Public Biometric Data Retention and Destruction Policy

How to use this document

• Use it as a written, public policy on which biometric data the organization processes, why, for how long and how it is destroyed; it includes the notice and release forms and the sign for commercial establishments.
• Suggested owner: legal, with information security responsible for destruction and safeguards; HR when employees are affected.
• Before adopting it, decide: which biometric technologies you use (timekeeping, physical access, identity verification, in-store facial recognition, voice), whose data (employees, customers, visitors), with which vendor, and which events end each purpose.
• Complete the table in section 3 and the schedule in section 6; they are the basis of the public policy.
• Publish the policy on the website and make it available to employees and customers before capturing biometric data. Use Annexes A and B to obtain the written release and Annex C if you have establishments open to the public in New York City.
• Keep in "Country variants" only the states where you capture or hold biometric data; the policy proposes applying the most protective timeframe to everyone.
• If you use facial recognition or biometric surveillance of customers or the public, rate that system at least High on the organization's single risk scale and submit it to the AI committee for approval.
• Ask internal legal or an external advisor to review the document before publishing: biometric laws include private rights of action and frequent litigation.
• Approve the policy in the [AI COMMITTEE] or the appropriate body, publish it and check every [REVIEW FREQUENCY] that destructions are carried out.

Public Biometric Data Retention and Destruction Policy

1. Purpose and scope

[LEGAL ENTITY NAME] ([ORGANIZATION NAME]) publishes this policy to explain which biometric identifiers and biometric information it collects, uses, retains and destroys, and the rights of the people concerned.

It applies to biometric data of employees, candidates, contractors, customers, users and visitors that the organization, or a vendor on its behalf, captures or holds at any location or channel, including AI systems that process faces, voices or other physical characteristics.

2. Definitions

• Biometric identifier: a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and other identifiers the applicable law treats as biometric.
• Biometric information: information, regardless of how it is captured or stored, based on a biometric identifier and used to identify an individual, including templates generated by a system.
• Biometric data: biometric identifiers and biometric information together.
• Initial purpose: the specific purpose for which the data were captured, as stated in the notice.
• Last interaction: the last time the person interacted with the organization in connection with the purpose (for example, the last clock-in or the last access).
• Destruction: permanent deletion of biometric data, including copies, templates and backups, so that they cannot be recovered.