Law / United States / 
New York
New York City Biometric Identifier Information Law
N.Y.C. Admin. Code §§ 22-1201 to 22-1205 (Local Law 2021/003)
In force since .
A personal data rule binding private bodies.
- Audit expectation
- none
What it requires
- If you are a commercial establishment in New York City collecting, retaining, converting, storing, or sharing biometric identifier information, including from scraped or captured photos processed into a face-geometry scan, post clear and conspicuous signage disclosing that practice.NIST AI RMFMEASURE 2.8
- Never sell, lease, trade, or otherwise profit from biometric identifier information collected from a New York City commercial establishment's customers; this ban carries no notice-and-cure period before a lawsuit.NIST AI RMFMAP 3.3
- An aggrieved person can sue you directly under this ordinance's private right of action; a signage violation gives you 30 days to cure before suit, but a sale or profit violation does not.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a company that extracts face geometry from photographs it scraped, and so has no customer entrance, collect biometric identifier information "of customers" under N.Y.C. Admin. Code section 22-1202(a)?
What it makes you log
Logging duty
Chapter 12 of Title 22 requires a commercial establishment to post a sign at its customer entrances disclosing its collection of biometric identifier information (section 22-1202(a)), bars selling or otherwise profiting from that information (section 22-1202(b)) and gives an aggrieved person a private right of action (section 22-1203). It does not apply to government agencies (section 22-1204). None of these provisions requires an establishment to make, keep or produce a record; the outreach duty in section 22-1205 falls on the chief privacy officer.
- Kind
- None
- As of
What this law does
The ordinance applies only to a commercial establishment, a place of entertainment, retail store, or food and drink establishment. Section 22-1202(a) requires clear, conspicuous signage disclosing the collection, retention, conversion, storage, or sharing of biometric identifier information, defined to include a retina or iris scan, fingerprint, voiceprint, or hand or face geometry scan, or other identifying characteristic.
Section 22-1202(b) flatly bans selling, leasing, trading, sharing in exchange for anything of value, or otherwise profiting from biometric identifier information.
Section 22-1203 creates a private right of action: an aggrieved person may sue, with a 30-day notice-and-cure period required before suing over a signage violation but no notice-and-cure required for a sale or profit violation under section 22-1202(b), and a prevailing party may recover statutory damages, attorneys' fees and costs, and injunctive relief.
It is a municipal law, narrower in scope than a statewide biometric statute because it is limited to commercial establishments' customer-facing collection and does not apply outside New York City, and its private right of action is stated in the code text. Section 22-1204 exempts government agencies entirely, and exempts financial institutions and non-analyzed photo or video capture from the disclosure duty specifically.
When LexLint raises it
When your app profile says your app crawls the web, processes biometric data or processes voice recordings.
Back to the example · Lint your app
Page updated .