Regulon — NY-A-06031 · NY A 6031 (Biometric Privacy Act)

Summary

The Biometric Privacy Act imposes obligations on private entities that possess, collect, or handle biometric identifiers (retina/iris scans, fingerprints, voiceprints, hand/face geometry scans) or biometric information. Covered entities must develop public written retention and destruction policies, provide written notice and obtain written consent before collecting biometric data, are prohibited from selling or profiting from biometric data, and must restrict disclosure to narrow exceptions. Biometric data must be stored and protected using industry-standard care and at least as protectively as other confidential information. Enforcement is exclusively through the Attorney General, with civil penalties of up to $20,000 per violation. Exemptions apply to HIPAA-covered healthcare data, financial institutions subject to Gramm-Leach-Bliley, and government contractors acting on behalf of government agencies.

Enforcement & Penalties

Enforcement Authority

Attorney General enforcement only, either upon complaint or on the AG's own initiative. The AG may bring an action or special proceeding to enjoin violations, obtain restitution, disgorgement, civil penalties, and preliminary relief. The AG has subpoena power and may compel compliance through supreme court motions. No private right of action is created. Six-year statute of limitations running from date the AG became aware of the violation.

Penalties

Civil penalties of up to $20,000 per violation. Each instance of unlawful processing is a separate violation; unlawful processing of more than one consumer's data counts as a separate violation per consumer; each provision violated counts as a separate violation. Restitution of moneys or property obtained by the violation, disgorgement of profits obtained by the violation, injunctive relief including preliminary relief, and any other relief the court deems proper. For subpoena noncompliance, civil penalty of up to $1,000 per day. Court considers nature and seriousness of misconduct, number of violations, persistence, duration, willfulness, and financial condition in assessing penalties.

Who Is Covered

"Private entity" means any individual, partnership, corporation, limited liability company, association, or other group, however organized. A private entity shall not include a state or local government agency or any court in the state, a clerk of the court, or a judge or justice thereof.

Compliance Obligations 7 obligations · click obligation ID to open requirement page

D-01 Automated Processing Rights & Data Controls · D-01.8 · Deployer · Biometrics

Gen. Bus. Law § 676-b(2)(a)-(c)

Plain Language

Before collecting any biometric identifier or biometric information, a private entity must provide written notice to the individual (or their legal representative) that biometric data is being collected, disclose the specific purpose and duration of collection/storage/use, and obtain a written release (informed written consent) from the individual. All three steps must be completed before any collection occurs. In the employment context, the written release may be executed as a condition of employment. This is a strict pre-collection consent requirement — there is no exception for publicly available data or implied consent.

Statutory Text

2. No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first: (a) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (b) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (c) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.

Other · Deployer · Biometrics

Gen. Bus. Law § 676-b(1)

Plain Language

Any private entity that possesses biometric identifiers or biometric information must create a publicly available written policy that establishes a retention schedule and guidelines for permanent destruction. Biometric data must be destroyed within 60 days of when the permissible purpose is satisfied, or within three years of the individual's last interaction with the entity — whichever comes first. The entity must actually follow its own retention and destruction schedule unless compelled by a valid warrant or subpoena. This is both a policy-creation obligation and an ongoing operational compliance obligation.

Statutory Text

1. A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information within a reasonable time, but in no event later than sixty days, after it is no longer necessary to maintain for the permissible purpose or purposes identified in the notice or for which the individual provided valid authorization or within three years of the individual's last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.

Other · Deployer · Biometrics

Gen. Bus. Law § 676-b(3)

Plain Language

Private entities are categorically prohibited from selling, leasing, trading, or otherwise profiting from any person's biometric identifiers or biometric information. This is an absolute prohibition with no exceptions — there is no consent override or business-purpose exception. Even if a person consented to collection, the entity cannot monetize the data through sale or trade.

Statutory Text

3. No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.

Other · Deployer · Biometrics

Gen. Bus. Law § 676-b(4)(a)-(d)

Plain Language

Private entities may not disclose, redisclose, or disseminate biometric identifiers or biometric information except under four narrow circumstances: (1) the individual or their legal representative consents; (2) the disclosure completes a financial transaction the individual requested or authorized; (3) the disclosure is required by law; or (4) the disclosure is compelled by a valid warrant or subpoena. Outside these four exceptions, any sharing of biometric data with third parties is prohibited. Note that this is narrower than many data-sharing provisions — there is no 'service provider' or 'business purpose' exception.

Statutory Text

4. No private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person's or a customer's biometric identifier or biometric information unless: (a) the subject of the biometric identifier or biometric information or the subject's legally authorized representative consents to the disclosure or redisclosure; (b) the disclosure or redisclosure completes a financial transaction requested or authorized by the subject of the biometric identifier or the biometric information or the subject's legally authorized representative; (c) the disclosure or redisclosure is required by federal, state or local law or municipal ordinance; or (d) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

Other · Deployer · Biometrics

Gen. Bus. Law § 676-b(5)(a)-(b)

Plain Language

Private entities must protect biometric data at two simultaneous standards: (1) using the reasonable standard of care within the entity's industry for storage, transmission, and disclosure protection; and (2) at a level at least as protective as the entity's treatment of other confidential and sensitive information (such as SSNs, account numbers, and PINs). The entity must meet both thresholds — the industry standard and the internal-comparator standard. If the entity already protects SSNs with encryption, biometric data must receive at least the same level of protection.

