Erie County Executive Mark Poloncarz has signed the Biometric Transparency and Privacy Act into law, the next step for the county-level legislation that makes Erie County the first in New York State to impose a comprehensive restriction on commercial use of customer biometric data. The signing follows the legislature’s passage of the act in April.
The Biometric Transparency and Privacy Act prohibits commercial establishments inside the county from collecting, storing, procuring, using, or selling customer biometric identifier information without the customer’s explicit consent. The definition of biometric identifier information is broad and covers facial images and recordings, iris and retina scans, fingerprints and handprints, voice, genetic information, and characteristic gait or typing patterns. Ordinary security camera footage is excluded as long as the recordings are not run through identification systems and are not shared with third parties.
Existing biometric records are subject to a deletion regime. Commercial establishments already in possession of customer biometric data must notify the Director of the Erie County Department of Public Advocacy Division of Consumer Protection within 30 days of the effective date and certify that the data has been permanently deleted or destroyed within 30 days of providing that notice. The law sets civil penalties of 1,000 dollars per day for ongoing violations and 5,000 dollars per day for failure to destroy biometric data already collected before the effective date.
Employee biometric data is not covered by the act, which addresses customer-facing collection only. The exemption tracks the line drawn in other state and local biometric privacy laws, where workplace use cases are typically left to other statutes and labour rules.
The Erie County Legislature passed the Biometric Transparency and Privacy Act in April, making it the first county-level statute of its kind in New York. The signing converts the legislation into binding county law and starts the disclosure-and-deletion clock for businesses operating in Erie County. The act has been compared, by lawyers tracking the space, to Illinois’s Biometric Information Privacy Act and to the Texas Capture or Use of Biometric Identifier Act, although the Erie County law is narrower in scope and county-bounded in jurisdiction.
Commercial establishments operating in Erie County will need to assess existing biometric collection programs, build consent procedures, and prepare to certify deletion of any non-consented records held when the act takes effect.
Sources: Erie County Department of Consumer Protection
–
By the ID Tech Editorial Team
