Have You Complied With Erie County’s New Biometric Privacy Law

Today, we're going to talk about a game changer here in Erie County, New York. Erie County is the first county in the state of New York to pass what is known as the Biometrics Transparency and Privacy Act. It's local law 1-2026, earlier this year passed by the Erie County Legislature, approved by the Erie County Executive, and effective June 5, 2026. And as you'll hear, what that means is that as of right now, if you haven't already done what you're supposed to do, you have just a few days to do it.

And if you don't, you could be subject to substantial penalties under this local law. All right. So let's talk about it. We're going to talk about the who, what, where, when, and why.

But first things first, we need to talk about what biometric information is. Now, we know what this is. But I'm going to give you the list. According to the local law, it includes depictions, images, descriptions, or recordings of facial features, iris or retina, finger or handprints, voice, genetics, or characteristic movements or gestures.

For example, gait, how you walk, or a typing pattern. Biometric information also includes data derived from those depictions, images, and descriptions. So this definition is meant to be very, very broad. And we're going to talk about why the legislature was so concerned about protecting biometric information a little bit later.

So that's what it means. And with that definition in mind, let's get to those five W's. First, the who. Who does this local law apply to?

And the short answer is pretty much everyone except for the government. What do I mean by that? Well, it applies to commercial establishments, which means essentially any person or organization, regardless of how your business is organized, a firm, partnership, association, corporation, or other entity that operates a place of business within Erie County and offers goods or services to the public, whether for profit or not for profit. The term commercial establishment does not, however, include any governmental agency employees or agents acting within the scope of their governmental duties.

In other words, if you're not the government, you pretty much have to comply with this local law. So that's the who. Now, let's talk about the what. What you may not do and what you must do.

Let's start with what you may not do. Section four of the law, prohibition. Here's what it says. except as provided in section seven below, which lists exceptions that we're going to cover in a minute.

So except for the exceptions, commercial establishments like you are prohibited from collecting, storing, procuring, using, and selling or otherwise monetizing a customer's biometric identifier information. So if you have any of that biometric information, if you collect it, store it, use it, send it somewhere else, you are now prohibited from doing that. That's what you may not do. Now, let's get to what you must do.

And this is important because you must do the first thing on this list within 30 days of June 5th, which by my count ends on July 5th, which is a Sunday. Now, I suppose there are publicly available forms you can use for all of this. So I suppose you could do this on a Saturday or Sunday, but if you want to do it on a business day, the last business day to comply with what we about to talk about is Friday July 3rd All right so here what you must do First notice within 30 days or by July 5th 2026 which falls on a Sunday you must provide notice to the director.

Who's the director? Well, fortunately, the local law tells us who that is. the director is the director of the Erie County Department of Public Advocacy Division of Consumer Protection. That's the director we're talking about.

So by July 5th, 2026, you must provide written notice to that director that you are in possession of biometric information. Now, if you're not in possession of any biometric information, you don't have to give notice. But if you are, you must give notice by July 5th. And that notice has to include a couple of things.

First, you've got to include a summary of the amount and type of biometric information that you have. And you have to establish a destruction policy. In other words, the method and timing of your permanent deletion or destruction of all that biometric information. And there's a where in here.

We're going to come back to it. So by July 5th, you've got to give notice. The good news is if none of that made sense to you, and I'm sure all of it did, but if none of that made sense to you, the Erie County director has on the county website, a form notice that you may use. So you've got to give that notice.

And by the way, if you don't give that notice, you may be subject to a civil penalty of $1,000 a day for every day. You don't comply. All right, so that's the first thing you must do. The second thing you must do is certification.

So let's say that you wait until the last day to provide notice to the director that you have these types of biometric information and that you will destroy or delete them in a certain way. Within 30 days of July 5th, you must provide an affidavit to the director certifying that you have, in fact, permanently deleted or destroyed all of that biometric information that you had in your possession. And if you don't do that, the penalty gets stiffer because any commercial establishment that violates that certification requirement may be subject to a civil penalty of $5,000 per day for each day of the violation.

Now, as far as these penalties go, you do get a period of time to cure your violation. So what would likely happen is that the director, as we defined him earlier, will send you a notice that you are not in compliance. How are they going to know you're not in compliance? My guess is that the county, being the county, is going to have a list of all businesses and organizations within the county itself.

They're going to cross-check that against the responses that they received from the organizations that are subject to this law. And if you're not on that list, you're going to notice that you violated. You'll have a period of time, 30 days, to cure your violation. And then if you don't cure it, you'll be subject to those penalties, either $1,000 a day for failing to give the notice or $5,000 a day for failing to give the certification.

And I suppose if you haven't given the notice, you haven't given the certification either. So is it possible that you could be stuck with both of those penalties? I'll think about that. Hit me up in the comments if you've figured out the math on that.

Okay, so we've talked about the what. What you must not do. You may not collect, store, use, or transmit to anyone biometric information, and you must give notice by July 5th and a certification within 30 days after that that you have deleted or destroyed all that biometric information That the who and the what What about the where Well it turns out there is a where Remember that notification we talked about that you need to send to the director. You also need to post that within your establishment, and it must be clearly and conspicuously posted.