Statutory Text

5. A private entity in possession of a biometric identifier or biometric information shall: (a) store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity's industry; and (b) store, transmit, and protect from disclosure all biometric identifiers and biometric information in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information.

Other · Biometrics

Gen. Bus. Law § 676-c(1)-(6)

Plain Language

This provision establishes the Attorney General as the sole enforcement authority for the Biometric Privacy Act. The AG may bring enforcement actions upon complaint or on its own initiative, with remedies including injunctive relief, restitution, disgorgement, and civil penalties of up to $20,000 per violation. Each instance of unlawful processing per consumer per provision counts as a separate violation. The AG has subpoena authority with penalties for noncompliance. This provision creates no new compliance obligation for private entities — it is an enforcement mechanism.

Statutory Text

1.(a) The attorney general is authorized and empowered to adopt, promulgate, amend and rescind suitable rules and regulations to carry out the provisions of this article, including rules governing the form and content of any disclosures or communications required by this article. (b) Whenever it appears to the attorney general, either upon complaint or otherwise, that any person or persons has engaged in or is about to engage in any of the acts or practices stated to be unlawful under this article, the attorney general may bring an action or special proceeding in the name and on behalf of the people of the state of New York to enjoin any violation of this article, to obtain restitution of any moneys or property obtained directly or indirectly by any such violation, to obtain disgorgement of any profits obtained directly or indirectly by any such violation, to obtain civil penalties of not more than twenty thousand dollars per violation, and to obtain any such other and further relief as the court may deem proper, including preliminary relief. (c) Each instance of unlawful processing counts as a separate violation. Unlawful processing of the personal data of more than one consumer counts as a separate violation as to each consumer. Each provision of this article that is violated counts as a separate violation. (d) In assessing the amount of penalties, the court must consider anyone or more of the relevant circumstances presented by any of the parties, including, but not limited to, the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the violator's misconduct, and the violator's financial condition. 2. Any action or special proceeding brought by the attorney general pursuant to this section must be commenced within six years of the date on which the attorney general became aware of the violation. 3. In connection with any proposed action or special proceeding under this section, the attorney general is authorized to take proof and make a determination of the relevant facts, and to issue subpoenas in accordance with the civil practice law and rules. The attorney general may also require such other data and information as the attorney general may deem relevant and may require written responses to questions under oath. Such power of subpoena and examination shall not abate or terminate by reason of any action or special proceeding brought by the attorney general under this article. 4. Any person, within or outside the state, who the attorney general believes may be in possession, custody, or control of any books, papers, or other things, or may have information, relevant to acts or practices stated to be unlawful in this article is subject to the service of a subpoena issued by the attorney general pursuant to this section. Service may be made in any manner that is authorized for service of a subpoena or a summons by the state in which service is made. 5.(a) Failure to comply with a subpoena issued pursuant to this section without reasonable cause tolls the applicable statutes of limitations in any action or special proceeding brought by the attorney general against the noncompliant person that arises out of the attorney general's investigation. (b) If a person fails to comply with a subpoena issued pursuant to this section, the attorney general may move in the supreme court to compel compliance. If the court finds that the subpoena was authorized, it shall order compliance and may impose a civil penalty of up to one thousand dollars per day of noncompliance. (c) Such tolling and civil penalty shall be in addition to any other penalties or remedies provided by law for noncompliance with a subpoena. 6. This section shall apply to all acts declared to be unlawful under this article, whether or not subject to any other law of this state, and shall not supersede, amend or repeal any other law of this state under which the attorney general is authorized to take any action or conduct any inquiry.

Other · Biometrics

Gen. Bus. Law § 676-d(1)-(4)

Plain Language

This section contains four savings and exemption clauses: (1) the Act does not affect court proceedings or discovery of biometric data; (2) the Act does not conflict with HIPAA; (3) financial institutions subject to Gramm-Leach-Bliley Title V are entirely exempt; and (4) contractors and subcontractors working for state or local government agencies are exempt when acting in that capacity. These provisions narrow the statute's scope but create no affirmative compliance obligation.

Statutory Text

1. Nothing in this article shall be construed to impact the admission or discovery of biometric identifiers and biometric information in any action of any kind in any court, or before any tribunal, board, agency, or person. 2. Nothing in this article shall be construed to conflict with the federal Health Insurance Portability and Accountability Act of 1996. 3. Nothing in the article shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999. 4. Nothing in this article shall be construed to apply to a contractor, subcontractor, or agent of a state agency of local government when working for that state agency of local government.