S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  4457--A
 
                        2023-2024 Regular Sessions
 
                             I N  S E N A T E
 
                             February 9, 2023
                                ___________
 
 Introduced  by  Sen.  LIU  --  read  twice and ordered printed, and when
   printed to be committed to the Committee  on  Consumer  Protection  --
   recommitted to the Committee on Consumer Protection in accordance with
   Senate  Rule  6, sec. 8 -- committee discharged, bill amended, ordered
   reprinted as amended and recommitted to said committee

 AN ACT to amend the general  business  law,  in  relation  to  biometric
   privacy
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new article
 32-A to read as follows:
                               ARTICLE 32-A
                           BIOMETRIC PRIVACY ACT
 SECTION 676. SHORT TITLE.
         676-A. DEFINITIONS.
         676-B. RETENTION; COLLECTION; DISCLOSURE; DESTRUCTION.
         676-C. REGULATORY AUTHORITY AND ENFORCEMENT.
         676-D. CONSTRUCTION WITH OTHER LAWS.
         676-E. SEVERABILITY.
   § 676. SHORT TITLE. THIS ARTICLE SHALL BE KNOWN AND MAY  BE  CITED  AS
 THE "BIOMETRIC PRIVACY ACT".
   § 676-A. DEFINITIONS. AS USED IN THIS ARTICLE: 1. "BIOMETRIC IDENTIFI-
 ER"  MEANS  A  RETINA  OR IRIS SCAN, FINGERPRINT, VOICEPRINT, OR SCAN OF
 HAND OR FACE GEOMETRY. BIOMETRIC IDENTIFIERS SHALL NOT  INCLUDE  WRITING
 SAMPLES,  WRITTEN SIGNATURES, PHOTOGRAPHS, HUMAN BIOLOGICAL SAMPLES USED
 FOR VALID SCIENTIFIC TESTING  OR  SCREENING,  DEMOGRAPHIC  DATA,  TATTOO
 DESCRIPTIONS,  OR  PHYSICAL  DESCRIPTIONS  SUCH  AS HEIGHT, WEIGHT, HAIR
 COLOR, OR EYE COLOR. BIOMETRIC IDENTIFIERS  SHALL  NOT  INCLUDE  DONATED
 BODY  PARTS  AS  DEFINED  IN  SECTION  FORTY-THREE HUNDRED OF THE PUBLIC
 HEALTH LAW OR BLOOD OR SERUM STORED ON BEHALF OF RECIPIENTS OR POTENTIAL
 RECIPIENTS OF LIVING OR CADAVERIC TRANSPLANTS AND OBTAINED OR STORED  BY
 A  FEDERALLY  DESIGNATED ORGAN PROCUREMENT AGENCY. BIOMETRIC IDENTIFIERS
 DO NOT INCLUDE INFORMATION CAPTURED FROM A  PATIENT  IN  A  HEALTH  CARE
 SETTING OR INFORMATION COLLECTED, USED, OR STORED FOR HEALTH CARE TREAT-
 
              

  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD01142-02-4
 S. 4457--A                          2
 
