By Ryan Whalen, originally published in Spectrum News on March 17, 2021, 3:42 PM ET.

Buffalo Legal Expert Explains Proposed Biometric Privacy Act

BUFFALO, N.Y. — Biometric data can be defined fairly broadly to include any information that can identify an individual based on that person’s physical characteristics or mannerisms.

It includes things like facial recognition technology.

“There’s been an increase in interest in protecting people’s biometric information, particularly given the fact that a lot of organizations are relying pretty heavily on biometric information in order to conduct their business as the pandemic continues to impede people’s return to physical offices,” Anna Mercado Clark, Phillips Lytle partner and head of the firm’s data security and privacy practice team, said.

Mercado Clark said this year is not the first time New York lawmakers are proposing biometric privacy legislation, but there are signs 2021 could be the year it passes, including a bipartisan slate of sponsors.

“The law would require that the private entities collecting the information give certain notices about the kind of data that they’re collecting. So gone would be the days, hopefully, that your data is being collected without you even knowing that it’s being collected,” she said.

The attorney said the proposed New York Biometric Privacy Act echoes legislation that’s been in place in Illinois for more than a decade. On top of disclosure rules, it would prohibit private entities from selling the data they collect for profit and includes provisions regarding how the information should be protected and how long it can be kept.

“This law proposes to allow individuals like you and me to bring our own lawsuits, to bring our own claims against these companies if they violate the provisions of the laws,” Mercado Clark said.

Unlike many other state laws that rely on attorney generals to force compliance, the Biometric Privacy Act would allow individuals to sue for damages ranging from $1,000 to up to $5,000 if the violation was willful or reckless.

Mercado Clark said a similar provision in Illinois’ law has recently lead to some of the largest class action privacy lawsuits in history, including settlements from social media giants Facebook and TikTok.