and protect the biometric identifiers or information from disclosure. The bill would also prevent an entity from selling or profiting off of the information.
The private right of action is similar to that found in Illinois's Biometric Information Privacy Act (BIPA). The bill would allow any "aggrieved" person to bring an action against an offending party The proposed bill provides for penalties of $1,000 or actual damages, whichever is greater, for negligent violations and $5,000 or actual damages, whichever is greater, for intentional or reckless violations. It also allows for recovery of reasonable attorneys' fees and costs, including expert witness fees and other litigation expenses, as well for other relief, such as an injunction.
The act would give companies a relatively short time for compliance, as it would take effect on the ninetieth day after becoming law. The bill was referred to the consumer affairs and protection committee on January 6, 2021.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.