![\"\"](\"https:\/\/cardozoaelj.com\/wp-content\/uploads\/2024\/11\/public-domain-on-raw-pixel--scaled.jpg\"){kind=tracking}
\u00a0<\/p>\n
The use of biometrics in the private sector has significantly expanded despite the disastrous fate of Clearview AI but in a more limited and cautious form.[1]<\/a> Google has rolled out biometric verification to the Play Store using fingerprint and facial recognition technology on device, which users can set as their default form of verification.[2]<\/a> Apple uses Face and Touch ID to protect devices and payment information. Both are entirely on device, and the only processing is the transmission from the sensor to the Secure Enclave, which encrypts and stores the user\u2019s biometric information.[3]<\/a> JPMorgan has also launched a biometrics payment program with several merchant pilots across the US.[4]<\/a> JPMorgan has partnered with software firm PopID, which offers face-pay technology that PopID claims only uses \u201copt-in\u201d and \u201caffirmative\u201d user consent to avoid conflict with local biometrics law.[5]<\/a><\/p>\n \u00a0<\/p>\n Supporters of biometrics claim that they are a robust method for preventing unauthorized access and, therefore, are very valuable from a cybersecurity perspective.[6]<\/a> However, regulators remain concerned about granting enhanced surveillance capabilities to private entities.[7]<\/a> Biometrics are also significantly less accurate at accurately identifying minorities, which can lead to unchecked bias.[8]<\/a> As a result, state and local governments have rolled out restrictive biometric laws to avoid unauthorized surveillance without informed consent.[9]<\/a><\/p>\n \u00a0<\/p>\n NYC Biometrics Law (\u00a7 22-1202(b)) provides that it \u201cshall be unlawful to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information.\u201d[10]<\/a> \u00a7 22-1202(a) permits the \u201ccommercial use, collection, and retention of biometric information\u201d if the customer is informed via conspicuous disclosure.[11]<\/a> Understanding the scope of this law is crucial to determining the viability of biometric products in NYC.<\/p>\n \u00a0<\/p>\n The issue of the scope of \u00a7 1202(b) was litigated in Gross v. Madison Square Garden,<\/em> a case that garnered a lot of media attention because it involved controversial Knicks owner James Dolan.[12]<\/a> The determinative legal issue in the case was whether there was an \u201cexchange for\u2026 value\u201d or if MSG \u201cotherwise profit[ed]\u201d from an exchange of biometric information.[13]<\/a> Plaintiffs alleged that \u201cMSG unlawfully uses the biometric data it collects from consumers via facial recognition technology to selectively remove attorneys and their clients who have commenced litigation against MSG from its venues, thus profiting by deterring litigation and reducing its litigation expenses.\u201d[14]<\/a> The court was not persuaded by this argument as it found the profit alleged by the plaintiffs to be too \u201cattenuated\u201d to fall under the scope of \u00a7 1202(b), which narrowly prohibits \u201cprofit from the transaction itself.\u201d[15]<\/a> Moreover, this would invalidate \u00a7 1202(a), which allows commercial use of biometrics with proper notice to the consumer.[16]<\/a> A broad interpretation of \u00a7\u00a01202(b) outlawing any benefit, no matter how attenuated, would invalidate all uses of biometrics in NYC as no company would use biometrics without accruing some benefit.[17]<\/a><\/p>\n \u00a0<\/p>\n Another case involving the NYC Biometrics Law is Mallouk v. Amazon.com, Inc.<\/em>, which concerned the implementation of biometrics in Amazon Go stores.[18]<\/a> Amazon\u2019s \u201cJust Walk Out\u201d technology allows customers to enter the store using their palmprints and uses cameras to identify customers, track their movement, and detect which products customers walk out with, then charges their credit card.