Regulon — NY-S-01422 · NY S 1422 (Biometric Privacy Act)

2025-01-09 committee referral REFERRED TO CONSUMER PROTECTION

2025-05-06 REPORTED AND COMMITTED TO INTERNET AND TECHNOLOGY REPORTED AND COMMITTED TO INTERNET AND TECHNOLOGY

2026-01-07 committee referral REFERRED TO CONSUMER PROTECTION

2026-05-12 REPORTED AND COMMITTED TO INTERNET AND TECHNOLOGY REPORTED AND COMMITTED TO INTERNET AND TECHNOLOGY

2026-05-12 AMEND (T) AND RECOMMIT TO INTERNET AND TECHNOLOGY AMEND (T) AND RECOMMIT TO INTERNET AND TECHNOLOGY

2026-05-12 PRINT NUMBER 1422A PRINT NUMBER 1422A

Summary

Establishes the Biometric Privacy Act in New York, imposing obligations on private entities that possess biometric identifiers or biometric information. Requires private entities to develop and publish written retention and destruction policies, obtain written notice and consent before collecting biometric data, prohibits the sale or profiting from biometric data, restricts disclosure to enumerated exceptions, and mandates reasonable security standards. Enforcement is exclusively through the Attorney General, who may seek civil penalties of up to $20,000 per violation, injunctive relief, restitution, and disgorgement. Excludes state and local government agencies, financial institutions subject to Gramm-Leach-Bliley, government contractors acting on behalf of agencies, and HIPAA-covered health care data.

Enforcement & Penalties

Enforcement Authority

Attorney General enforcement. The Attorney General may bring an action or special proceeding upon complaint or otherwise whenever it appears that any person has engaged in or is about to engage in unlawful acts under this article. The Attorney General has rulemaking authority, subpoena power, and may compel compliance through the Supreme Court. Six-year statute of limitations from the date the Attorney General became aware of the violation. No private right of action.

Penalties

Civil penalties of up to $20,000 per violation. Each instance of unlawful processing counts as a separate violation; unlawful processing of multiple consumers' data counts as a separate violation per consumer; each provision violated counts as a separate violation. The Attorney General may also obtain injunctive relief, restitution of moneys or property obtained by violation, disgorgement of profits obtained by violation, and any other relief the court deems proper including preliminary relief. Failure to comply with an Attorney General subpoena may result in an additional civil penalty of up to $1,000 per day of noncompliance.

Who Is Covered

"Private entity" means any individual, partnership, corporation, limited liability company, association, or other group, however organized. A private entity shall not include a state or local government agency or any court in the state, a clerk of the court, or a judge or justice thereof.

Compliance Obligations 7 obligations · click obligation ID to open requirement page

D-01 Automated Processing Rights & Data Controls · D-01.8 · Deployer · Biometrics

Gen. Bus. Law § 676-b(2)(a)-(c)

Plain Language

Before collecting, capturing, purchasing, or otherwise obtaining any biometric identifier or biometric information, a private entity must provide the individual (or their authorized representative) with written notice that biometric data is being collected or stored, written notice of the specific purpose and duration for which the data will be collected, stored, and used, and must obtain a written release from the individual. All three steps — notice of collection, notice of purpose and duration, and written consent — must be completed before any collection occurs. In the employment context, a written release executed as a condition of employment satisfies the consent requirement.

Statutory Text

2. No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first: (a) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (b) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (c) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.

Other · Deployer · Biometrics

Gen. Bus. Law § 676-b(1)

Plain Language

Any private entity that possesses biometric identifiers or biometric information must create and publicly publish a written policy that establishes a retention schedule and destruction guidelines. Biometric data must be permanently destroyed within 60 days after the purpose for collection has been satisfied, or within three years of the individual's last interaction with the entity — whichever comes first. The entity must then actually comply with its own published schedule. The only exception is a valid warrant or subpoena from a court of competent jurisdiction.

Statutory Text

1. A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information within a reasonable time, but in no event later than sixty days, after it is no longer necessary to maintain for the permissible purpose or purposes identified in the notice or for which the individual provided valid authorization or within three years of the individual's last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.

Other · Deployer · Biometrics

Gen. Bus. Law § 676-b(3)

Plain Language

Private entities are categorically prohibited from selling, leasing, trading, or otherwise profiting from any biometric identifier or biometric information they possess. This is an absolute prohibition with no exceptions — there is no consent override or authorized-purpose carve-out. Even with an individual's written release, a private entity cannot monetize their biometric data.

Statutory Text

3. No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.

Other · Deployer · Biometrics

Gen. Bus. Law § 676-b(4)(a)-(d)

Plain Language

Private entities may not disclose, redisclose, or otherwise disseminate biometric identifiers or biometric information unless one of four narrow exceptions applies: (1) the individual or their authorized representative consents; (2) the disclosure completes a financial transaction the individual requested or authorized; (3) disclosure is required by law; or (4) disclosure is required by a valid court warrant or subpoena. Outside these four exceptions, all sharing of biometric data is prohibited. Note this is distinct from the sale prohibition in § 676-b(3) — this provision covers any disclosure even without profit motive.

