Businesses in Erie County are no longer allowed to collect, store, or sell data collected from biometric means. And those which already have it must now permanently delete it. A bill preventing the gathering of such information was signed into law Tuesday afternoon by Erie County Executive Mark Poloncarz.
The purpose is to prevent that data from falling into the wrong hands, the law’s backers say.
“This is not about stopping innovation, technology, or thwarting loss prevention methods. This is about protecting consumer privacy, creating reasonable safeguards, so residents know when their information is being collected and how it's being used,” said Legislator Lawrence Dupree, the bill’s lead sponsor. “Our residents should never have to sacrifice their privacy in everyday life.”
Under the county’s Biometric Transparency and Privacy Act, any establishments which have already collected and stored biometric data must disclose it to the county’s Division of Consumer Protection, and then provide the county with a plan for how they’ll permanently delete all their data. They’ll then have 30 days to issue an affidavit confirming the data was permanently destroyed.
“We want to make sure that all businesses are aware of the resources and information on this law. Our division has created a website, it's erie.gov/biometrics, and there is additional information on the website, including web forms for businesses to submit to our office to ensure that they are in compliance with the law,” said Jennifer Andres, Director of Consumer Protection for the Erie County Department of Public Advocacy.
Before signing the bill into law, Poloncarz recalled recently having a credit card compromised. He stated that you can change a PIN or password and you get a new credit card, but once biometric data ends up in the wrong hands, any damage it inflicts is permanent.
“There is nothing that is more important towards an individual than that individual self, and you cannot protect it once it's out on the black market,” Poloncarz said. “We are very afraid that someone's information could be compromised. It's really bad if your social security gets compromised, but what if your face does, and it's used for nefarious purposes, including the sale of information or terrible things against you personally?”
Meanwhile, county leaders are assuring businesses that they are still allowed to use surveillance for purposes of protecting their property and goods.
“This does not prohibit a business from using surveillance cameras, especially with regards to anti-fraud, anti-theft activity. They just can't take the information from that and convert it into a biometric stored information that they can then use for whatever purpose and have on site,” Poloncarz said.
