Bill > S01422

This bill establishes the Biometric Privacy Act in New York, which requires private entities that collect or possess biometric identifiers (such as retina or iris scans, fingerprints, voiceprints, or facial geometry) to develop and publicly disclose a written policy for handling such sensitive information. The policy must outline a retention schedule that permanently destroys biometric data within 60 days after it is no longer necessary, or within three years of the individual's last interaction with the entity, whichever comes first. The bill mandates that private entities obtain written consent before collecting biometric information, clearly inform individuals about the purpose and duration of data collection, and prohibits selling or profiting from this data. Additionally, the bill allows the Attorney General to enforce these regulations through actions that can result in civil penalties up to $20,000 per violation, with considerations given to the nature and extent of the misconduct. The legislation provides some exceptions, such as for financial transactions, legal requirements, or warrant-issued disclosures, and explicitly does not apply to certain entities like healthcare providers, financial institutions, and government agencies. The act aims to protect individuals' biometric privacy by establishing clear guidelines for the collection, use, storage, and destruction of sensitive personal identifiers.

Business and Industry

https://www.nysenate.gov/legislation/bills/2025/S1422