After hours of fruitless questioning at a New York City Council hearing last week on the government’s use of facial recognition and other biometric technology, councilmembers are calling city officials out on their reticence. The officials, meanwhile, contend that the questions weren’t theirs to answer.
At the hearing, which was held on May 3 to discuss two new bills regulating the use of biometric tech by landlords and private business owners, members of the Council’s technology committee grilled officials from the city’s newly formed Office of Technology and Innovation on how these tools are deployed by both public and private entities.
The next day, advocates filed a legal complaint alleging that some Starbucks-Amazon Go locations aren’t fully notifying customers that cameras and scanners are capturing and sharing their physical characteristics, including their palm scans and body shapes. They've described the officials’ testimony as “misinformation.”
At the hearing, the city's Chief Privacy Officer Michael Fitzpatrick couldn’t say whether housing, homeless and children’s services agencies collect fingerprints or other biometric information on clients, adding that each agency’s data collection and storage practices are up to their own tech and privacy officers. He also demurred on the same grounds when asked about how biometric data collected by the police department is stored.
The answers seemed to clash with previous testimony by OTI Commissioner Matt Fraser, who told councilmembers last year that the new office would oversee the city’s data privacy efforts.
“We are responsible for ensuring that [data collection and storage] align to the city's best practices and align to nationwide best practices from a privacy and security perspective,” he said at a hearing in May of last year.
OTI spokesperson Ray Legendre said the agency-specific questions were outside the tech office’s purview and noted that the office did share some information with councilmembers, including the types of data collected by other agencies.
Biometric surveillance use in private industry is also out of scope for the agency, officials said. Neither Fitzpatrick nor Ryan Birchmeier, deputy commissioner for public information at OTI, took a stance on the two bills being considered, which would bar business owners and landlords from using many types of biometric surveillance. Experts and advocates say the technology, which uses physical characteristics to identify people, can be biased and poses privacy risks. Others, including some business owners and lawmakers, say it’s a useful security tool.
Signs posted at the entrance and exit of the Starbucks stores disclose some, but not all, of the biometric technology used, the complaint alleges.
“Despite previous testimony by CTO Matthew Fraser that the Office of Technology and Innovation is responsible for all technology contracts for city agencies, and the existence of reporting mandates in the administrative code, OTI declined to answer questions regarding the collection, storage, and usage of New Yorkers’ biometric and facial recognition data,” read a written statement issued shortly after the hearing by Jennifer Gutiérrez, chair of the Council’s technology committee.
She added that Fitzpatrick “was unable to provide answers to many of the questions raised during the hearing” and expressed skepticism that the agency would home through with the follow-ups he promised.
Asked about City Hall’s stance on the two bills, the mayor's spokesperson Fabien Levy said that City Hall was reviewing the legislation.
“We are concerned that these bills may actually hamper public safety in our city, specifically for retail stores where this has become an effective tool,” he added.
Albert Fox Cahn, founder of the nonprofit Surveillance Technology Oversight Project, criticized the OTI officials’ testimony, saying it undersold the degree to which city agencies collect and share biometric data.
“The only thing more shocking than the admin’s lack of answers was how wrong many of the answers were that they gave us,” he said.
On the heels of last week’s hearing, Fox Cahn’s group filed a proposed class-action lawsuit against coffee giant Starbucks, claiming that the company doesn’t sufficiently disclose the extent of biometric data collection used at both of its high-tech Starbucks Pickup + Amazon Go locations.
Images from STOP’s legal complaint depict the body scanning technology used to follow customers’ purchases.
The stores, located near Times Square and on East 59th Street, allow customers to simply grab products off the shelf and walk off with them — provided that they’ve scanned their credit card or palm first. The locations use ceiling-mounted cameras and artificial intelligence to track customers’ movements, including what items they take with out of the store — then charge them for it.
The complaint, submitted last week on behalf of a Starbucks customer named Suzanne Mallouk, alleges that the company took more than a year to post legally required signs notifying consumers that their biometric data was being collected. When the company finally posted signs about the surveillance, in March 2023, they were vague and misleading, the complaint states. The signs mention the palm scans but omit any reference to the cameras, which map each customer’s body size and shape.
“By posting these signs, Starbucks is now making false assurances that it will not collect any biometric identifier information about customers unless a customer uses a palm scanner to enter the gated area of the store,” the complaint reads.
At the coffee chain’s Eighth Avenue location, the Starbucks-designed sign mentioned in the lawsuit was visible to the right of the entrance, just above a “no smoking” placard. It referenced the palm scanners but did not mention the cameras posted throughout the store, which track buyers’ movements and purchases.
The company also continues to violate city law by sharing customers’ biometric data with Amazon, which operates the “pickup and go” technology, the complaint alleges.
A Starbucks spokesperson acknowledged the existence of the complaint but declined to comment on its contents.
The lawsuit isn’t the first STOP has filed on this topic. In March, the group announced a similar proposed class-action against Amazon for not properly disclosing the use of its tech at its Go stores.
Correction: This story has been updated to correct Ryan Birchmeier's title.
Clarification: This story has been updated to clarify OTI spokesperson Ray Legendre's statement on data sharing with the city council.