 MENT,  PAYMENT,  OR OPERATIONS UNDER THE FEDERAL HEALTH INSURANCE PORTA-
 BILITY AND ACCOUNTABILITY ACT OF  1996.  BIOMETRIC  IDENTIFIERS  DO  NOT
 INCLUDE  AN X-RAY, ROENTGEN PROCESS, COMPUTED TOMOGRAPHY, MAGNETIC RESO-
 NANCE  IMAGING, POSITRON-EMISSION TOMOGRAPHY SCAN, MAMMOGRAPHY, OR OTHER
 IMAGE OR FILM OF THE HUMAN ANATOMY USED TO DIAGNOSE, PROGNOSE, OR  TREAT
 AN  ILLNESS OR OTHER MEDICAL CONDITION OR TO FURTHER VALIDATE SCIENTIFIC
 TESTING OR SCREENING.
   2. "BIOMETRIC INFORMATION" MEANS ANY INFORMATION, REGARDLESS OF HOW IT
 IS CAPTURED, CONVERTED, STORED, OR  SHARED,  BASED  ON  AN  INDIVIDUAL'S
 BIOMETRIC  IDENTIFIER USED TO IDENTIFY AN INDIVIDUAL. BIOMETRIC INFORMA-
 TION SHALL NOT INCLUDE INFORMATION  DERIVED  FROM  ITEMS  OR  PROCEDURES
 EXCLUDED UNDER THE DEFINITION OF BIOMETRIC IDENTIFIERS.
   3. "CONFIDENTIAL AND SENSITIVE INFORMATION" MEANS PERSONAL INFORMATION
 THAT  CAN  BE USED TO UNIQUELY IDENTIFY AN INDIVIDUAL OR AN INDIVIDUAL'S
 ACCOUNT OR PROPERTY WHICH SHALL INCLUDE, BUT SHALL NOT BE LIMITED TO,  A
 GENETIC  MARKER, GENETIC TESTING INFORMATION, A UNIQUE IDENTIFIER NUMBER
 TO LOCATE AN ACCOUNT OR PROPERTY, AN ACCOUNT NUMBER,  A  PERSONAL  IDEN-
 TIFICATION  NUMBER,  A PASS CODE, A DRIVER'S LICENSE NUMBER, OR A SOCIAL
 SECURITY NUMBER.
   4. "PRIVATE ENTITY" MEANS ANY  INDIVIDUAL,  PARTNERSHIP,  CORPORATION,
 LIMITED  LIABILITY  COMPANY, ASSOCIATION, OR OTHER GROUP, HOWEVER ORGAN-
 IZED. A PRIVATE ENTITY SHALL NOT INCLUDE A  STATE  OR  LOCAL  GOVERNMENT
 AGENCY  OR  ANY  COURT IN THE STATE, A CLERK OF THE COURT, OR A JUDGE OR
 JUSTICE THEREOF.
   5. "WRITTEN RELEASE" MEANS INFORMED WRITTEN CONSENT OR, IN THE CONTEXT
 OF EMPLOYMENT, A RELEASE EXECUTED BY  AN  EMPLOYEE  AS  A  CONDITION  OF
 EMPLOYMENT.
   §  676-B. RETENTION; COLLECTION; DISCLOSURE; DESTRUCTION. 1. A PRIVATE
 ENTITY IN POSSESSION OF BIOMETRIC IDENTIFIERS OR  BIOMETRIC  INFORMATION
