NY State Senate Bill 2021-S1933A

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Jan 05, 2022	referred to consumer protection
Jun 04, 2021	print number 1933a
Jun 04, 2021	amend and recommit to consumer protection
Jan 16, 2021	referred to consumer protection

Bill Amendments

Original

A (Active)

2021-S1933 - Details

Current Committee:: Senate Consumer Protection
Law Section:: General Business Law
Laws Affected:: Add Art 32-A §§676 - 676-d, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2017-2018: S8547
2019-2020: S1203

2021-S1933 - Summary

Establishes the biometric privacy act; requires private entities in possession of biometric identifiers or biometric information to develop a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual's last interaction with the private entity, whichever occurs later.

2021-S1933 - Sponsor Memo

                                
 
BILL NUMBER: S1933

SPONSOR: RITCHIE
 
TITLE OF BILL:

An act to amend the general business law, in relation to biometric
privacy

 
PURPOSE:

The purpose of this legislation is to provide safeguards for consumers'
biometric information

 
SUMMARY OF PROVISIONS:

Section 1 amends the general business law in relation to biometric
privacy by adding a new article 32-A, creating the "Biometric Privacy
Act." § 676-a defines terms used in the bill. § 676-b states that an
entity in possession of biometric identifiers or biometric information
must develop a written policy made available to the public. No entity
may collect, capture, purchase, or trade the biometrics of a person,

unless the entity informs the subject person through writing and
receives a legal written consent from the person.  An entity in
possession of a biometric identifier or information shall store, trans-
mit and protect from disclosure in a safe manner.  The entity may not
sell or profit from this information. § 676-c includes the right of
action to any individual aggrieved by a violation of this article. §
676-d states that nothing in this article shall be construed to impact
the admission or discovery of biometric identifiers and biometric infor-
mation in any court action.

Section 2 provides the effective date.

 
JUSTIFICATION:

As technology continues to improve and makes the collection of biometric
information easier, the risk that this information could be exploited
and used for illegal purposes also grows. In enacting similar legis-
lation, the Illinois legislature wrote in 2008, "Biometrics are unlike
other unique identifiers that are used to access finances or other
sensitive information. For example, social security numbers, when
compromised, can be changed. Biometrics, however, are biologically
unique to the individual; therefore, once compromised, the individual
has no recourse and is at heightened risk for identity theft."

Many companies have collected this information without notifying indi-
viduals as to how their personal information will be used. Every time an
individual uploads a photograph with facial recognition, unlocks their
phone with their fingerprints, or uses a retinal scanner, the company to
whom that information is sent has virtually unchecked and unlimited
ability to do with it whatever they please. Not only could this informa-
tion be stolen, the company could simply just sell it to the highest
bidder. This presents both a security concern and a privacy concern.

It is important to note that this legislation does not prevent the use
of biometric information; it simply requires that companies notify indi-
viduals that they will be collecting this data, create a plan to destroy
it when it is no longer being used for its original purpose, and do not
sell it to third parties.
 
LEGISLATIVE HISTORY:

2018: S.8547/A.9793.

2019-2020: S.1203/A.1911

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect on the thirtieth day after it shall have
become a law.

2021-S1933 - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   1933
 
                        2021-2022 Regular Sessions
 
                             I N  S E N A T E
 
                             January 16, 2021
                                ___________
 
 Introduced  by  Sen. RITCHIE -- read twice and ordered printed, and when
   printed to be committed to the Committee on Consumer Protection
 
 AN ACT to amend the general  business  law,  in  relation  to  biometric
   privacy
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:

