A01362 Summary:

BILL NOA01362A
 
SAME ASSAME AS S04457-A
 
SPONSORGunther
 
COSPNSRVanel, Epstein, Reyes, Sayegh, Cook, Zebrowski, Cruz, Hyndman, Glick, Dickens, Smullen, Giglio JM, McDonough, Blankenbush, Lupardo, Eachus, Kelles, Bendett, Gallahan, Simon, Gandolfo, Brabenec
 
MLTSPNSRAngelino
 
Add Art 32-A §§676 - 676-d, Gen Bus L
 
Establishes the biometric privacy act; requires private entities in possession of biometric identifiers or biometric information to develop a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual's last interaction with the private entity, whichever occurs first.
Go to top    

A01362 Actions:

BILL NOA01362A
 
01/17/2023referred to consumer affairs and protection
01/03/2024referred to consumer affairs and protection
06/03/2024amend and recommit to consumer affairs and protection
06/03/2024print number 1362a
Go to top

A01362 Committee Votes:

Go to top

A01362 Floor Votes:

There are no votes for this bill in this legislative session.
Go to top

A01362 Text:



 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                         1362--A
 
                               2023-2024 Regular Sessions
 
                   IN ASSEMBLY
 
                                    January 17, 2023
                                       ___________
 
        Introduced  by  M.  of  A. GUNTHER, VANEL, EPSTEIN, REYES, SAYEGH, COOK,
          ZEBROWSKI, CRUZ, HYNDMAN, GLICK, DICKENS, SMULLEN, J. M. GIGLIO, McDO-
          NOUGH, BLANKENBUSH, LUPARDO, EACHUS, KELLES, BENDETT, GALLAHAN, SIMON,
          GANDOLFO, BRABENEC -- Multi-Sponsored by -- M. of A. ANGELINO --  read
          once  and referred to the Committee on Consumer Affairs and Protection
          -- recommitted to the Committee on Consumer Affairs and Protection  in
          accordance  with Assembly Rule 3, sec. 2 -- committee discharged, bill
          amended, ordered reprinted as amended and recommitted to said  commit-
          tee
 
        AN  ACT  to  amend  the  general  business law, in relation to biometric
          privacy
 
          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:
 
     1    Section 1. The general business law is amended by adding a new article
     2  32-A to read as follows:
     3                                ARTICLE 32-A
     4                            BIOMETRIC PRIVACY ACT
     5  Section 676. Short title.
     6          676-a. Definitions.
     7          676-b. Retention; collection; disclosure; destruction.
     8          676-c. Regulatory authority and enforcement.
     9          676-d. Construction with other laws.
    10          676-e. Severability.
    11    §  676.  Short  title. This article shall be known and may be cited as
    12  the "biometric privacy act".
    13    § 676-a. Definitions. As used in this article: 1. "Biometric identifi-
    14  er" means a retina or iris scan, fingerprint,  voiceprint,  or  scan  of
    15  hand  or  face geometry. Biometric identifiers shall not include writing
    16  samples, written signatures, photographs, human biological samples  used
    17  for  valid  scientific  testing  or  screening, demographic data, tattoo
    18  descriptions, or physical descriptions  such  as  height,  weight,  hair

