Biometrics is an increasingly valuable way to ensure secure a person’s identity. Organizations have started using this to confirm certain sales. Sports teams in particular have started using biometrics as a way to make security easier to enter their ballparks. But like with everything, there are certain regulations to handling it that’s state by state and the New York Mets have seemingly run afoul of New York City’s.
When it comes to biometric protection, Illinois Biometric Information Protection Act (BIPA) is considered to be the gold standard. The law, passed in 2008 is extremely comprehensive in its wording. The law ensures that individuals are in control of their own biometric data and prohibits private companies from collecting it unless they:
- Inform the person in writing of what data is being collected or stored. (e.g. fingerprint is stored when using TouchID to log into bank account app on phone)
- Inform the person in writing of the specific purpose and length of time for which the data will be collected, stored and used. (e.g. fingerprint is stored for ease of logging into app and only for a duration of six months)
- Obtain the person’s written consent. (e.g. user signs their name before sharing their fingerprint)
Biometric information includes retina or iris scans, fingerprints, voiceprints, hand scans, facial geometry, DNA, and other unique biological information. (1)
In New York City, they’ve had a biometric identifier law on the books in 2021. Dubbed the Biometric Identifier Information Law, "It requires that businesses disclose to customers such collection, retention, conversion, storage, or sharing of their biometric data by placing a clear and conspicuous sign in plain and simple language near all customer entrances to serve as notice. It prohibits the selling, leasing, or profiting from consumers’ biometric data. The law also provides for a private right of action and allows for damages of $500 for each violation and negligent violation of the regulation, $5,000 for each intention.”(2)
The class action lawsuit stems from a holder who used biometrics to confirm their identity before they purchased their tickets. The defendant sued the ownership group, Sterling Mets, on behalf of other ticket holders and purchasers. Their lawsuit alleges the Mets, “uses facial recognition technology to collect biometric identifier information and profits from the information to the detriment of consumers.” It further contends, “that the Mets organization profits in two ways: by increasing its profit margin by using facial recognition as opposed to using manual labor to protect its 400,000 square foot premises and by selling tickets for baseball games and concerts at a premium price that customers would not have paid if they had known the price included the “surreptitious collection of their biometrics.”(3) The case is currently in the Eastern New York District Federal Court, after the team successfully moved it from state court.
Biometrics is a valuable source of personally identifiable information that is unique to every person. States and other municipalities are starting to step in to protect such information. However, until companies start realizing that such information needs to be carefully protected,