 MUST  DEVELOP A WRITTEN POLICY, MADE AVAILABLE TO THE PUBLIC, ESTABLISH-
 ING A RETENTION SCHEDULE AND GUIDELINES FOR PERMANENTLY DESTROYING BIOM-
 ETRIC IDENTIFIERS AND BIOMETRIC INFORMATION WITHIN  A  REASONABLE  TIME,
 BUT  IN  NO EVENT LATER THAN SIXTY DAYS, AFTER IT IS NO LONGER NECESSARY
 TO MAINTAIN FOR THE PERMISSIBLE PURPOSE OR PURPOSES  IDENTIFIED  IN  THE
 NOTICE OR FOR WHICH THE INDIVIDUAL PROVIDED VALID AUTHORIZATION OR WITH-
 IN  THREE  YEARS  OF  THE INDIVIDUAL'S LAST INTERACTION WITH THE PRIVATE
 ENTITY, WHICHEVER OCCURS FIRST.  ABSENT  A  VALID  WARRANT  OR  SUBPOENA
 ISSUED  BY  A  COURT  OF  COMPETENT  JURISDICTION,  A  PRIVATE ENTITY IN
 POSSESSION OF BIOMETRIC IDENTIFIERS OR BIOMETRIC INFORMATION MUST COMPLY
 WITH ITS ESTABLISHED RETENTION SCHEDULE AND DESTRUCTION GUIDELINES.
   2. NO PRIVATE ENTITY MAY COLLECT, CAPTURE, PURCHASE,  RECEIVE  THROUGH
 TRADE,  OR OTHERWISE OBTAIN A PERSON'S OR A CUSTOMER'S BIOMETRIC IDENTI-
 FIER OR BIOMETRIC INFORMATION, UNLESS IT FIRST:
   (A) INFORMS THE SUBJECT OR THE SUBJECT'S LEGALLY AUTHORIZED  REPRESEN-
 TATIVE  IN  WRITING THAT A BIOMETRIC IDENTIFIER OR BIOMETRIC INFORMATION
 IS BEING COLLECTED OR STORED;
   (B) INFORMS THE SUBJECT OR THE SUBJECT'S LEGALLY AUTHORIZED  REPRESEN-
 TATIVE IN WRITING OF THE SPECIFIC PURPOSE AND LENGTH OF TERM FOR WHICH A
 BIOMETRIC  IDENTIFIER  OR  BIOMETRIC  INFORMATION  IS  BEING  COLLECTED,
 STORED, AND USED; AND
   (C) RECEIVES A WRITTEN RELEASE EXECUTED BY THE SUBJECT OF  THE  BIOME-
 TRIC  IDENTIFIER  OR  BIOMETRIC  INFORMATION  OR  THE  SUBJECT'S LEGALLY
 AUTHORIZED REPRESENTATIVE.
   3. NO PRIVATE ENTITY IN POSSESSION OF A BIOMETRIC IDENTIFIER OR BIOME-
 TRIC INFORMATION MAY SELL, LEASE, TRADE,  OR  OTHERWISE  PROFIT  FROM  A
 PERSON'S OR A CUSTOMER'S BIOMETRIC IDENTIFIER OR BIOMETRIC INFORMATION.
 S. 4457--A                          3