   Section 1. The general business law is amended by adding a new article
 32-A to read as follows:
                               ARTICLE 32-A
                           BIOMETRIC PRIVACY ACT
 SECTION 676. SHORT TITLE.
         676-A. DEFINITIONS.
         676-B. RETENTION; COLLECTION; DISCLOSURE; DESTRUCTION.
         676-C. RIGHT OF ACTION.
         676-D. CONSTRUCTION WITH OTHER LAWS.
   § 676. SHORT TITLE. THIS ARTICLE SHALL BE KNOWN AND MAY  BE  CITED  AS
 THE "BIOMETRIC PRIVACY ACT".
   § 676-A. DEFINITIONS. AS USED IN THIS ARTICLE: 1. "BIOMETRIC IDENTIFI-
 ER"  MEANS  A  RETINA  OR IRIS SCAN, FINGERPRINT, VOICEPRINT, OR SCAN OF
 HAND OR FACE GEOMETRY. BIOMETRIC IDENTIFIERS SHALL NOT  INCLUDE  WRITING
 SAMPLES,  WRITTEN SIGNATURES, PHOTOGRAPHS, HUMAN BIOLOGICAL SAMPLES USED
 FOR VALID SCIENTIFIC TESTING  OR  SCREENING,  DEMOGRAPHIC  DATA,  TATTOO
 DESCRIPTIONS,  OR  PHYSICAL  DESCRIPTIONS  SUCH  AS HEIGHT, WEIGHT, HAIR
 COLOR, OR EYE COLOR. BIOMETRIC IDENTIFIERS  SHALL  NOT  INCLUDE  DONATED
 BODY  PARTS  AS  DEFINED  IN  SECTION  FORTY-THREE HUNDRED OF THE PUBLIC
 HEALTH LAW OR BLOOD OR SERUM STORED ON BEHALF OF RECIPIENTS OR POTENTIAL
 RECIPIENTS OF LIVING OR CADAVERIC TRANSPLANTS AND OBTAINED OR STORED  BY
 A  FEDERALLY  DESIGNATED ORGAN PROCUREMENT AGENCY. BIOMETRIC IDENTIFIERS
 DO NOT INCLUDE INFORMATION CAPTURED FROM A  PATIENT  IN  A  HEALTH  CARE
 SETTING OR INFORMATION COLLECTED, USED, OR STORED FOR HEALTH CARE TREAT-
 MENT,  PAYMENT,  OR OPERATIONS UNDER THE FEDERAL HEALTH INSURANCE PORTA-
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD02422-01-1

