Processes biometric data, in New York

N.Y. Gen. Bus. Law § 899-aa · Read the law's page

• Disclose a breach of the security of your system to each affected New York resident in the most expedient time possible and without unreasonable delay, and no later than 30 days after discovering the breach.
• Notify the New York Attorney General, the Department of State, and the Division of State Police of the breach, and notify each nationwide consumer reporting agency if you are notifying more than 5,000 New York residents at once.
• If you are a covered entity as defined in 23 NYCRR 500.1, also notify the New York Department of Financial Services of the breach in compliance with 23 NYCRR 500.17 (Section 899-aa(8)(a)).
• If you maintain computerized data that includes private information you do not own, notify the owner or licensee of any breach of the security of the system immediately, and in any event within 30 days following discovery, if the information was or is reasonably believed to have been accessed or acquired without valid authorization (Section 899-aa(3)).
• If you are a covered entity that must notify the Secretary of Health and Human Services of a breach under HIPAA or the HITECH Act, notify the New York Attorney General within 5 business days of notifying the Secretary (Section 899-aa(9)).
• If you decide not to notify affected persons because an exposure was an inadvertent disclosure by persons authorized to access private information that will not likely result in misuse or harm, and the incident affects over 500 New York residents, submit your written determination to the New York Attorney General within 10 days after the determination (Section 899-aa(2)(a)).
• Do not assume New York law clears a faceprint or voiceprint you extract from a recording to authenticate or ascertain identity. SHIELD's biometric-information trigger carries no recording-derived exclusion, so an extracted identifier plausibly falls within it if a later breach exposes it, though this reading is untested in New York case law or Attorney General guidance.
• Do not treat a New York City ordinance as displaced by this section's preemption clause. SHIELD's preemption is scoped to breach notification; the separate NYC Biometric Identifier Information Law regulates capture consent and retention, a different subject.

N.Y. Gen. Bus. Law section 899-bb (Article 39-F, added by L. 2019, ch. 117 (S5575-B/A5635-B), section 4) · Read the law's page

• This binds any person or business that owns, licenses, or maintains computerized data including the private information of a New York resident; a business already a compliant regulated entity under Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or 23 NYCRR Part 500 (the New York Department of Financial Services cybersecurity regulation for a financial-services licensee) is deemed to comply.
• Absent that safe harbor, develop, implement, and maintain a data security program with reasonable administrative safeguards (a designated coordinator, a risk assessment, employee training, vetted service-provider contracts, and periodic adjustment), reasonable technical safeguards (assessing network and software design risk, detecting and responding to attacks, and testing controls), and reasonable physical safeguards (securing storage and disposal and limiting access during and after collection).
• A small business, fewer than 50 employees, under $3,000,000 in gross annual revenue in each of the last three fiscal years, or under $5,000,000 in year-end total assets, may scale its program's administrative, technical, and physical safeguards to its own size, complexity, and the sensitivity of the personal information it collects.
• There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of General Business Law 349, seeking injunctive relief and a civil penalty of up to $5,000 per violation under General Business Law 350-d.

N.Y.C. Admin. Code §§ 22-1201 to 22-1205 (Local Law 2021/003) · Read the law's page

• If you are a commercial establishment in New York City collecting, retaining, converting, storing, or sharing biometric identifier information, including from scraped or captured photos processed into a face-geometry scan, post clear and conspicuous signage disclosing that practice.
• Never sell, lease, trade, or otherwise profit from biometric identifier information collected from a New York City commercial establishment's customers; this ban carries no notice-and-cure period before a lawsuit.
• An aggrieved person can sue you directly under this ordinance's private right of action; a signage violation gives you 30 days to cure before suit, but a sale or profit violation does not.