Statutory Text

4. No private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person's or a customer's biometric identifier or biometric information unless: (a) the subject of the biometric identifier or biometric information or the subject's legally authorized representative consents to the disclosure or redisclosure; (b) the disclosure or redisclosure completes a financial transaction requested or authorized by the subject of the biometric identifier or the biometric information or the subject's legally authorized representative; (c) the disclosure or redisclosure is required by federal, state or local law or municipal ordinance; or (d) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

Other · Deployer · Biometrics

Gen. Bus. Law § 676-b(5)(a)-(b)

Plain Language

Private entities must store, transmit, and protect biometric identifiers and biometric information under two parallel standards: (1) the reasonable standard of care within their industry, and (2) at least as protectively as they treat other confidential and sensitive information such as social security numbers, account numbers, and genetic data. The entity must meet both benchmarks — the industry standard and the internal comparability test. This is a continuing obligation that applies to data at rest and in transit.

Statutory Text

5. A private entity in possession of a biometric identifier or biometric information shall: (a) store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity's industry; and (b) store, transmit, and protect from disclosure all biometric identifiers and biometric information in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information.

Other · Biometrics

Gen. Bus. Law § 676-c(1)(a)

Plain Language

The Attorney General is granted rulemaking authority to implement this article, including authority over the form and content of required disclosures and communications. This delegation of authority does not itself create a compliance obligation for private entities — future AG rules may impose additional requirements.

Statutory Text

1.(a) The attorney general is authorized and empowered to adopt, promulgate, amend and rescind suitable rules and regulations to carry out the provisions of this article, including rules governing the form and content of any disclosures or communications required by this article.

Other · Biometrics

Gen. Bus. Law § 676-c(1)(b)-(d), (2)-(6)

Plain Language

This provision establishes the full enforcement framework: the Attorney General may bring actions or special proceedings upon complaint or on its own initiative, seeking injunctions, restitution, disgorgement, civil penalties up to $20,000 per violation, and other relief. Each unlawful processing instance, each affected consumer, and each violated provision counts as a separate violation. The AG has subpoena power within and outside the state, and failure to comply with a subpoena tolls the statute of limitations and may result in $1,000/day civil penalties. The six-year statute of limitations runs from the date the AG became aware of the violation. This creates no independent compliance obligation for private entities beyond the substantive provisions of the article.

Statutory Text

(b) Whenever it appears to the attorney general, either upon complaint or otherwise, that any person or persons has engaged in or is about to engage in any of the acts or practices stated to be unlawful under this article, the attorney general may bring an action or special proceeding in the name and on behalf of the people of the state of New York to enjoin any violation of this article, to obtain restitution of any moneys or property obtained directly or indirectly by any such violation, to obtain disgorgement of any profits obtained directly or indirectly by any such violation, to obtain civil penalties of not more than twenty thousand dollars per violation, and to obtain any such other and further relief as the court may deem proper, including preliminary relief. (c) Each instance of unlawful processing counts as a separate violation. Unlawful processing of the personal data of more than one consumer counts as a separate violation as to each consumer. Each provision of this article that is violated counts as a separate violation. (d) In assessing the amount of penalties, the court must consider anyone or more of the relevant circumstances presented by any of the parties, including, but not limited to, the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the violator's misconduct, and the violator's financial condition. 2. Any action or special proceeding brought by the attorney general pursuant to this section must be commenced within six years of the date on which the attorney general became aware of the violation. 3. In connection with any proposed action or special proceeding under this section, the attorney general is authorized to take proof and make a determination of the relevant facts, and to issue subpoenas in accordance with the civil practice law and rules. The attorney general may also require such other data and information as the attorney general may deem relevant and may require written responses to questions under oath. Such power of subpoena and examination shall not abate or terminate by reason of any action or special proceeding brought by the attorney general under this article. 4. Any person, within or outside the state, who the attorney general believes may be in possession, custody, or control of any books, papers, or other things, or may have information, relevant to acts or practices stated to be unlawful in this article is subject to the service of a subpoena issued by the attorney general pursuant to this section. Service may be made in any manner that is authorized for service of a subpoena or a summons by the state in which service is made. 5.(a) Failure to comply with a subpoena issued pursuant to this section without reasonable cause tolls the applicable statutes of limitations in any action or special proceeding brought by the attorney general against the noncompliant person that arises out of the attorney general's investigation. (b) If a person fails to comply with a subpoena issued pursuant to this section, the attorney general may move in the supreme court to compel compliance. If the court finds that the subpoena was authorized, it shall order compliance and may impose a civil penalty of up to one thousand dollars per day of noncompliance. (c) Such tolling and civil penalty shall be in addition to any other penalties or remedies provided by law for noncompliance with a subpoena. 6. This section shall apply to all acts declared to be unlawful under this article, whether or not subject to any other law of this state, and shall not supersede, amend or repeal any other law of this state under which the attorney general is authorized to take any action or conduct any inquiry.