 S. 1933                             2
 
 BILITY AND ACCOUNTABILITY ACT OF  1996.  BIOMETRIC  IDENTIFIERS  DO  NOT
 INCLUDE  AN X-RAY, ROENTGEN PROCESS, COMPUTED TOMOGRAPHY, MAGNETIC RESO-
 NANCE IMAGING, POSITRON-EMISSION TOMOGRAPHY SCAN, MAMMOGRAPHY, OR  OTHER
 IMAGE  OR FILM OF THE HUMAN ANATOMY USED TO DIAGNOSE, PROGNOSE, OR TREAT
 AN ILLNESS OR OTHER MEDICAL CONDITION OR TO FURTHER VALIDATE  SCIENTIFIC
 TESTING OR SCREENING.
   2. "BIOMETRIC INFORMATION" MEANS ANY INFORMATION, REGARDLESS OF HOW IT
 IS  CAPTURED,  CONVERTED,  STORED,  OR  SHARED, BASED ON AN INDIVIDUAL'S
 BIOMETRIC IDENTIFIER USED TO IDENTIFY AN INDIVIDUAL. BIOMETRIC  INFORMA-
 TION  SHALL  NOT  INCLUDE  INFORMATION  DERIVED FROM ITEMS OR PROCEDURES
 EXCLUDED UNDER THE DEFINITION OF BIOMETRIC IDENTIFIERS.
   3. "CONFIDENTIAL AND SENSITIVE INFORMATION" MEANS PERSONAL INFORMATION
 THAT CAN BE USED TO UNIQUELY IDENTIFY AN INDIVIDUAL OR  AN  INDIVIDUAL'S
 ACCOUNT  OR PROPERTY WHICH SHALL INCLUDE, BUT SHALL NOT BE LIMITED TO, A
 GENETIC MARKER, GENETIC TESTING INFORMATION, A UNIQUE IDENTIFIER  NUMBER
 TO  LOCATE  AN  ACCOUNT OR PROPERTY, AN ACCOUNT NUMBER, A PERSONAL IDEN-
 TIFICATION NUMBER, A PASS CODE, A DRIVER'S LICENSE NUMBER, OR  A  SOCIAL
 SECURITY NUMBER.
   4.  "PRIVATE  ENTITY"  MEANS ANY INDIVIDUAL, PARTNERSHIP, CORPORATION,
 LIMITED LIABILITY COMPANY, ASSOCIATION, OR OTHER GROUP,  HOWEVER  ORGAN-
 IZED.  A  PRIVATE  ENTITY  SHALL NOT INCLUDE A STATE OR LOCAL GOVERNMENT
 AGENCY OR ANY COURT IN THE STATE, A CLERK OF THE COURT, OR  A  JUDGE  OR
 JUSTICE THEREOF.
   5. "WRITTEN RELEASE" MEANS INFORMED WRITTEN CONSENT OR, IN THE CONTEXT
 OF  EMPLOYMENT,  A  RELEASE  EXECUTED  BY  AN EMPLOYEE AS A CONDITION OF
 EMPLOYMENT.
   § 676-B. RETENTION; COLLECTION; DISCLOSURE; DESTRUCTION. 1. A  PRIVATE
 ENTITY  IN  POSSESSION OF BIOMETRIC IDENTIFIERS OR BIOMETRIC INFORMATION
 MUST DEVELOP A WRITTEN POLICY, MADE AVAILABLE TO THE PUBLIC,  ESTABLISH-
 ING A RETENTION SCHEDULE AND GUIDELINES FOR PERMANENTLY DESTROYING BIOM-
 ETRIC IDENTIFIERS AND BIOMETRIC INFORMATION WHEN THE INITIAL PURPOSE FOR
 COLLECTING  OR OBTAINING SUCH IDENTIFIERS OR INFORMATION HAS BEEN SATIS-
 FIED OR WITHIN THREE YEARS OF THE INDIVIDUAL'S LAST INTERACTION WITH THE
 PRIVATE ENTITY, WHICHEVER  OCCURS  FIRST.  ABSENT  A  VALID  WARRANT  OR
 SUBPOENA  ISSUED  BY A COURT OF COMPETENT JURISDICTION, A PRIVATE ENTITY
 IN POSSESSION OF BIOMETRIC IDENTIFIERS  OR  BIOMETRIC  INFORMATION  MUST
 COMPLY  WITH  ITS  ESTABLISHED RETENTION SCHEDULE AND DESTRUCTION GUIDE-
 LINES.
   2. NO PRIVATE ENTITY MAY COLLECT, CAPTURE, PURCHASE,  RECEIVE  THROUGH
 TRADE,  OR OTHERWISE OBTAIN A PERSON'S OR A CUSTOMER'S BIOMETRIC IDENTI-
 FIER OR BIOMETRIC INFORMATION, UNLESS IT FIRST:
   (A) INFORMS THE SUBJECT OR THE SUBJECT'S LEGALLY AUTHORIZED  REPRESEN-
 TATIVE  IN  WRITING THAT A BIOMETRIC IDENTIFIER OR BIOMETRIC INFORMATION
 IS BEING COLLECTED OR STORED;
   (B) INFORMS THE SUBJECT OR THE SUBJECT'S LEGALLY AUTHORIZED  REPRESEN-
 TATIVE IN WRITING OF THE SPECIFIC PURPOSE AND LENGTH OF TERM FOR WHICH A
 BIOMETRIC  IDENTIFIER  OR  BIOMETRIC  INFORMATION  IS  BEING  COLLECTED,
 STORED, AND USED; AND
   (C) RECEIVES A WRITTEN RELEASE EXECUTED BY THE SUBJECT OF  THE  BIOME-
 TRIC  IDENTIFIER  OR  BIOMETRIC  INFORMATION  OR  THE  SUBJECT'S LEGALLY
 AUTHORIZED REPRESENTATIVE.
   3. NO PRIVATE ENTITY IN POSSESSION OF A BIOMETRIC IDENTIFIER OR BIOME-
 TRIC INFORMATION MAY SELL, LEASE, TRADE,  OR  OTHERWISE  PROFIT  FROM  A
 PERSON'S OR A CUSTOMER'S BIOMETRIC IDENTIFIER OR BIOMETRIC INFORMATION.
   4. NO PRIVATE ENTITY IN POSSESSION OF A BIOMETRIC IDENTIFIER OR BIOME-
 TRIC  INFORMATION  MAY  DISCLOSE, REDISCLOSE, OR OTHERWISE DISSEMINATE A

