Establishes the biometric identifier privacy act; requires private entities in possession of biometric identifiers or biometric information to develop a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual's last interaction with the private entity, whichever occurs first.
S01422 establishes a new “Biometric Identifier Privacy Act” in the General Business Law. It defines biometric identifiers and biometric information broadly to include data such as faceprints, fingerprints, voiceprints, gait, retina or iris images, DNA, and other biological or behavioral characteristics used for automated identification, while carving out several exclusions such as signatures, ordinary photographs or videos (except for biometric data derived from them), certain medical and research uses, and information governed by HIPAA or other specified laws.
The bill would require private entities that collect or possess biometric data to give written notice, disclose the purpose and retention period, obtain a written release, and maintain a public retention/destruction policy. It also prohibits selling, leasing, trading, or otherwise profiting from biometric data, restricts disclosure except in limited circumstances, and bars conditioning goods or services on biometric collection unless strictly necessary. The Attorney General would be empowered to enforce the law through rulemaking, investigations, injunctions, restitution, disgorgement, and civil penalties, and individuals would have a private right of action, including damages, attorneys’ fees, and class action remedies. The act would take effect 90 days after becoming law.
If enacted, the bill would add a new article 32-A to the General Business Law and create statewide rules governing private-sector collection, storage, use, disclosure, and destruction of biometric identifiers and biometric information. It would impose compliance obligations on businesses and other private entities, establish retention and destruction deadlines, and create both public enforcement by the Attorney General and private litigation exposure, including class actions and statutory damages. The bill also expressly preserves certain existing legal regimes, including HIPAA, Gramm-Leach-Bliley-covered financial institutions, and government contractors working for state or local agencies.
The available voting history suggests generally favorable committee sentiment: the Senate Consumer Protection Committee approved the bill 6-1. No committee transcript is provided, so there is no recorded floor or hearing debate to indicate broader support or opposition. The bill’s progression from Consumer Protection to Internet and Technology also suggests it was treated as a consumer privacy and technology policy measure rather than a controversial partisan proposal.
The main points of potential contention are the breadth of the biometric-data restrictions and the scope of liability. Businesses may object to the written-release requirement, the prohibition on profiting from biometric data, the limits on conditioning services on biometric collection, and the availability of statutory damages, attorneys’ fees, and class actions. Another likely issue is the bill’s broad definition of biometric information and the compliance burden of retention, destruction, and security requirements. At the same time, the bill includes carveouts for health care, research, financial institutions, and government contractors, which may reflect efforts to address concerns from those sectors while leaving the core privacy protections intact.