BILL NUMBER: S2390

SPONSOR: LIU
 
TITLE OF BILL:

An act to amend the general business law, in relation to the use of
biometric data for marketing purposes

 
PURPOSE OR GENERAL IDEA OF BILL:

Relates to the use of biometric data for marketing purposes

 
SUMMARY OF SPECIFIC PROVISIONS:

Adds Section 399-dddd of the general business law. Section 1 subdivision
(a) defines' private entity* to mean any individual. Partnership, corpo-
ration, limited liability company, association, or other group, however,
organized. Subdivision (b) defines "biometric identifier's to mean data
generated by automatic measurements of an individual's biological char-
acteristics, such as fingerprint, voiceprint, eye retinas, irises, or
other unique biological pattern or characteristic that is used to iden-
tify a specific individual. This section also adds subdivision (c) which
              

defines "biometric information" to mean any Information, regardless of
how it is captured, converted, stored, or shared, based on an indivi-
duers biometric identifier used to identify an individual.

Section 2. Provides no private entity shall use biometric identifiers or
biometric information for any advertising, detailing, marketing,
promotion, or any other activity that is intended to be used to influ-
ence business volume, sales or market share or to evaluate the effec-
tiveness of marketing practices or marketing personnel, regardless of
whether the beneficiary of such activity is a governmental, for-profit
or non-profit entity.

Section 3. Contains the effective date.

 
JUSTIFICATION:

In an effort to improve safety in large venues, various private entities
like Madison Square Garden have begun to use facial recognition technol-
ogy and other biometric identifiers as part of their security systems.
While arenas do not disclose their security information, sources from
within Madison Square Garden told the New York Times that the venue has
been using facial recognition software. This technology collects infor-
mation from concert-goers, sports fans, and the like, including finger-
prints, voiceprints, eye retinas, irises, and other biometric data The
data is then run through a program to try to find any persons who might
be a risk. There is potential for this type of system to improve safety
and decrease events like MEWS shootings and bombings that have been too
common in the last two decades. But the use of this technology by
private entities is not currently efficient due to their inability to
cross-reference any data collected with comprehensive watch lists.  Even
more troubling Is the fact that these private entities are able to
profit off of the biometric data that they collect through marketing and
advertising means. This data may at times be collected covertly or
buried in the fine print when purchasing a ticket.

Allen Ganz, a director of critical infrastructure at NEC Corporation of
America, an industry leader in facial recognition, told the New York
Times that his company's system could "estimate anonymously the age and
gender of people coming into the stadium." An electronic advertising
board connected to the system could even be changed depending upon the
age and gender of who is standing in front of it.  When this data is
used for security reasons, its benefits may outweigh its drawbacks.
However, when used by private entities to make a profit, it IS a
violation of privacy. There is currently no federal law governing the
use of facial recognition technology. This legislation prohibits the use
of biometric identifiers and information for marketing purposes. This
would prevent private entities from using data, which theyclaim they are
gathering for security reasons, to profit. It is not intended to end the
practice of security systems using blometric data, but only to stop
private entities from then going on to use that data to profit from
through advertising, marketing, and promotion.

 
PRIOR LEGISLATIVE HISTORY:

2019-2020: S.2500/A.235 - Referred to Consumer Protection.

01/05/22 REFERRED TO CONSUMER PROTECTION

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect on the thirteenth day after It shall have
become a law.