 S. 1933                             3
 
 PERSON'S OR A CUSTOMER'S BIOMETRIC IDENTIFIER OR  BIOMETRIC  INFORMATION
 UNLESS:
   (A)  THE  SUBJECT OF THE BIOMETRIC IDENTIFIER OR BIOMETRIC INFORMATION
 OR THE SUBJECT'S  LEGALLY  AUTHORIZED  REPRESENTATIVE  CONSENTS  TO  THE
 DISCLOSURE OR REDISCLOSURE;
   (B)  THE  DISCLOSURE OR REDISCLSOURE COMPLETES A FINANCIAL TRANSACTION
 REQUESTED OR AUTHORIZED BY THE SUBJECT OF THE  BIOMETRIC  IDENTIFIER  OR
 THE  BIOMETRIC INFORMATION OR THE SUBJECT'S LEGALLY AUTHORIZED REPRESEN-
 TATIVE;
   (C) THE DISCLOSURE OR REDISCLOSURE IS REQUIRED BY  FEDERAL,  STATE  OR
 LOCAL LAW OR MUNICIPAL ORDINANCE; OR
   (D) THE DISCLOSURE IS REQUIRED PURSUANT TO A VALID WARRANT OR SUBPOENA
 ISSUED BY A COURT OF COMPETENT JURISDICTION.
   5.  A PRIVATE ENTITY IN POSSESSION OF A BIOMETRIC IDENTIFIER OR BIOME-
 TRIC INFORMATION SHALL:
   (A) STORE, TRANSMIT, AND PROTECT FROM DISCLOSURE ALL BIOMETRIC IDENTI-
 FIERS AND BIOMETRIC INFORMATION USING THE REASONABLE  STANDARD  OF  CARE
 WITHIN THE PRIVATE ENTITY'S INDUSTRY; AND
   (B) STORE, TRANSMIT, AND PROTECT FROM DISCLOSURE ALL BIOMETRIC IDENTI-
 FIERS  AND BIOMETRIC INFORMATION IN A MANNER THAT IS THE SAME AS OR MORE
 PROTECTIVE THAN THE MANNER IN WHICH THE PRIVATE  ENTITY  STORES,  TRANS-
 MITS, AND PROTECTS OTHER CONFIDENTIAL AND SENSITIVE INFORMATION.
   §  676-C. RIGHT OF ACTION. ANY PERSON AGGRIEVED BY A VIOLATION OF THIS
 ARTICLE SHALL HAVE A RIGHT OF ACTION IN SUPREME COURT AGAINST AN OFFEND-
 ING PARTY. A PREVAILING PARTY MAY RECOVER FOR EACH VIOLATION:
   1. AGAINST A PRIVATE ENTITY THAT NEGLIGENTLY VIOLATES A  PROVISION  OF
 THIS  ARTICLE,  LIQUIDATED  DAMAGES  OF  ONE  THOUSAND DOLLARS OR ACTUAL
 DAMAGES, WHICHEVER IS GREATER;
   2. AGAINST A PRIVATE ENTITY THAT INTENTIONALLY OR RECKLESSLY  VIOLATES
 A PROVISION OF THIS ARTICLE, LIQUIDATED DAMAGES OF FIVE THOUSAND DOLLARS
 OR ACTUAL DAMAGES, WHICHEVER IS GREATER;
   3. REASONABLE ATTORNEYS' FEES AND COSTS, INCLUDING EXPERT WITNESS FEES
 AND OTHER LITIGATION EXPENSES; AND
   4. OTHER RELIEF, INCLUDING AN INJUNCTION, AS THE COURT MAY DEEM APPRO-
 PRIATE.
   §  676-D.  CONSTRUCTION  WITH  OTHER  LAWS. 1. NOTHING IN THIS ARTICLE
 SHALL BE CONSTRUED TO IMPACT THE ADMISSION  OR  DISCOVERY  OF  BIOMETRIC
 IDENTIFIERS  AND  BIOMETRIC INFORMATION IN ANY ACTION OF ANY KIND IN ANY
 COURT, OR BEFORE ANY TRIBUNAL, BOARD, AGENCY, OR PERSON.
   2. NOTHING IN THIS ARTICLE SHALL BE CONSTRUED  TO  CONFLICT  WITH  THE
 FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996.
   3.  NOTHING IN THE ARTICLE SHALL BE DEEMED TO APPLY IN ANY MANNER TO A
 FINANCIAL INSTITUTION OR AN AFFILIATE OF A FINANCIAL INSTITUTION THAT IS
 SUBJECT TO TITLE V OF THE FEDERAL GRAMM-LEACH-BLILEY ACT OF 1999.
   4. NOTHING IN THIS ARTICLE SHALL BE CONSTRUED TO APPLY TO  A  CONTRAC-
 TOR,  SUBCONTRACTOR, OR AGENT OF A STATE AGENCY OF LOCAL GOVERNMENT WHEN
 WORKING FOR THAT STATE AGENCY OF LOCAL GOVERNMENT.
   § 2. This act shall take effect on the ninetieth day  after  it  shall
 have become a law.

2021-S1933A (ACTIVE) - Details

Current Committee:: Senate Consumer Protection
Law Section:: General Business Law
Laws Affected:: Add Art 32-A §§676 - 676-d, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2017-2018: S8547
2019-2020: S1203

2021-S1933A (ACTIVE) - Summary

2021-S1933A (ACTIVE) - Sponsor Memo

                                 
BILL NUMBER: S1933A

SPONSOR: RITCHIE
 
TITLE OF BILL:

An act to amend the general business law, in relation to biometric
privacy

 
PURPOSE:

The purpose of this legislation is to provide safeguards for consumers'
biometric information

 
SUMMARY OF PROVISIONS:

Section 1 amends the general business law in relation to biometric
privacy by adding a new article 32-A, creating the "Biometric Privacy
Act." § 676-a defines terms used in the bill. § 676-b concerns the
retention, collection, disclosure and destruction of biometric informa-
tion. § 676-c includes the right of action to individuals aggrieved by a
violation of this article. § 676-d states that nothing in this article
shall be construed to impact the admission or discovery of biometric

identifiers and biometric information in any court action.