   4. NO PRIVATE ENTITY IN POSSESSION OF A BIOMETRIC IDENTIFIER OR BIOME-
 TRIC  INFORMATION  MAY  DISCLOSE, REDISCLOSE, OR OTHERWISE DISSEMINATE A
 PERSON'S OR A CUSTOMER'S BIOMETRIC IDENTIFIER OR  BIOMETRIC  INFORMATION
 UNLESS:
   (A)  THE  SUBJECT OF THE BIOMETRIC IDENTIFIER OR BIOMETRIC INFORMATION
 OR THE SUBJECT'S  LEGALLY  AUTHORIZED  REPRESENTATIVE  CONSENTS  TO  THE
 DISCLOSURE OR REDISCLOSURE;
   (B)  THE  DISCLOSURE OR REDISCLOSURE COMPLETES A FINANCIAL TRANSACTION
 REQUESTED OR AUTHORIZED BY THE SUBJECT OF THE  BIOMETRIC  IDENTIFIER  OR
 THE  BIOMETRIC INFORMATION OR THE SUBJECT'S LEGALLY AUTHORIZED REPRESEN-
 TATIVE;
   (C) THE DISCLOSURE OR REDISCLOSURE IS REQUIRED BY  FEDERAL,  STATE  OR
 LOCAL LAW OR MUNICIPAL ORDINANCE; OR
   (D) THE DISCLOSURE IS REQUIRED PURSUANT TO A VALID WARRANT OR SUBPOENA
 ISSUED BY A COURT OF COMPETENT JURISDICTION.
   5.  A PRIVATE ENTITY IN POSSESSION OF A BIOMETRIC IDENTIFIER OR BIOME-
 TRIC INFORMATION SHALL:
   (A) STORE, TRANSMIT, AND PROTECT FROM DISCLOSURE ALL BIOMETRIC IDENTI-
 FIERS AND BIOMETRIC INFORMATION USING THE REASONABLE  STANDARD  OF  CARE
 WITHIN THE PRIVATE ENTITY'S INDUSTRY; AND
   (B) STORE, TRANSMIT, AND PROTECT FROM DISCLOSURE ALL BIOMETRIC IDENTI-
 FIERS  AND BIOMETRIC INFORMATION IN A MANNER THAT IS THE SAME AS OR MORE
 PROTECTIVE THAN THE MANNER IN WHICH THE PRIVATE  ENTITY  STORES,  TRANS-
 MITS, AND PROTECTS OTHER CONFIDENTIAL AND SENSITIVE INFORMATION.
   §  676-C.  REGULATORY  AUTHORITY  AND  ENFORCEMENT. 1.(A) THE ATTORNEY
 GENERAL IS AUTHORIZED AND EMPOWERED  TO  ADOPT,  PROMULGATE,  AMEND  AND
 RESCIND  SUITABLE  RULES  AND REGULATIONS TO CARRY OUT THE PROVISIONS OF
 THIS ARTICLE, INCLUDING RULES GOVERNING THE  FORM  AND  CONTENT  OF  ANY
 DISCLOSURES OR COMMUNICATIONS REQUIRED BY THIS ARTICLE.
   (B)  WHENEVER  IT  APPEARS  TO THE   ATTORNEY   GENERAL, EITHER   UPON
 COMPLAINT  OR  OTHERWISE,  THAT  ANY PERSON OR PERSONS HAS ENGAGED IN OR
 IS ABOUT TO ENGAGE IN ANY OF THE ACTS OR PRACTICES  STATED TO  BE UNLAW-
 FUL  UNDER  THIS ARTICLE, THE ATTORNEY GENERAL MAY BRING  AN  ACTION  OR
 SPECIAL PROCEEDING IN THE NAME AND ON BEHALF OF THE PEOPLE  OF THE STATE
 OF  NEW YORK TO ENJOIN ANY VIOLATION OF THIS ARTICLE, TO OBTAIN RESTITU-
 TION OF ANY MONEYS OR PROPERTY OBTAINED DIRECTLY OR  INDIRECTLY  BY  ANY
 SUCH   VIOLATION,   TO   OBTAIN   DISGORGEMENT   OF ANY PROFITS OBTAINED
 DIRECTLY OR INDIRECTLY BY ANY SUCH VIOLATION, TO OBTAIN CIVIL  PENALTIES
 OF  NOT  MORE  THAN TWENTY THOUSAND DOLLARS PER VIOLATION, AND TO OBTAIN
 ANY  SUCH OTHER AND FURTHER RELIEF AS THE COURT MAY DEEM PROPER, INCLUD-
 ING PRELIMINARY RELIEF.
   (C)  EACH  INSTANCE  OF  UNLAWFUL  PROCESSING  COUNTS  AS  A  SEPARATE
 VIOLATION.    UNLAWFUL  PROCESSING OF THE PERSONAL DATA OF MORE THAN ONE
 CONSUMER COUNTS AS A  SEPARATE  VIOLATION  AS  TO   EACH CONSUMER.  EACH
 PROVISION  OF  THIS  ARTICLE  THAT  IS  VIOLATED  COUNTS AS   A SEPARATE
 VIOLATION.
   (D) IN ASSESSING THE AMOUNT OF  PENALTIES,  THE  COURT  MUST  CONSIDER
 ANYONE   OR  MORE  OF  THE  RELEVANT  CIRCUMSTANCES  PRESENTED BY ANY OF
 THE PARTIES, INCLUDING, BUT NOT LIMITED TO, THE NATURE  AND  SERIOUSNESS
 OF THE MISCONDUCT, THE NUMBER OF  VIOLATIONS,  THE  PERSISTENCE  OF  THE
 MISCONDUCT,  THE  LENGTH OF TIME OVER WHICH THE MISCONDUCT OCCURRED, THE
 WILLFULNESS OF THE  VIOLATOR'S  MISCONDUCT,  AND  THE  VIOLATOR'S FINAN-
 CIAL CONDITION.
   2.  ANY  ACTION  OR SPECIAL PROCEEDING BROUGHT BY THE ATTORNEY GENERAL
 PURSUANT TO THIS SECTION MUST BE COMMENCED WITHIN SIX YEARS OF THE  DATE
 ON WHICH THE ATTORNEY GENERAL BECAME AWARE OF THE VIOLATION.
 S. 4457--A                          4

