Means of permitting or barring access to a particular location, these errors can have far reaching consequences for people trying to go about their daily lives.

For example, a black teenager in Detroit was barred from entering a skating rink after facial recognition, misidentified her as a different patron.

Similarly, in the UK, a woman was misidentified as a shoplifter, subsequently back searched, asked to leave the store, and banned from all other stores using the same technology until the company acknowledges mistake.

These biases in facial recognition risk excluding marginalized communities from everyday life.

More and more stores are deploying biometric surveillance to monitor customers, screen against watch lists, and share information with other businesses, security firms, and law enforcement without people's knowledge and often resulting in misidentifications, leading to false accusations, invasive searches, or access restrictions.

The Federal Trade Commission has recognized the dangers of facial recognition technology.

In December 2023, the FTC banned banned the grocery chain Ride from using facial recognition surveillance for five years.

Ride aid's facial recognition technology misidentified thousands of customers, disproportionately people of color and women as previous shoplifters.

Suspected individuals were then followed around stores and searched, ordered to leave, or publicly accused of shoplifting.

Facial recognition technology is also ripe for abuse.

Medicine Square garden owner James Dolan has used facial recognition as a retaliatory tool to bar those against whom he has a personal vendetta from access to his facilities.

In 2022, Dolan ejected a mother trying to watch the Roquettes show with her daughter's Girl Scouts group simply because she was identified as an employee of a law firm engaged in litigation against MSG, even though she never directly worked on a lawsuit.

He later ejected someone for creating a t-shirt that made fun of him.

This sort of retaliation sets a chilling precedent for how the rich and powerful can silence their opponents, critics, and those helping them fight for their day in court.

The risks are even higher for immigrant New Yorkers.

As the Department of Homeland Security continues to rely on biometric surveillance technologies to target immigrant communities, immigrants live in fear as they go about their daily lives.

Once biometric recognition systems collect data, companies and third party providers amass huge databases of highly personal information that could be exploited by ice.

All these examples point to Orwellian use cases where it will be impossible to move, purchase goods and associate freely.

The need for stronger privacy protections has never been clearer.

People should be should not be required to have their faces scanned and biometric data collected simply to buy groceries and other necessities of daily life.

The NYCLU thanks the committee for the opportunity to provide testimony today.

Nobody wants to live in a world where pervasive surveillance identifies them, tracks their movements and associations, and impacts which places they can visit, which services they can access, with whom they meet, or how they exercise their free speech rights.

Thank you very much.

Thank you.

And Daniel, I think.

In your intro, you mentioned targeting and discrimination against individuals.

And I think that those are the primary concerns of myself and Councillor Monto, Councillor Majoke, who are co-sponsors on this piece of legislation.

Again, can you before your testimony, I talked about the public good.

And can you give your opinion and perspective on how a ban of this nature would be for the public good?

Absolutely.

I think it it touches on different aspects.

So these technologies have much higher error rates for black and brown people, for women, for young people, and for older people.

People are much more likely to trust the output by a computer.

And when this discrimination runs wild and is amplified by a system at scale, that's when we see those discriminatory impacts, like in the case with Riotate, where thousands of people were misidentified.

The system is deployed at scale, and then discrimination is running wild.

When it comes to places of public accommodation, people are expecting to go into a store and being able to buy their groceries without being identified, tracked, or accused of a crime, mismatched to a shoplifter from another area, and then being locked out without the ability to appeal, to correct the record oftentimes, to have dangerous interactions.

And depending on access in their neighborhoods, their ability to move to different stores, that could be a lifeline.

If if you're unable to go anymore to the store that is in your vicinity in your neighborhood, and it creates additional barriers for you, and that that could be it could have dramatic ramifications for that person depending on where they live, their social and economic class, their ability to move somewhere else for purchasing those goods, etc.

Thank you.

And Daniel, another one of my primary concerns is around data privacy and data storage.

What do we know about data protection in the private sector?

I think it's really hard to give a comprehensive overview of that landscape because it is the Wild West.

We're lacking comprehensive privacy protections at the state level and even more so at the federal level.

We do have some limited cybersecurity provisions that were enacted under the Cybersecurity Shield Law around 2018-2019 that require um businesses to safeguard sensitive data, including biometric data, but it just doesn't go far enough.

And it does not protect data in the way that many other states do, whether that is Illinois, Washington, Texas, they all have long ago enacted strong biometric privacy protections that also cover the collection and the use, the deletion of biometric data.

That is all not present here.

So we we really leave businesses to their own devices what to do with the data and really take it from people without their knowledge or consent.

And that is a massive issue that we're seeing right now.

I think it comes to the fore now also with uh wearables, where we see meta glasses and the ability to um surreptitiously collect video footage that could be again aggregated and compared against um other forms of um biometric recognition databases, um, identify people without their their knowledge, and um to come back to the cybersecurity risk, we see breaches left and right.

Umce your biometric data is leaked or accessed by hackers, you can't take it back.

It is not like your credit card number that you can't can just change once it has been accessed by someone else, but rather your your biometrics are yours and they're immutable.

Um so uh it really runs the risks um that that could harm you for a lifetime.

Great, thank you.

And Daniel, I've got more, but I'll turn it over to my colleagues if they have any questions at this point.

I want to touch basis on what Daniel said about Ride Aid.

So when this data is collected, so does this how far and how wide does this data go?

It really depends.

Um, so we don't know exactly what kind of biometric surveillance system Ride 8 was utilizing in this in their stores, whether that was um a third-party provider, whether they worked specifically on their own in-house system.

But there's many surveillance vendors that um make it very cheaply available for any small store or for your home security, let's say, um, and it is being entered into wide data sharing networks.

So uh beyond the entity that is deploying the system in their four corners of their store, it gets hosted externally on the vendor's cloud platform.