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD01142-03-4

        A. 1362--A                          2
 
     1  color,  or  eye  color.  Biometric identifiers shall not include donated
     2  body parts as defined in  section  forty-three  hundred  of  the  public
     3  health law or blood or serum stored on behalf of recipients or potential
     4  recipients  of living or cadaveric transplants and obtained or stored by
     5  a federally designated organ procurement agency.  Biometric  identifiers
     6  do  not  include  information  captured  from a patient in a health care
     7  setting or information collected, used, or stored for health care treat-
     8  ment, payment, or operations under the federal Health  Insurance  Porta-
     9  bility  and  Accountability  Act  of  1996. Biometric identifiers do not
    10  include an X-ray, roentgen process, computed tomography, magnetic  reso-
    11  nance  imaging, positron-emission tomography scan, mammography, or other
    12  image or film of the human anatomy used to diagnose, prognose, or  treat
    13  an  illness or other medical condition or to further validate scientific
    14  testing or screening.
    15    2. "Biometric information" means any information, regardless of how it
    16  is captured, converted, stored, or  shared,  based  on  an  individual's
    17  biometric  identifier used to identify an individual. Biometric informa-
    18  tion shall not include information  derived  from  items  or  procedures
    19  excluded under the definition of biometric identifiers.
    20    3. "Confidential and sensitive information" means personal information
    21  that  can  be used to uniquely identify an individual or an individual's
    22  account or property which shall include, but shall not be limited to,  a
    23  genetic  marker, genetic testing information, a unique identifier number
    24  to locate an account or property, an account number,  a  personal  iden-
    25  tification  number,  a pass code, a driver's license number, or a social
    26  security number.
    27    4. "Private entity" means any  individual,  partnership,  corporation,
    28  limited  liability  company, association, or other group, however organ-
    29  ized. A private entity shall not include a  state  or  local  government
    30  agency  or  any  court in the state, a clerk of the court, or a judge or
    31  justice thereof.
    32    5. "Written release" means informed written consent or, in the context
    33  of employment, a release executed by  an  employee  as  a  condition  of
    34  employment.
    35    §  676-b. Retention; collection; disclosure; destruction. 1. A private
    36  entity in possession of biometric identifiers or  biometric  information
    37  must  develop a written policy, made available to the public, establish-
    38  ing a retention schedule and guidelines for permanently destroying biom-
    39  etric identifiers and biometric information within  a  reasonable  time,
    40  but  in  no event later than sixty days, after it is no longer necessary
    41  to maintain for the permissible purpose or purposes  identified  in  the
    42  notice or for which the individual provided valid authorization or with-
    43  in  three  years  of  the individual's last interaction with the private
    44  entity, whichever occurs first.  Absent  a  valid  warrant  or  subpoena
    45  issued  by  a  court  of  competent  jurisdiction,  a  private entity in
    46  possession of biometric identifiers or biometric information must comply
    47  with its established retention schedule and destruction guidelines.
    48    2. No private entity may collect, capture, purchase,  receive  through
    49  trade,  or otherwise obtain a person's or a customer's biometric identi-
    50  fier or biometric information, unless it first:
    51    (a) informs the subject or the subject's legally authorized  represen-
    52  tative  in  writing that a biometric identifier or biometric information
    53  is being collected or stored;
    54    (b) informs the subject or the subject's legally authorized  represen-
    55  tative in writing of the specific purpose and length of term for which a

        A. 1362--A                          3
 
     1  biometric  identifier  or  biometric  information  is  being  collected,
     2  stored, and used; and
     3    (c)  receives  a written release executed by the subject of the biome-
     4  tric identifier  or  biometric  information  or  the  subject's  legally
     5  authorized representative.
     6    3. No private entity in possession of a biometric identifier or biome-
     7  tric  information  may  sell,  lease,  trade, or otherwise profit from a
     8  person's or a customer's biometric identifier or biometric information.
     9    4. No private entity in possession of a biometric identifier or biome-
    10  tric information may disclose, redisclose, or  otherwise  disseminate  a
    11  person's  or  a customer's biometric identifier or biometric information
    12  unless:
    13    (a) the subject of the biometric identifier or  biometric  information
    14  or  the  subject's  legally  authorized  representative  consents to the
    15  disclosure or redisclosure;
    16    (b) the disclosure or redisclosure completes a  financial  transaction
    17  requested  or  authorized  by the subject of the biometric identifier or
    18  the biometric information or the subject's legally authorized  represen-
    19  tative;
    20    (c)  the  disclosure  or redisclosure is required by federal, state or
    21  local law or municipal ordinance; or
    22    (d) the disclosure is required pursuant to a valid warrant or subpoena
    23  issued by a court of competent jurisdiction.
    24    5. A private entity in possession of a biometric identifier or  biome-
    25  tric information shall:
    26    (a) store, transmit, and protect from disclosure all biometric identi-
    27  fiers  and  biometric  information using the reasonable standard of care
    28  within the private entity's industry; and
    29    (b) store, transmit, and protect from disclosure all biometric identi-
    30  fiers and biometric information in a manner that is the same as or  more
    31  protective  than  the  manner in which the private entity stores, trans-
    32  mits, and protects other confidential and sensitive information.
    33    § 676-c. Regulatory authority  and  enforcement.  1.(a)  The  attorney
    34  general  is  authorized  and  empowered  to adopt, promulgate, amend and
    35  rescind suitable rules and regulations to carry out  the  provisions  of
    36  this  article,  including  rules  governing  the form and content of any
    37  disclosures or communications required by this article.
    38    (b) Whenever it appears to the    attorney    general,  either    upon
    39  complaint  or  otherwise,  that  any person or persons has engaged in or
    40  is about to engage in any of the acts or practices  stated to  be unlaw-
    41  ful    under   this article, the attorney general may bring an action or
    42  special proceeding in the name and on behalf of the people  of the state
    43  of New York to enjoin any violation of this article, to obtain  restitu-
    44  tion  of  any  moneys or property obtained directly or indirectly by any
    45  such  violation,  to   obtain   disgorgement   of any  profits  obtained
    46  directly  or indirectly by any such violation, to obtain civil penalties
    47  of  not  more  than twenty thousand dollars per violation, and to obtain
    48  any such other and further relief as the court may deem proper,  includ-
    49  ing preliminary relief.
    50    (c)  Each  instance  of  unlawful  processing  counts  as  a  separate
    51  violation.  Unlawful processing of the personal data of  more  than  one
    52  consumer  counts  as a  separate  violation  as  to  each consumer. Each
    53  provision of this article  that  is  violated  counts  as    a  separate
    54  violation.
    55    (d)  In  assessing  the  amount  of penalties, the court must consider
    56  anyone  or  more  of  the  relevant  circumstances  presented by any  of

