BUFFALO, N.Y. (WKBW) — The Erie County Legislature has passed the Biometrics Transparency and Privacy Act, which bans businesses from collecting, storing, or selling customers' biometric data.
Its passage makes Erie County the first county in New York State to ban the commercial collection of biometric data.
The legislature voted 7-3 to pass the act, which was sponsored by 1st District Legislator Lawrence J. Dupre. It applies to any commercial establishment operating in a commercial setting within Erie County.
The legislation was proposed after Wegmans confirmed it is using facial recognition technology at what it calls "elevated risk" stores — but it wouldn't specify which locations qualify or what makes them higher risk.
The ban covers:
- Face scans
- Fingerprints
- Iris scans
- Voice prints
- Genetics
- Characteristic movements such as gait or typing patterns
According to the legislature, the law includes targeted exceptions, including:
- Government agencies acting within their governmental duties
- Financial institutions
- Personal device authentication
- Social media face detection
- Law enforcement acting pursuant to a valid warrant or subpoena
- Photographs and video recordings that are not analyzed by identification software and are not shared with third parties
"This law does not ban security cameras. It does not ban loss prevention. The line it draws is between a security camera and a biometric database. A store can record video for security. What it cannot do is run facial recognition software to build a profile of every customer who walks through the door."
Below are some further details provided by the legislature:
- Businesses that receive a violation notice have a 30-day cure period to come into compliance before any penalties apply
- Civil penalties are $1,000 per day for violations after the cure period and $5,000 per day for failure to destroy biometric data already in a business's possession
- Enforcement is handled by the Erie County Department of Public Advocacy, Division of Consumer Protection.
- Businesses already holding biometric data when the law takes effect must notify the Director of Consumer Protection within 30 days, establish a destruction policy, and permanently delete all such data within 30 days of providing notice
- The Biometrics Transparency and Privacy Act takes effect upon filing with the New York State Secretary of State
