NYC’s Biometric Identifier Information Law: Are You Covered?
Kelley Drye Client Advisory
Blanket comparisons to BIPA are not warranted because the BII Law is less stringent than BIPA and BIPA is further reaching. Both the BII Law and BIPA impart restrictions on the collection and use of biometric data, including data such as fingerprints, face scans, or voiceprints. However, BIPA generally applies to any “private entity” and the BII Law regulates “commercial establishments.” BIPA’s private entity is defined much more broadly than the NYC BII Law’s commercial establishment, and thus regulates a greater range of establishments than NYC’s BII Law.
New York City’s BII Law provides a 30-day cure period for certain violations and permits the collection of biometric data without written consent, which may result in less litigation than Illinois’ BIPA. Nonetheless, it is essential for New York businesses subject to the BII Law to be aware of its requirements and consider whether their current insurance policy covers potential BII Law liabilities.
Insurance policies that may cover BII Law-related claims include commercial general liability (CGL), employment practices liability (EPL), and cyber insurance policies.
CGL policies provide defense and indemnity coverage for “personal and advertising injury” the definition of which may cover claims for BII Law violations. Policies cover employment practices claims and often include coverage of claims for EPL employment-related invasions of privacy, which may also extend to cover BII Law-related claims. Cyber insurance policies frequently cover liability arising out of technology-related wrongful acts. Because there is a wide variation in the terms of cyber-insurance coverage, these policies need to be reviewed carefully. In some cases, the unlawful collection and disclosure of confidential information can be excluded from cyber insurance policies.
Policyholders should review their coverage and prior to securing a policy, seek advice as to what exactly their existing policy covers.
Kelley Drye’s Insurance Recovery and Counseling group is closely following developments in this area. Please click here if you would like to be kept abreast of current developments. Additionally, Kelley Drye actively tracks cases and developments related to the BII-Law and provides practical compliance and litigation counsel to help companies effectively use biometric information and mitigate business and liability risk.