Section 2 provides the effective date.

 
JUSTIFICATION:

As technology continues to improve and makes the collection of biometric
information easier, the risk that this information could be exploited
and used for illegal purposes also grows. In enacting similar legis-
lation, the Illinois legislature wrote in 2008, "Biometrics are unlike
other unique identifiers that are used to access finances or other
sensitive information. For example, social security numbers, when
compromised, can be changed. Biometrics, however, are biologically
unique to the individual; therefore, once compromised, the individual
has no recourse and is at heightened risk for identity theft."

Many companies have collected this information without notifying indi-
viduals as to how their personal information will be used. Every time an
individual uploads a photograph with facial recognition, unlocks their
phone with their fingerprints, or uses a retinal scanner, the company to
whom that information is sent has virtually unchecked and unlimited
ability to do with it whatever they please.  Not only could this infor-
mation be stolen, the company could simply just sell it to the highest
bidder. This presents both a security concern and a privacy concern.

It is important to note that this legislation does not prevent the use
of biometric information; it simply requires that companies notify indi-
viduals that they will be collecting this data, create a plan to destroy
it when it is no longer being used for its original purpose, and do not
sell it to third parties.

 
LEGISLATIVE HISTORY:

2018: S.8547/A.9793.

2019-2020: S.1203/A.1911

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect on the ninetieth day after it shall have
become a law.

2021-S1933A (ACTIVE) - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  1933--A
 
                        2021-2022 Regular Sessions
 
                             I N  S E N A T E
 
                             January 16, 2021
                                ___________
 
 Introduced  by  Sen. RITCHIE -- read twice and ordered printed, and when
   printed to be committed to the Committee  on  Consumer  Protection  --
   committee  discharged,  bill amended, ordered reprinted as amended and
   recommitted to said committee
 
 AN ACT to amend the general  business  law,  in  relation  to  biometric
   privacy

   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new article
 32-A to read as follows:
                               ARTICLE 32-A
                           BIOMETRIC PRIVACY ACT
 SECTION 676. SHORT TITLE.
         676-A. DEFINITIONS.
         676-B. RETENTION; COLLECTION; DISCLOSURE; DESTRUCTION.
         676-C. RIGHT OF ACTION.
         676-D. CONSTRUCTION WITH OTHER LAWS.
   § 676. SHORT TITLE. THIS ARTICLE SHALL BE KNOWN AND MAY  BE  CITED  AS
 THE "BIOMETRIC PRIVACY ACT".
   § 676-A. DEFINITIONS. AS USED IN THIS ARTICLE: 1. "BIOMETRIC IDENTIFI-
 ER"  MEANS  A  RETINA  OR IRIS SCAN, FINGERPRINT, VOICEPRINT, OR SCAN OF
 HAND OR FACE GEOMETRY. BIOMETRIC IDENTIFIERS SHALL NOT  INCLUDE  WRITING
 SAMPLES,  WRITTEN SIGNATURES, PHOTOGRAPHS, HUMAN BIOLOGICAL SAMPLES USED
 FOR VALID SCIENTIFIC TESTING  OR  SCREENING,  DEMOGRAPHIC  DATA,  TATTOO
 DESCRIPTIONS,  OR  PHYSICAL  DESCRIPTIONS  SUCH  AS HEIGHT, WEIGHT, HAIR
 COLOR, OR EYE COLOR. BIOMETRIC IDENTIFIERS  SHALL  NOT  INCLUDE  DONATED
 BODY  PARTS  AS  DEFINED  IN  SECTION  FORTY-THREE HUNDRED OF THE PUBLIC
 HEALTH LAW OR BLOOD OR SERUM STORED ON BEHALF OF RECIPIENTS OR POTENTIAL
 RECIPIENTS OF LIVING OR CADAVERIC TRANSPLANTS AND OBTAINED OR STORED  BY
 A  FEDERALLY  DESIGNATED ORGAN PROCUREMENT AGENCY. BIOMETRIC IDENTIFIERS
 DO NOT INCLUDE INFORMATION CAPTURED FROM A  PATIENT  IN  A  HEALTH  CARE
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD02422-04-1