[19]<\/a> This specific suit is regarding a combination Starbucks-Amazon Go location, which allows customers to pick up their Starbucks mobile order and also shop at Amazon Go on 59th<\/sup> Street between Park and Lexington Avenue.[20]<\/a><\/p>\n \u00a0<\/p>\n Plaintiffs alleged that Amazon did not provide the required signage to inform consumers that biometric information was being collected and that Amazon failed to fix the problem within 30 days of being notified by mail per the requirements of \u00a7\u00a022-1201(a).[21]<\/a> Defendants argued that Plaintiffs consented to biometric collection and, therefore, did not have a legitimate case. The Court found this argument unpersuasive as the NYC biometrics law does not include a consent limitation and provides that businesses must post a \u201cclear and conspicuous sign\u201d by all entrances.[22]<\/a> The fact that the consumers registered their palmprints does not imply that they consented to sharing other forms of biometric information. Therefore, the Court agreed that \u201cNYC requires specific signage for adequate notice and consent to occur.\u201d[23]<\/a><\/p>\n \u00a0<\/p>\n Plaintiffs also claimed that Amazon profited from sharing biometric information with Starbucks, violating \u00a7 22-1202(b).[24]<\/a> According to Plaintiffs, the sharing of this information allowed Amazon to link biometric information to other forms of personal information (purchase history, credit cards information, etc.) \u201cto make more targeted advertising, marketing, pricing, and promotional decisions.\u201d[25]<\/a> The Court held that this type of profit was too \u201cattenuated\u201d to violate 22-1202(b), much like in the MSG case.[26]<\/a> Amazon has closed three Amazon Go stores, citing a lack of profitability in the face of rising rent and did not comment on the role the pending litigation played.[27]<\/a><\/p>\n \u00a0<\/p>\n In light of these cases, it remains unclear what kind of transactions involving biometric data is prohibited under the \u201cotherwise profits\u201d prong of \u00a7 22-1202(b), as there is no concrete example of what would constitute a profit that is not \u201ctoo attenuated.\u201d From a policy perspective, the recommendation from the Magistrate Judge seems sounder than Judge Kaplan\u2019s ruling. Judge Kaplan\u2019s interpretation of the \u201cotherwise profits\u201d prong to mean \u201cprofit from the transaction itself\u201d[28]<\/a> gives it the same meaning as the \u201cexchange for value\u201d prong, essentially folding the two definitions into one. Holding that \u201creducing litigation costs\u201d counts as \u201cotherwise profits\u201d is more in line with the intention of the legislature to protect biometric data from being \u201csold, shared, or used in ways that the consumer does not understand or consent to.\u201d[29]<\/a><\/p>\n \u00a0<\/p>\n Regardless, businesses must still avoid directly paying for the collection of biometric information as this would likely violate \u00a7\u00a022-1202(b) under the \u201cexchange for\u2026. value\u201d prong.[30]<\/a> This prevents the accumulation of biometric databases that are then sold for profit, like Clearview AI, but not contracting for a third party to process biometric information using their own database. Thus, there is significant wiggle room for third-party biometrics providers to sell their services. However, for all allowed uses, there must still be appropriate signage at all entrances under \u00a7\u00a022-1202(a).[31]<\/a><\/p>\n \u00a0<\/p>\n [1]<\/a> In Big Win, Settlement Ensures Clearview AI Complies With Groundbreaking Illinois Biometric Privacy Law<\/em>, <\/strong>ACLU (May 9, 2022), https:\/\/www.aclu.org\/press-releases\/big-win-settlement-ensures-clearview-ai-complies-with-groundbreaking-illinois [https:\/\/perma.cc\/P2CF-W47T].