Legislator Lawrence J. Dupre Introduces “Biometrics Transparency and Privacy Act” Local Law for Erie County in Response to Grocery Store Surveillance Revelations

Proposed Local Law Would Require Clear Notice When Businesses Collect Face Scans and Other Biometric Data; Would Prohibit Sale or Monetization of Information

Lawrence Dupre

BUFFALO, NY — Erie County Legislator Lawrence J. Dupre has clocked in legislation to require businesses to post clear notice when they collect customers’ face scans, fingerprints, voiceprints, or other biometric identifier information, and to prohibit the sale or monetization of that data. The measure comes in direct response to revelations this week that Wegmans and other major retailers are using facial recognition technology to scan and store customers’ bio metric data, often without shop pers’ knowledge.

“If you’re walking into a store in Erie County and that business is scanning your face or collect ing your voiceprint, you have a right to know about it before you walk through the door,” said Legislator Dupre. “This is about basic transparency and respect for consumers. Biomet ric data is uniquely sensitive, you can’t change your face like you change a password. People deserve to know when it’s being collected, and they deserve protection against it being sold to the highest bidder.”

WHAT THE LOCAL LAW DOES

If enacted, the local law would add a new Article 28 to the Erie County Code and establish:

• Clear Notice Required at Customer Entrances

Under the proposed law, any business operating in Erie County that collects, stores, uses, or shares biometric identifier information from customers would be required to post conspicuous signage at all customer entrances. The notice must be in plain, simple language and inform customers that their biometric data is being collected.

The Erie County Director of Consumer Protection would establish the specific form and format for required signage through implementing regulations.

• Prohibiting Sale and Monetization

The legislation draws a bright line against the commercialization of biometric information. Businesses would be prohibited from selling, leasing, trading, or otherwise profiting from bio metric identifier data collected from customers.

A practical safe harbor would allow businesses to share bio metric data with service providers who are contractually prohibited from monetizing the information and may use it only to provide services to the business.

• Enforcement Balanced with Compliance Support

The Director of Consumer Protection would serve as the primary enforcement authority. For businesses that fail to post required notices, the law pro vides a 30-day cure period after receiving a notice of violation.

“We want businesses to come into compliance, not to trap them with gotcha enforcement,” Dupre explained. “But for businesses that refuse to post notice or that violate the prohibition on selling biometric data, there are real consequences.”

Civil penalties would include up to $500 per violation for failure to post required notice and up to $5,000 per violation for selling or monetizing biometric information. The Erie County Attorney would be authorized to pursue civil enforcement actions and seek injunctive relief.

RESPONDING TO A GROWING NATIONAL CONCERN

The legislation responds to mounting privacy concerns as facial recognition and other biometric technologies become more prevalent in commercial settings. Recent news reports revealed that Wegmans grocery stores in New York City are collecting facial recognition data, eye scans, and voiceprints from customers, retaining the information “as long as necessary for security purposes” without disclosing specific retention periods.

Privacy advocates have raised concerns about the risks of data breaches, potential misuse by law enforcement or immigration authorities, and disproportionate impacts on marginalized communities. Research has shown that facial recognition systems often misidentify people of color at higher rates than white individuals.

While some states including Illinois, Texas, and Washington have enacted biometric privacy laws, and New York City has a notice requirement, Erie County’s proposed law would be among the first local measures in New York State to combine notice requirements with a prohibition on monetization.

180-DAY IMPLEMENTATION PERIOD

The law would take effect 180 days after enactment, giving businesses time to come into compliance without disruption. “This is about basic fairness and basic transparency,” Dupre said. “Consumers should not have to guess whether a business is col lecting biometric identifiers, and they should not have to worry that their biometric data is being treated like an asset to be sold. Erie County residents deserve protection from the commercial exploitation of their most person al information.” The legislation will be considered by the Erie County Legislature in the coming weeks.