 S. 1933--A                          2
 
 SETTING OR INFORMATION COLLECTED, USED, OR STORED FOR HEALTH CARE TREAT-
 MENT,  PAYMENT,  OR OPERATIONS UNDER THE FEDERAL HEALTH INSURANCE PORTA-
 BILITY AND ACCOUNTABILITY ACT OF  1996.  BIOMETRIC  IDENTIFIERS  DO  NOT
 INCLUDE  AN X-RAY, ROENTGEN PROCESS, COMPUTED TOMOGRAPHY, MAGNETIC RESO-
 NANCE IMAGING, POSITRON-EMISSION TOMOGRAPHY SCAN, MAMMOGRAPHY, OR  OTHER
 IMAGE  OR FILM OF THE HUMAN ANATOMY USED TO DIAGNOSE, PROGNOSE, OR TREAT
 AN ILLNESS OR OTHER MEDICAL CONDITION OR TO FURTHER VALIDATE  SCIENTIFIC
 TESTING OR SCREENING.
   2. "BIOMETRIC INFORMATION" MEANS ANY INFORMATION, REGARDLESS OF HOW IT
 IS  CAPTURED,  CONVERTED,  STORED,  OR  SHARED, BASED ON AN INDIVIDUAL'S
 BIOMETRIC IDENTIFIER USED TO IDENTIFY AN INDIVIDUAL. BIOMETRIC  INFORMA-
 TION  SHALL  NOT  INCLUDE  INFORMATION  DERIVED FROM ITEMS OR PROCEDURES
 EXCLUDED UNDER THE DEFINITION OF BIOMETRIC IDENTIFIERS.
   3. "CONFIDENTIAL AND SENSITIVE INFORMATION" MEANS PERSONAL INFORMATION
 THAT CAN BE USED TO UNIQUELY IDENTIFY AN INDIVIDUAL OR  AN  INDIVIDUAL'S
 ACCOUNT  OR PROPERTY WHICH SHALL INCLUDE, BUT SHALL NOT BE LIMITED TO, A
 GENETIC MARKER, GENETIC TESTING INFORMATION, A UNIQUE IDENTIFIER  NUMBER
 TO  LOCATE  AN  ACCOUNT OR PROPERTY, AN ACCOUNT NUMBER, A PERSONAL IDEN-
 TIFICATION NUMBER, A PASS CODE, A DRIVER'S LICENSE NUMBER, OR  A  SOCIAL
 SECURITY NUMBER.
   4.  "PRIVATE  ENTITY"  MEANS ANY INDIVIDUAL, PARTNERSHIP, CORPORATION,
 LIMITED LIABILITY COMPANY, ASSOCIATION, OR OTHER GROUP,  HOWEVER  ORGAN-
 IZED.  A  PRIVATE  ENTITY  SHALL NOT INCLUDE A STATE OR LOCAL GOVERNMENT
 AGENCY OR ANY COURT IN THE STATE, A CLERK OF THE COURT, OR  A  JUDGE  OR
 JUSTICE THEREOF.
   5. "WRITTEN RELEASE" MEANS INFORMED WRITTEN CONSENT OR, IN THE CONTEXT
 OF  EMPLOYMENT,  A  RELEASE  EXECUTED  BY  AN EMPLOYEE AS A CONDITION OF
 EMPLOYMENT.
   § 676-B. RETENTION; COLLECTION; DISCLOSURE; DESTRUCTION. 1. A  PRIVATE
 ENTITY  IN  POSSESSION OF BIOMETRIC IDENTIFIERS OR BIOMETRIC INFORMATION
 MUST DEVELOP A WRITTEN POLICY  ESTABLISHING  A  RETENTION  SCHEDULE  AND
 GUIDELINES  FOR  PERMANENTLY DESTROYING BIOMETRIC IDENTIFIERS AND BIOME-
 TRIC INFORMATION WHEN THE INITIAL PURPOSE FOR  COLLECTING  OR  OBTAINING
 SUCH IDENTIFIERS OR INFORMATION HAS BEEN SATISFIED OR WITHIN THREE YEARS
 OF  THE INDIVIDUAL'S LAST INTERACTION WITH THE PRIVATE ENTITY, WHICHEVER
 OCCURS LATER. ABSENT A VALID WARRANT OR SUBPOENA ISSUED BY  A  COURT  OF
 COMPETENT  JURISDICTION,  A  PRIVATE  ENTITY  IN POSSESSION OF BIOMETRIC
 IDENTIFIERS OR BIOMETRIC INFORMATION MUST COMPLY  WITH  ITS  ESTABLISHED
 RETENTION SCHEDULE AND DESTRUCTION GUIDELINES.
   2.  NO  PRIVATE ENTITY MAY COLLECT, CAPTURE, PURCHASE, RECEIVE THROUGH
 TRADE, OR OTHERWISE OBTAIN A PERSON'S OR A CUSTOMER'S BIOMETRIC  IDENTI-
 FIER OR BIOMETRIC INFORMATION, UNLESS IT FIRST:
   (A)  INFORMS THE SUBJECT OR THE SUBJECT'S LEGALLY AUTHORIZED REPRESEN-
 TATIVE IN WRITING THAT A BIOMETRIC IDENTIFIER OR  BIOMETRIC  INFORMATION
 IS BEING COLLECTED OR STORED;
   (B)  INFORMS THE SUBJECT OR THE SUBJECT'S LEGALLY AUTHORIZED REPRESEN-
 TATIVE IN WRITING OF THE SPECIFIC PURPOSE AND LENGTH OF TERM FOR WHICH A
 BIOMETRIC  IDENTIFIER  OR  BIOMETRIC  INFORMATION  IS  BEING  COLLECTED,
 STORED, AND USED; AND
   (C)  RECEIVES  A WRITTEN RELEASE EXECUTED BY THE SUBJECT OF THE BIOME-
 TRIC IDENTIFIER  OR  BIOMETRIC  INFORMATION  OR  THE  SUBJECT'S  LEGALLY
 AUTHORIZED REPRESENTATIVE.
   (D)  THE  PROVISIONS  OF THIS SUBDIVISION SHALL NOT APPLY TO A PRIVATE
 ENTITY WHICH OBTAINED INFORMED WRITTEN CONSENT TO  COLLECT  OR  STORE  A
 PERSON OR CUSTOMER'S BIOMETRIC IDENTIFIER OR BIOMETRIC INFORMATION PRIOR
 TO  THE  EFFECTIVE  DATE  OF  THIS  ARTICLE,  PROVIDED  SUCH CONSENT WAS

 S. 1933--A                          3
 
 OBTAINED FROM THE PERSON OR CUSTOMER IN A MANNER  THAT  WOULD  OTHERWISE
 SATISFY  THE  REQUIREMENTS  SET  FORTH IN PARAGRAPHS (A), (B) AND (C) OF
 THIS SUBDIVISION.
   3. NO PRIVATE ENTITY IN POSSESSION OF A BIOMETRIC IDENTIFIER OR BIOME-
 TRIC  INFORMATION  MAY  SELL,  LEASE,  TRADE, OR OTHERWISE PROFIT FROM A
 PERSON'S OR A CUSTOMER'S BIOMETRIC IDENTIFIER OR BIOMETRIC INFORMATION.
   4. NO PRIVATE ENTITY IN POSSESSION OF A BIOMETRIC IDENTIFIER OR BIOME-
 TRIC INFORMATION MAY DISCLOSE, REDISCLOSE, OR  OTHERWISE  DISSEMINATE  A
 PERSON'S  OR  A CUSTOMER'S BIOMETRIC IDENTIFIER OR BIOMETRIC INFORMATION
 UNLESS:
   (A) THE SUBJECT OF THE BIOMETRIC IDENTIFIER OR  BIOMETRIC  INFORMATION
 OR  THE  SUBJECT'S  LEGALLY  AUTHORIZED  REPRESENTATIVE  CONSENTS TO THE
 DISCLOSURE OR REDISCLOSURE;
   (B) THE DISCLOSURE OR REDISCLSOURE COMPLETES A  FINANCIAL  TRANSACTION
 REQUESTED  OR  AUTHORIZED  BY THE SUBJECT OF THE BIOMETRIC IDENTIFIER OR
 THE BIOMETRIC INFORMATION OR THE SUBJECT'S LEGALLY AUTHORIZED  REPRESEN-
 TATIVE;
   (C)  THE  DISCLOSURE  OR REDISCLOSURE IS REQUIRED BY FEDERAL, STATE OR
 LOCAL LAW OR MUNICIPAL ORDINANCE; OR
   (D) THE DISCLOSURE IS REQUIRED PURSUANT TO A VALID WARRANT OR SUBPOENA
 ISSUED BY A COURT OF COMPETENT JURISDICTION.
   5. A PRIVATE ENTITY IN POSSESSION OF A BIOMETRIC IDENTIFIER OR  BIOME-
 TRIC INFORMATION SHALL:
   (A) STORE, TRANSMIT, AND PROTECT FROM DISCLOSURE ALL BIOMETRIC IDENTI-
 FIERS  AND  BIOMETRIC  INFORMATION USING THE REASONABLE STANDARD OF CARE
 WITHIN THE PRIVATE ENTITY'S INDUSTRY; AND
   (B) STORE, TRANSMIT, AND PROTECT FROM DISCLOSURE ALL BIOMETRIC IDENTI-
 FIERS AND BIOMETRIC INFORMATION IN A MANNER THAT IS THE SAME AS OR  MORE
 PROTECTIVE  THAN  THE  MANNER IN WHICH THE PRIVATE ENTITY STORES, TRANS-
 MITS, AND PROTECTS OTHER CONFIDENTIAL AND SENSITIVE INFORMATION.
   § 676-C. RIGHT OF ACTION. ANY PERSON AGGRIEVED BY A VIOLATION OF  THIS
 ARTICLE  WHO  HAS SUSTAINED ACTUAL DAMAGES AS A RESULT OF SUCH VIOLATION
 SHALL HAVE A RIGHT OF ACTION  IN  SUPREME  COURT  AGAINST  AN  OFFENDING
 PARTY. A PREVAILING PARTY MAY RECOVER FOR EACH VIOLATION:
   1.  AGAINST  A PRIVATE ENTITY THAT NEGLIGENTLY VIOLATES A PROVISION OF
 THIS ARTICLE, LIQUIDATED DAMAGES  OF  ONE  THOUSAND  DOLLARS  OR  ACTUAL
 DAMAGES, WHICHEVER IS GREATER;
