Law / United States / New York / New York City
Biometric Identifier Information Law
N.Y.C. Admin. Code tit. 22, ch. 12, secs. 22-1201 to 22-1205 (Local Law 3 of 2021)
In force since .
A biometric privacy rule binding private bodies.
- Audit expectation
- none
What it requires
- A commercial establishment operating in New York City that collects, retains, converts, stores, or shares a customer's biometric identifier information must post a clear and conspicuous sign at every customer entrance disclosing that practice, and must never sell, lease, trade, or otherwise profit from transacting in biometric identifier information regardless of signage.
These lines are LexLint's reading of the law's text. Also read by: New York City Department of Consumer and Worker Protection (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
Section 22-1203 lets a prevailing party recover $500 for each violation of the signage duty in section 22-1202(a), $500 for each negligent violation of the sale ban in section 22-1202(b) and $5,000 for each intentional or reckless violation of the sale ban, plus attorneys' fees and costs. The amounts are per violation, not per person. A person who sues over the signage duty must first give written notice 30 days ahead, and no action lies if the establishment cures within 30 days.
- As of
- Currency
- USD
- Per person reckless
- 5,000
- Per person negligent
- 500
Who enforces it
Enforcement body
Aggrieved persons, by a private action under section 22-1203. The chapter names no city agency to enforce it and sets no civil penalty; the Commissioner of Consumer and Worker Protection prescribes the form and manner of the sign by rule.
Settledness
- As of
- Guidance link
- https://rules.cityofnewyork.us/wp-content/uploads/2021/07/NOA_DCWP-Rule-re-Biometric-Data-Collection.pdf
- Guidance body
- New York City Department of Consumer and Worker Protection
- Open questions
- Does a commercial establishment 'profit from the transaction of biometric identifier information' under section 22-1202(b) when it pays a vendor to run a biometric system on its customers, or only when it receives something of value for the information itself?
What it reaches
What it reaches
duty
Obligation class
Biometric, Disclosure, Prohibition
Applicability criteria
This is the definition of commercial establishment in section 22-1201. Section 22-1204 exempts government agencies, employees and agents, and exempts financial institutions from the sign requirement.
- As of
- Combinator
- All of
- Criteria
- a place of entertainment, a retail store, or a food and drink establishment
What it makes you log
Logging duty
The chapter requires a sign at customer entrances disclosing that biometric identifier information is collected, retained, converted, stored or shared, and bars selling, leasing, trading or otherwise profiting from it. A sign is a notice to customers, not a record; the express written statement that a violation has been cured, given to an aggrieved person under section 22-1203, is a reply to a complainant; and section 22-1205 only has the chief privacy officer run outreach. The chapter imposes no duty to keep a log or record, names no audit and gives no party a right to a record. It states no territorial clause: it binds a commercial establishment with customer entrances and, in section 22-1204(a), excludes government agencies, employees and agents.
- Kind
- None
- As of
What this law does
A commercial establishment, a place of entertainment, retail store, or food and drink establishment, that collects, retains, converts, stores, or shares customers' biometric identifier information must post a clear and conspicuous sign at every customer entrance disclosing that practice.
Separately, it is unlawful for any commercial establishment to sell, lease, trade, share in exchange for anything of value, or otherwise profit from the transaction of biometric identifier information, and the law does not apply to a government agency, employee, or agent.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .