BILL NUMBER: S4457AREVISED 6/7/24
SPONSOR: LIU
 
TITLE OF BILL:
An act to amend the general business law, in relation to biometric
privacy
 
PURPOSE OR GENERAL IDEA OF BILL:
The purpose of this legislation is to provide safeguards for consumers'
biometric information
 
SUMMARY OF PROVISION:
Section 1 amends the general business law by adding a new article 32-A,
creating the "Biometric Privacy Act."
-Subsection 676-a defines terms used in the bill.
-Subsection 676-b provides policy requirements for the retention,
collection, disclosure, and destruction of biometric data
-Subsection 676-c provides regulatory authority and enforcement measures
-Subsection 676-d provides for how the law would interact with other
laws
-Subsection 676-e provides a severability clause
Section 2 provides the effective date.
 
JUSTIFICATION:
As technology rapidly improves and the collection of biometric informa-
tion becomes easier, the risk that this information could be exploited
and used for illegal purposes also grows. Government must establish
clear guidelines for the appropriate use of biometric data to safeguard
sensitive and personal identifying information.
In enacting similar legislation, the Illinois legislature wrote in 2008,
"Biometrics are unlike other unique identifiers that are used to access
finances or other sensitive information. For example, social security
numbers, when compromised, can be charged. Biometrics, however, are
biologically unique to the individual; therefore, once compromised, the
individual has no recourse and is at heightened risk for identity
theft."
Many companies collect this data without notifying individuals how their
personal information will be used. Every time an individual uploads a
photograph with facial recognition, unlocks their phone with their fing-
erprints, or uses a retinal scanner, the company collecting this
personal information has virtually unchecked and unlimited ability to
use it as they please. This information could be stolen or sold to the
highest bidder presenting serious privacy and security risks.
It is important to note that this legislation does not prevent the use
of biometric information; it simply requires companies to notify indi-
viduals that they will be collecting their data, to create a plan to
destroy it when it is no longer being used for its original purpose, and
it prohibits the sale of this information to third parties.
 
LEGISLATIVE HISTORY:
2023: Consumer Protection
 
FISCAL IMPLICATIONS:
None.
 
EFFECTIVE DATE:
This act shall take effect on the ninetieth day after it shall have
become a law.