Well, what does that mean? Well, actually, Erie County local law defines what clearly and conspicuously means. And here's what it means. It means that the notice and the destruction policy must be posted within the physical location, all right, in a conspicuous place using lettering and wording that is easily visible and understandable to the average customer.

Now, that's fairly descriptive, not terribly clear what that means, but my recommendation would be, it means that you can't hide it behind the counter. It means that it has to be legible. It should be in a prominent place where your customers can see it. All right, so we've talked about the who, what, and where.

Now let's talk about the when. And we're going to rewind a little bit just to confirm because this is very important. So we're sitting here recording on June 25th, 2026. And you're going to see this episode for the first time Wednesday, July 1st.

You will have just four days from today to file your notice with the director. And as I said, the good news is you can do it online. Hit me up in the comments if you need the form. We can provide that to you.

Now, let's close by talking about the why. Why do we have to do all this? Why is Erie County so concerned about biometric privacy protection? Well, it turns out, you probably know this, that biometric identifiers like facial features, iris, retina, fingerprints, handprints, voice, those are very personal identifiers to the average person.

And those are things that are increasingly subject to privacy and safety concerns. Think about the advances in AI. We're actually at a point where someone can take my voice. They just need a few seconds of my voice and then duplicate So it sounds like I'm talking when it's not me.

And you can only imagine the risks that would happen there. You have someone duplicating a parent's voice in order to kidnap children or someone using your voice to harm you professionally. Clearly some potentially bad things that can happen when your biometric information is stolen or abused. And that's what the county seizes on.

So there's actually a section of this law called Legislative Findings and Intent, and I want to share it with you. So here's what it says. The Erie County Legislature finds that biometric identifier technologies are increasingly used in commercial settings for purposes including, but not limited to, customer authentication, building access, and fraud prevention. So those are the benefits of biometric information.

But there's a downside. The legislature also finds that biometric identifier information is uniquely sensitive because it is derived from a person's physical or biological characteristics and poses serious privacy and security risks to individuals if compromised. So we've got two sides of the same coin. On one hand, this information is potentially valuable for security reasons, among others.

On the other hand, if it gets into the wrong hands, it can be extraordinarily harmful to the individuals who possess that information. So the legislature is weighing these benefits and harms and saying you know what we going to be the first county in the state of New York to pass a biometric transparency and privacy act We going to make businesses stand up and say hey we got this stuff just so you know Here how we going to destroy it and delete it And then 30 days later, we're going to make these businesses certify to you and the county that they've actually done what they're supposed to do.

Is this a good idea? Probably. It's frankly a little bit of a surprise to me that Erie County here in Western New York is the first in the state to cross this line, but we'll have to see how it turns out. And it'll be very interesting to see how aggressively Erie County enforces this new local law.

Now, there's one thing that I want to touch on before we say goodbye, and that is the exceptions to this law. There are a handful of exceptions, and I'm going to hit the highlights here. First of all, there's a governmental exception. This new local law does not apply to the collection, storage, sharing, or use of biometric information by government agencies, employees, or agents of governmental agencies.

Second, it does not apply to the collection, storage, sharing, or use of biometric information by financial institutions. So there's a complete carve-out for governmental agencies and a complete carve out for financial institutions. Other exceptions, just so you know, because you may be thinking, well, I use facial identification to access my cell phone and I use an employer provided phone or device in order to gain access to employer data or computer systems. There's an exception for that as well.

You don't have to turn in your cell phone or provide notice to the county that you're going to destroy all your personal information. Cell phones, employer devices are exempt. Another exception that applies governs the use of security cameras or security photos. Here's what's important.

And the law does not ban the use of security cameras. Here's the wrinkle. The law doesn't ban the use of security cameras where the recordings are not analyzed by applications that identify individuals based on biometric characteristics and the security camera footage is not shared with third parties. So if you're using a security camera, you can continue to use it as long as you're not analyzing the footage based on a person's physiological or biometric data.

And as long as you're not sharing that information with other third parties like vendors who may be in the practice of analyzing biometric information. So there are important exceptions that do apply, but overall, this is going to be, I think, a fairly significant undertaking, at least on a short-term basis. So if you didn't know about Erie County's new Biometric Transparency and Privacy Act, you know now you've got to provide notice to that director within 30 days of the effective date or by July 5th.

And then within 30 days of that notice, you've got to provide a sworn statement, an affidavit certifying that you have deleted or destroyed all the biometric data that you have. What do you think? Is it a good idea? Is it a good idea, but not now?

Or should we not be doing this at all? Should we let organizations in our county collect and store and transmit our fellow citizens biometric information. Let me know in the comments what you think, but I wanted you to be aware of this. We've got a little bit of time left to comply.

Let me know also whether you knew about this, whether you did comply. How easy or difficult was it? I'd love to hear from you. Meanwhile, thank you for joining this episode.

We'll be back soon with another episode of CyberSip. The CyberSip Podcast is available on BarclayDamon.com, YouTube, LinkedIn, Apple Podcasts, and Spotify. Like, follow, share, and continue to listen.