   3.  IN CONNECTION WITH ANY PROPOSED ACTION OR SPECIAL PROCEEDING UNDER
 THIS SECTION, THE ATTORNEY GENERAL IS AUTHORIZED TO TAKE PROOF AND  MAKE
 A DETERMINATION OF THE RELEVANT FACTS, AND TO ISSUE SUBPOENAS IN ACCORD-
 ANCE  WITH  THE  CIVIL PRACTICE LAW AND RULES.  THE ATTORNEY GENERAL MAY
 ALSO REQUIRE SUCH OTHER DATA AND INFORMATION AS THE ATTORNEY GENERAL MAY
 DEEM  RELEVANT  AND  MAY  REQUIRE  WRITTEN  RESPONSES TO QUESTIONS UNDER
 OATH. SUCH POWER OF SUBPOENA AND EXAMINATION SHALL NOT ABATE  OR  TERMI-
 NATE  BY  REASON OF  ANY  ACTION  OR  SPECIAL  PROCEEDING BROUGHT BY THE
 ATTORNEY GENERAL UNDER THIS ARTICLE.
   4. ANY PERSON, WITHIN OR OUTSIDE THE STATE, WHO THE  ATTORNEY  GENERAL
 BELIEVES MAY BE IN POSSESSION, CUSTODY, OR CONTROL OF ANY BOOKS, PAPERS,
 OR  OTHER THINGS, OR MAY HAVE INFORMATION, RELEVANT TO ACTS OR PRACTICES
 STATED TO BE UNLAWFUL IN THIS ARTICLE IS SUBJECT TO  THE  SERVICE  OF  A
 SUBPOENA  ISSUED  BY  THE  ATTORNEY  GENERAL  PURSUANT  TO THIS SECTION.
 SERVICE MAY BE MADE IN ANY MANNER THAT IS AUTHORIZED FOR  SERVICE  OF  A
 SUBPOENA OR A SUMMONS BY THE STATE IN WHICH SERVICE IS MADE.
   5.(A)  FAILURE  TO  COMPLY  WITH  A  SUBPOENA  ISSUED PURSUANT TO THIS
 SECTION WITHOUT REASONABLE CAUSE TOLLS THE APPLICABLE STATUTES OF  LIMI-
 TATIONS  IN  ANY  ACTION  OR  SPECIAL PROCEEDING BROUGHT BY THE ATTORNEY
 GENERAL AGAINST THE NONCOMPLIANT PERSON THAT ARISES OUT OF THE  ATTORNEY
 GENERAL'S INVESTIGATION.
   (B)  IF A PERSON FAILS TO COMPLY WITH A SUBPOENA  ISSUED  PURSUANT  TO
 THIS SECTION, THE ATTORNEY GENERAL MAY MOVE  IN  THE  SUPREME  COURT  TO
 COMPEL COMPLIANCE.  IF THE COURT FINDS THAT THE SUBPOENA WAS AUTHORIZED,
 IT  SHALL  ORDER  COMPLIANCE AND MAY IMPOSE A CIVIL PENALTY OF UP TO ONE
 THOUSAND DOLLARS PER DAY OF NONCOMPLIANCE.
   (C) SUCH TOLLING AND CIVIL PENALTY SHALL BE IN ADDITION TO  ANY  OTHER
 PENALTIES OR REMEDIES PROVIDED BY LAW FOR NONCOMPLIANCE WITH A SUBPOENA.
   6.  THIS SECTION SHALL APPLY TO ALL ACTS DECLARED TO BE UNLAWFUL UNDER
 THIS ARTICLE, WHETHER OR NOT SUBJECT TO ANY OTHER LAW OF THIS STATE, AND
 SHALL NOT SUPERSEDE, AMEND OR REPEAL ANY OTHER LAW OF THIS  STATE  UNDER
 WHICH  THE  ATTORNEY GENERAL IS AUTHORIZED TO TAKE ANY ACTION OR CONDUCT
 ANY INQUIRY.
   §  676-D.  CONSTRUCTION  WITH  OTHER  LAWS. 1. NOTHING IN THIS ARTICLE
 SHALL BE CONSTRUED TO IMPACT THE ADMISSION  OR  DISCOVERY  OF  BIOMETRIC
 IDENTIFIERS  AND  BIOMETRIC INFORMATION IN ANY ACTION OF ANY KIND IN ANY
 COURT, OR BEFORE ANY TRIBUNAL, BOARD, AGENCY, OR PERSON.
   2. NOTHING IN THIS ARTICLE SHALL BE CONSTRUED  TO  CONFLICT  WITH  THE
 FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996.
   3.  NOTHING IN THE ARTICLE SHALL BE DEEMED TO APPLY IN ANY MANNER TO A
 FINANCIAL INSTITUTION OR AN AFFILIATE OF A FINANCIAL INSTITUTION THAT IS
 SUBJECT TO TITLE V OF THE FEDERAL GRAMM-LEACH-BLILEY ACT OF 1999.
   4. NOTHING IN THIS ARTICLE SHALL BE CONSTRUED TO APPLY TO  A  CONTRAC-
 TOR,  SUBCONTRACTOR, OR AGENT OF A STATE AGENCY OF LOCAL GOVERNMENT WHEN
 WORKING FOR THAT STATE AGENCY OF LOCAL GOVERNMENT.
   § 676-E. SEVERABILITY. IF ANY PROVISION OF THIS ARTICLE, OR ANY APPLI-
 CATION OF ANY PROVISION OF THIS ARTICLE, IS HELD  TO  BE  INVALID,  THAT
 SHALL NOT AFFECT THE VALIDITY OR EFFECTIVENESS OF ANY OTHER PROVISION OF
 THIS ARTICLE, OR OF ANY OTHER APPLICATION OF ANY PROVISION OF THIS ARTI-
 CLE,  WHICH  CAN  BE GIVEN EFFECT WITHOUT THAT PROVISION OR APPLICATION;
 AND TO THAT END, THE PROVISIONS AND APPLICATIONS  OF  THIS  ARTICLE  ARE
 SEVERABLE.
   §  2.  This  act shall take effect on the ninetieth day after it shall
 have become a law.