Last week a new privacy law limiting what businesses can do with
biometric data (for example, facial recognition information and
fingerprints) took effect in New York City. The new ordinance
requires commercial establishments that collect biometric
information to post notices to customers explaining how their data
will be used. The law applies to a wide range of businesses,
including stores, restaurants, and theaters. The ordinance defines
"biometric identifier information" as any
"physiological or biological characteristic that is used by or
on behalf of a commercial establishment, singly or in combination,
to identify, or assist in identifying, an individual, including,
but not limited to: (i) a retina or iris scan, (ii) a fingerprint
or voiceprint, (iii) a scan of hand or face geometry, or any other
identifying characteristic." The law does, however, permit the
collection, use, and retention of biometric identifying data if a
notice to customers in "plain, simple
