A1494

An Act concerning biometric surveillance systems and supplementing P.L.1960, c.39 (C.56:8-1 et seq.).

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. As used in this section:

“Biometric surveillance system” means any computer software that performs facial recognition or other remote biometric recognition.

“Business entity” means any natural or legal person, business corporation, professional services corporation, limited liability company, partnership, limited partnership, business trust, association, or any other legal commercial entity organized under the laws of this State or any other state or foreign jurisdiction.

“Facial recognition” means an automated or semi-automated process that assists in identifying a person or capturing information about a person based on the physical characteristics of the person’s face, or that logs characteristics of a person’s face, head, or body to infer emotion, associations, activities, or location of the person.

2. a. It shall be an unlawful practice and a violation of P.L.1960, c.39 (C.56:8-1 et seq.) for a business entity to use any biometric surveillance system on a consumer at the physical premises of the business entity, except as provided in subsection c. of this section.

b. A business entity may use a biometric surveillance system on a consumer at the physical premises of the business entity, if:

(1) the business entity provides clear and conspicuous notice to the consumer regarding its use of a biometric surveillance system; and

(2) the biometric surveillance system is used for a lawful purpose.

The business entity may satisfy the notice requirement of paragraph (1) of this section by posting a sign in a conspicuous location at the perimeter of any area where a biometric surveillance system is being used.

c. If a business entity uses information obtained through a biometric surveillance system to deny a consumer access to its premises or to remove a consumer from its premises, the business entity shall provide the consumer with a detailed explanation regarding its actions and the criteria used by the business entity in making its determination.

d. Upon being informed of a first violation, a business entity shall comply with the provisions of this act within 30 days. Upon demonstrating compliance, any penalty provided pursuant to P.L.1960, c.39 (C.56:8-1 et seq.) shall be waived.

e. In accordance with the Administrative Procedure Act, P.L.1968, c.410 (C.52:14B-1 et seq.), the Director of the Division of Consumer Affairs may promulgate rules and regulations to effectuate the provisions of this section.

3. a. A business entity shall not sell, lease, trade, share, or otherwise profit from information obtained through the business entity’s use of a biometric surveillance system on a consumer.

b. A violation of this section shall be an unlawful practice and a violation of P.L.1960, c.39 (C.56:8-1 et seq.).

4. This act shall take effect on the first day of the sixth month following enactment.

STATEMENT

This bill prohibits the use of a biometric surveillance system on a consumer under certain circumstances.

Under the bill, a business entity is prohibited from using a biometric surveillance system on a consumer at the physical premises of the business entity, unless: (1) the business entity provides clear and conspicuous notice to the consumer regarding its use of a biometric surveillance system; and (2) the biometric surveillance system is used for a lawful purpose.

The business entity may satisfy the notice requirement by posting a sign in a conspicuous location at the perimeter of any area where a biometric surveillance system is being used. However, under the bill, if a business entity uses information obtained through a biometric surveillance system to deny a consumer access to its premises or to remove a consumer from its premises, the business entity is required to provide the consumer with a detailed explanation regarding its actions and the criteria used by the business entity in making its determination. The bill provides that a business entity will not be liable for a first violation if, within thirty days, the business entity demonstrates compliance with the provisions of this section.

In addition, the bill prohibits a business entity from selling, leasing, trading, sharing, or otherwise profiting from information obtained through the business entity’s use of a biometric surveillance system on a consumer.

A violation of the bill’s provisions is an unlawful practice under the consumer fraud act, punishable by a monetary penalty of not more than $10,000 for a first offense and not more than $20,000 for any subsequent offense. In addition, violations may result in cease and desist orders issued by the Attorney General, the assessment of punitive damages, and the awarding of treble damages and costs to the injured party.