        A. 1362--A                          4
 
     1  the parties, including, but not limited to, the nature  and  seriousness
     2  of  the  misconduct,  the  number  of violations, the persistence of the
     3  misconduct,  the  length of time over which the misconduct occurred, the
     4  willfulness of the  violator's  misconduct,  and  the  violator's finan-
     5  cial condition.
     6    2.  Any  action  or special proceeding brought by the attorney general
     7  pursuant to this section must be commenced within six years of the  date
     8  on which the attorney general became aware of the violation.
     9    3.  In connection with any proposed action or special proceeding under
    10  this section, the attorney general is authorized to take proof and  make
    11  a determination of the relevant facts, and to issue subpoenas in accord-
    12  ance  with  the  civil practice law and rules.  The attorney general may
    13  also require such other data and information as the attorney general may
    14  deem  relevant  and  may  require  written  responses to questions under
    15  oath. Such power of subpoena and examination shall not abate  or  termi-
    16  nate  by  reason of  any  action  or  special  proceeding brought by the
    17  attorney general under this article.
    18    4. Any person, within or outside the state, who the  attorney  general
    19  believes may be in possession, custody, or control of any books, papers,
    20  or  other things, or may have information, relevant to acts or practices
    21  stated to be unlawful in this article is subject to  the  service  of  a
    22  subpoena  issued  by  the  attorney  general  pursuant  to this section.
    23  Service may be made in any manner that is authorized for  service  of  a
    24  subpoena or a summons by the state in which service is made.
    25    5.(a)  Failure  to  comply  with  a  subpoena  issued pursuant to this
    26  section without reasonable cause tolls the applicable statutes of  limi-
    27  tations  in  any  action  or  special proceeding brought by the attorney
    28  general against the noncompliant person that arises out of the  attorney
    29  general's investigation.
    30    (b)  If a person fails to comply with a subpoena  issued  pursuant  to
    31  this section, the attorney general may move  in  the  supreme  court  to
    32  compel compliance.  If the court finds that the subpoena was authorized,
    33  it  shall  order  compliance and may impose a civil penalty of up to one
    34  thousand dollars per day of noncompliance.
    35    (c) Such tolling and civil penalty shall be in addition to  any  other
    36  penalties or remedies provided by law for noncompliance with a subpoena.
    37    6.  This section shall apply to all acts declared to be unlawful under
    38  this article, whether or not subject to any other law of this state, and
    39  shall not supersede, amend or repeal any other law of this  state  under
    40  which  the  attorney general is authorized to take any action or conduct
    41  any inquiry.
    42    §  676-d.  Construction  with  other  laws. 1. Nothing in this article
    43  shall be construed to impact the admission  or  discovery  of  biometric
    44  identifiers  and  biometric information in any action of any kind in any
    45  court, or before any tribunal, board, agency, or person.
    46    2. Nothing in this article shall be construed  to  conflict  with  the
    47  federal Health Insurance Portability and Accountability Act of 1996.
    48    3.  Nothing in the article shall be deemed to apply in any manner to a
    49  financial institution or an affiliate of a financial institution that is
    50  subject to Title V of the federal Gramm-Leach-Bliley Act of 1999.
    51    4. Nothing in this article shall be construed to apply to  a  contrac-
    52  tor,  subcontractor, or agent of a state agency of local government when
    53  working for that state agency of local government.
    54    § 676-e. Severability. If any provision of this article, or any appli-
    55  cation of any provision of this article, is held  to  be  invalid,  that
    56  shall not affect the validity or effectiveness of any other provision of

        A. 1362--A                          5
 
     1  this article, or of any other application of any provision of this arti-
     2  cle,  which  can  be given effect without that provision or application;
     3  and to that end, the provisions and applications  of  this  article  are
     4  severable.
     5    §  2.  This  act shall take effect on the ninetieth day after it shall
     6  have become a law.
Go to top