   2.  AGAINST A PRIVATE ENTITY THAT INTENTIONALLY OR RECKLESSLY VIOLATES
 A PROVISION OF THIS ARTICLE, LIQUIDATED DAMAGES OF FIVE THOUSAND DOLLARS
 OR ACTUAL DAMAGES, WHICHEVER IS GREATER;
   3. REASONABLE ATTORNEYS' FEES AND COSTS, INCLUDING EXPERT WITNESS FEES
 AND OTHER LITIGATION EXPENSES; AND
   4. OTHER RELIEF, INCLUDING AN INJUNCTION, AS THE COURT MAY DEEM APPRO-
 PRIATE.
   § 676-D. CONSTRUCTION WITH OTHER LAWS.  1.  NOTHING  IN  THIS  ARTICLE
 SHALL  BE  CONSTRUED  TO  IMPACT THE ADMISSION OR DISCOVERY OF BIOMETRIC
 IDENTIFIERS AND BIOMETRIC INFORMATION IN ANY ACTION OF ANY KIND  IN  ANY
 COURT, OR BEFORE ANY TRIBUNAL, BOARD, AGENCY, OR PERSON.
   2.  NOTHING  IN  THIS  ARTICLE SHALL BE CONSTRUED TO CONFLICT WITH THE
 FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996.
   3. NOTHING IN THE ARTICLE SHALL BE DEEMED TO APPLY IN ANY MANNER TO  A
 FINANCIAL INSTITUTION OR AN AFFILIATE OF A FINANCIAL INSTITUTION THAT IS
 SUBJECT TO TITLE V OF THE FEDERAL GRAMM-LEACH-BLILEY ACT OF 1999.
   4.  NOTHING  IN THIS ARTICLE SHALL BE CONSTRUED TO APPLY TO A CONTRAC-
 TOR, SUBCONTRACTOR, OR AGENT OF A STATE AGENCY OF LOCAL GOVERNMENT  WHEN
 WORKING FOR THAT STATE AGENCY OF LOCAL GOVERNMENT.

 S. 1933--A                          4
 
   5.  NOTHING  IN  THIS  ARTICLE SHALL BE CONSTRUED TO CONFLICT WITH ANY
 FEDERAL LAW, RULE, REGULATION, OR LICENSING REQUIREMENT TO THE CONTRARY.
   §  2.  This  act shall take effect on the ninetieth day after it shall
 have become a law.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Senate Bill S1933A

Sponsored By

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

Bill Amendments

2021-S1933 - Details

2021-S1933 - Summary

2021-S1933 - Sponsor Memo

2021-S1933 - Bill Text download pdf

2021-S1933A (ACTIVE) - Details

2021-S1933A (ACTIVE) - Summary

2021-S1933A (ACTIVE) - Sponsor Memo

2021-S1933A (ACTIVE) - Bill Text download pdf

Comments

Senate Bill S1933A

Share this bill

Sponsored By

Patty Ritchie

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

Bill Amendments

2021-S1933 - Details

2021-S1933 - Summary

2021-S1933 - Sponsor Memo

2021-S1933 - Bill Text download pdf

2021-S1933A (ACTIVE) - Details

2021-S1933A (ACTIVE) - Summary

2021-S1933A (ACTIVE) - Sponsor Memo

2021-S1933A (ACTIVE) - Bill Text download pdf

Comments