Erie County enacts ban on businesses collecting biometric data

“This is not about stopping innovation, technology or thwarting loss prevention methods,” said Erie County Legislator Lawrence Dupre.

BUFFALO, N.Y. — Erie County Executive Mark Poloncarz has signed a first-of-its-kind law in New York State, officially barring local businesses from collecting, storing, using, and selling customers’ biometric information.

The new legislation applies to all businesses in the county, ranging from major big-box retailers to small “mom and pop” shops. 

This story continues below.

More in Local

Under the law, commercial entities are strictly prohibited from utilizing residents’ unique biological characteristics, including fingerprints, facial scans, iris scans, genetics, and voice prints.

“This is not about stopping innovation, technology or thwarting loss prevention methods,” said Erie County Legislator Lawrence Dupre, the bill’s sponsor. “This is about protecting consumer privacy, creating reasonable safeguards so residents know when their information is being collected and how it’s being used.”

Dupre alongside legislator Lindsay Lorigo originally proposed bipartisan legislation that would have required businesses to disclose whether they collect customer’s biometric data, citing recent signs posted at a Wegmans in New York City. Poloncarz said they wanted to pass something stronger.

The bill passed the legislature by a party line vote of 7-4. After the vote, Lorigo expressed concerns about the ban, noting the impact on local businesses.

While the law does not ban traditional surveillance cameras, photographs, or video recordings, it strictly prohibits businesses from running that footage through recognition software to build consumer profiles. Notable exemptions include government agencies, financial institutions, law enforcement acting with a warrant, and personal device authentication, such as cellphone Face-ID.

Poloncarz noted how the law will have unique implications for funeral homes and deceased versus living persons. Casinos he said will also be unaffected by the law as they are governed by state law.

Enforcement of the complaint-driven law puts the burden on the business community. All companies in Erie County are required to self-report whether they use biometric data. Those with existing data must notify the county, implement a destruction plan, and end the practice within 30 days or face steep fines.

“Under the language of the law every company is required to provide that information to us,” said Trek Fulater, Director of Policy for Erie County. “So if we don’t hear from a company and we have no information whatsoever and then there’s a consumer complaint or we know certain companies, as part of their policies, that they perform this work that we will be reaching out to them, but we’re not proactively going to the business community thus far.”

Poloncarz said that other New York municipalities including Syracuse have already reached out to Erie County to model their own legislation after the law. Erie County drew its inspiration from a law in Portland, Oregon that protects against the use of biometric data.

Business owners looking to learn how the law applies to them can contact the Erie County Division of Consumer Protection or visit erie.gov/biometrics.