New York’s Monroe County Legislature has approved a law requiring commercial establishments to disclose their use of facial recognition and other biometric technologies while imposing limits on the sale, retention and storage of biometric data.
Businesses that collect or store biometric information will be required to post a clear notice near their entrances. The measure covers facial scans, fingerprints, voiceprints, retina or iris scans, and measurements of hand or face geometry used to identify a person.
The law prohibits businesses from selling, trading or exchanging biometric information for money or another item of value. Stored biometric data generally must be anonymized so that it cannot identify a person on its own, and it must be destroyed within two years unless another law requires longer retention.
The measure regulates commercial biometric use rather than prohibiting it. Businesses may continue using systems such as facial recognition, but they must provide notice and comply with the restrictions governing the resulting data.
Most people alleging a violation may bring a private action after giving the business 30 days to correct the problem. That cure period gives an establishment an opportunity to address notice, retention or handling failures before litigation proceeds.
The vote advances a proposal that county lawmakers had been considering for several months. The original Monroe County bill focused on visible disclosure and controls over biometric records after concerns about facial recognition use in local retail stores.
Local governments across New York have taken different approaches to commercial biometric surveillance. Syracuse adopted a broader ban on biometric surveillance by public-facing businesses, while New York City lawmakers have considered restrictions on scanning customers in places open to the public.
Neighboring Erie County adopted a more restrictive policy that bars commercial establishments from collecting or using customer biometric identifiers. Monroe County’s measure instead allows the technology under disclosure, handling and retention rules, creating different requirements for businesses operating across western New York.
The measure applies to commercial establishments across Monroe County. Customers entering a covered business are to receive notice of biometric collection at the entrance, while the two-year destruction rule sets the general retention limit when no other law requires the information to be kept longer.
Sources: RochesterFirst
–
By the ID Tech Editorial Team
