Proposed Biometric Privacy Law with Private Right of Action Introduced in New York
A dedicated biometric privacy law has been introduced by legislators in the New York State Assembly. The bill, titled the Biometric Privacy Act, would apply to private entities that collect, capture, purchase, receive through trade, or otherwise obtain biometric identifiers or biometric information of persons or customers. Biometric identifiers are defined in the bill as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Biometric information is defined as "any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual." Prior to collecting or receiving such information, private entities would be required to:
- inform the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
- inform the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
- receive a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.
Private entities are defined in the bill as "any individual, partnership, corporation, limited liability company, association, or other group," but does not include state or local government agencies, courts, court clerks, and judges.
Importantly, the bill provides for a private right of action, with statutory damages of $1,000 for negligent violations, and $5,000 for reckless violations.
The proposed New York Biometric Privacy Act is very similar to the Illinois Biometric Privacy Act (BIPA) – currently the country’s only biometric privacy law with a private right of action –which has spurred hundreds of class action lawsuits. It also joins the already pending New York It’s Your Data Act, a more comprehensive privacy law that was introduced in the New York State legislature last year.