<\/p>\n [2]<\/a> Cesar Cadenas, Google adds biometric verification to Play Store to keep your in-store wallet safe,<\/em> Techradar (Apr. 16, 2024),https:\/\/www.techradar.com\/computing\/software\/google-adds-biometric-verification-to-play-store-to-keep-your-in-store-wallet-safe [https:\/\/perma.cc\/S4JJ-27QZ].<\/p>\n [3]<\/a> Apple Platform Security<\/em>, Apple, https:\/\/help.apple.com\/pdf\/security\/en_GB\/apple-platform-security-guide-b.pdf [https:\/\/perma.cc\/573X-7Q5B] (last visited Nov. 13, 2024).<\/p>\n [4]<\/a> Caitlin Mullen, JPMorgan to launch biometric checkout next year<\/em>, Payments Dive (Mar. 11, 2024), https:\/\/www.paymentsdive.com\/news\/jpmorgan-payments-biometrics-checkout-face-palm-pay-popid\/709844\/ [https:\/\/perma.cc\/SW4Q-QELC].<\/p>\n [5]<\/a> Id.<\/em><\/p>\n [6]<\/a> Evie Kim Sing, OBIM spokesperson gives rare comment on biometric identification as the baseline for cyber security<\/em>, IdentityWeek (Nov. 11, 2024),https:\/\/identityweek.net\/obim-spokesperson-gives-rare-comment-on-biometric-identification-as-the-baseline-for-cyber-security\/ [https:\/\/perma.cc\/JDB4-K8GM].<\/p>\n [7]<\/a> FTC Warns About Misuses of Biometric Information and Harm to Consumers<\/em>, FTC (May 18, 2023), https:\/\/www.ftc.gov\/news-events\/news\/press-releases\/2023\/05\/ftc-warns-about-misuses-biometric-information-harm-consumers [https:\/\/perma.cc\/RY69-LR82].<\/p>\n [8]<\/a> Id.<\/em><\/p>\n [9]<\/a> See <\/em>740 Ill. Comp. Stat. 14\/1 (2008) (also known as the \u201cBiometric Information Privacy Act\u201d).<\/p>\n [10]<\/a> N.Y.C. Admin. Code \u00a7 22-1202(b).<\/p>\n [11]<\/a> N.Y.C. Admin. Code \u00a7 22-1202(a).<\/p>\n [12]<\/a> Rich Calder, Judge greenlights NYC suit alleging MSG, James Dolan used tech to ban enemies<\/em>, NY Post (Jan. 13, 2024), https:\/\/nypost.com\/2024\/01\/13\/metro\/judge-oks-nyc-suit-over-msg-james-dolan-using-tech-to-ban-enemies\/ [https:\/\/perma.cc\/CS42-HUQE].<\/p>\n [13]<\/a> Gross v. Madison Square Garden Ent. Corp., No. 23CV3380LAKJLC, 2024 WL 103235 (S.D.N.Y. Jan. 9, 2024),\u00a0report and recommendation adopted in part, rejected in part,\u00a0No. 23-CV-3380 (LAK) (JLC), 2024 WL 2055343 (S.D.N.Y. May 7, 2024) [hereinafter MSG Magistrate Opinion<\/em>].<\/p>\n [14]<\/a> Id.<\/em><\/p>\n [15]<\/a> Gross v. Madison Square Garden Ent. Corp., <\/em>No. 23-CV-3380 (LAK) (JLC), 2024 WL 2055343, at *1 (S.D.N.Y. May 7, 2024) (rejecting the recommendation by the Magistrate Judge that reducing litigation costs should fulfill the otherwise profits prong of the statute on the grounds that it would be too broad of an interpretation) [hereinafter MSG Kaplan Opinion<\/em>].<\/p>\n [16]<\/a> N.Y.C. Admin. Code \u00a7 22-1202(a).<\/p>\n [17]<\/a> MSG Kaplan Opinion<\/em>, 2024 WL 2055343, at *2.<\/p>\n [18]<\/a> Mallouk v. Amazon.com, Inc., No. C23-852-RSM, 2024 WL 3511015 (W.D. Wash. July 23, 2024)<\/p>\n [19]<\/a> Id. <\/em>at *4-5.<\/p>\n [20]<\/a> Starbucks, Starbucks Pickup and Amazon Go Collaborate to Launch New Store Concept in New York City<\/em><\/p>\n https:\/\/about.starbucks.com\/press\/2021\/starbucks-pickup-and-amazon-go-collaborate-to-launch-new-store-concept-in-new-york-city\/ (Nov. 13, 2024).<\/p>\n [21]<\/a> Id. <\/em>at *6.<\/p>\n [22]<\/a> Id. <\/em>at *9.<\/p>\n [23]<\/a> Id.<\/em> at *10.<\/p>\n [24]<\/a> Mallouk, <\/em>2024 WL 3511015, at *13.<\/p>\n [25]<\/a> Id.<\/em> at *14.<\/p>\n [26]<\/a> Id. <\/em>at *15 citing MSG Kaplan Opinion<\/em>, 2024 WL 2055343, at *1.<\/p>\n [27]<\/a> Jessica Loder, Amazon Go closes 3 NYC stores<\/em>, Retail Dive(Oct. 9, 2024), https:\/\/www.retaildive.com\/news\/3-amazon-go-stores-close-new-york\/729336\/ [https:\/\/perma.cc\/W3TE-LPFX].<\/p>\n [28]<\/a> MSG Kaplan Opinion<\/em>, 2024 WL 2055343, at *1.<\/p>\n [29]<\/a> MSG Magistrate Opinion, <\/em>2024 WL 103235, at *5 (quoting Committee Report at 12).<\/p>\n
\n