Assembly Actions - Lowercase Senate Actions - UPPERCASE |
|
---|---|
Apr 29, 2022 | referred to governmental operations |
assembly Bill A10036
2021-2022 Legislative Session
Relates to banning the use of biometric data by certain state agencies
Sponsored By
GONZALEZ-ROJAS
Archive: Last Bill Status - In Assembly Committee
- Introduced
- In Committee
- On Floor Calendar
- Passed Senate
- Passed Assembly
- Delivered to Governor
- Signed/Vetoed by Governor
Your Voice
Actions
-
view actions (1)
A10036 (ACTIVE) - Details
- Law Section:
- Executive Law
- Laws Affected:
- Add §§170-f, 235 & 837-x, Exec L
A10036 (ACTIVE) - Bill Text download pdf
S T A T E O F N E W Y O R K ________________________________________________________________________ 10036 I N A S S E M B L Y April 29, 2022 ___________ Introduced by M. of A. GONZALEZ-ROJAS -- read once and referred to the Committee on Governmental Operations AN ACT to amend the executive law, in relation to banning the use of biometric data by certain state agencies THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM- BLY, DO ENACT AS FOLLOWS: Section 1. The executive law is amended by adding a new section 170-f to read as follows: § 170-F. USE OF BIOMETRIC RECOGNITION TECHNOLOGY PROHIBITED. 1. FOR THE PURPOSES OF THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOW- ING MEANINGS: (A) "BIOMETRIC DATA" SHALL MEAN ANY MEASURABLE PHYSIOLOGICAL, BIOLOG- ICAL OR BEHAVIORAL CHARACTERISTICS THAT ARE ATTRIBUTABLE TO A PERSON, INCLUDING FACIAL CHARACTERISTICS, FINGERPRINT CHARACTERISTICS, HAND CHARACTERISTICS, EYE CHARACTERISTICS, GENETIC CHARACTERISTICS, VOCAL CHARACTERISTICS OR THERMAL CHARACTERISTICS THAT CAN BE USED, EITHER SINGULARLY OR IN COMBINATION WITH EACH OTHER OR CAN BE PAIRED OR COMBINED WITH OTHER INFORMATION, TO ESTABLISH INDIVIDUAL IDENTITY. (B) "BIOMETRIC RECOGNITION TECHNOLOGY" SHALL MEAN EITHER OR BOTH (I) ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES BY WHICH A PERSON IS IDENTIFIED OR ATTEMPTED TO BE IDENTIFIED BASED ON THEIR BIOMETRIC DATA, INCLUDING IDENTIFICATION OF KNOWN OR UNKNOWN INDIVIDUALS OR GROUPS; AND/OR (II) ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES THAT GENERATES OR ASSISTS IN GENERATING, INFORMATION ABOUT ANY INDIVID- UAL BASED ON THEIR BIOMETRIC DATA, INCLUDING BUT NOT LIMITED TO EMOTION, AFFECT, OR BEHAVIOR DETECTION. (C) "EQUITY IMPACT ASSESSMENT" SHALL MEAN AN AUDIT AND REPORT ADDRESS- ING, AT A MINIMUM, THE FOLLOWING: (I) EVALUATION OF POTENTIAL BENEFITS, HARMS, AND IMPACTS ON PERSONS OR GROUPS OF PERSONS WHO ARE PROTECTED FROM DISCRIMINATION AS SET FORTH IN ARTICLE FIFTEEN OF THIS CHAPTER, INCLUDING SPECIFIC CONSIDERATIONS BASED ON A PERSON'S ETHNIC AND RACIAL BACKGROUND. SUCH EVALUATION SHALL ALSO INCLUDE, ALTHOUGH NOT BE LIMITED TO THE DISPROPORTIONATE COLLECTION AND USE OF SUCH TECHNOLOGY ON ETHNIC AND RACIAL MINORITIES IN NEW YORK EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets [ ] is old law to be omitted.
LBD14858-01-2 A. 10036 2 STATE, THE DISPROPORTIONATE USE OF SUCH TECHNOLOGY IN LOCATIONS WHERE ETHNIC AND RACIAL MINORITIES RESIDE, AND THE DISPROPORTIONATE REPRESEN- TATION OF PARTICULAR ETHNIC AND RACIAL MINORITIES IN ANY UNDERLYING DATASETS USED TO DEVELOP AND/OR IMPLEMENT SUCH TECHNOLOGY; (II) EVALUATION OF THE EFFICACY AND ACCURACY OF THE BIOMETRIC RECOGNI- TION TECHNOLOGY, INCLUDING THE ACCURACY OF SUCH TECHNOLOGY IN IDENTIFY- ING PERSONS WHO BELONG TO A GROUP OR GROUPS PROTECTED FROM DISCRIMI- NATION AS SET FORTH IN ARTICLE FIFTEEN OF THIS CHAPTER AND A DESCRIPTION OF THE METHODOLOGY OF SUCH EVALUATION, INCLUDING WHETHER SUCH EVALUATION INVOLVED A CONTROLLED OR REAL-WORLD STUDY; (III) STEPS TAKEN OR PLANNED BY THE STATE OR LOCAL AGENCY TO ADDRESS AND TO REDUCE ANY DISPARITIES OR INACCURACIES IDENTIFIED IN SUBPARA- GRAPHS (I) OR (II) OF THIS PARAGRAPH, ALONG WITH THE STATE OR LOCAL AGENCY'S REASONING FOR CONTINUING TO USE THE BIOMETRIC RECOGNITION TECH- NOLOGY DESPITE THE DISPARATE IMPACT OR INACCURACY; (IV) PROCEDURES TO ADDRESS AND CHALLENGE FALSE RESULTS AND PROTECTIVE MEASURES AND PREVENTATIVE CHECKS AGAINST SUCH OCCURRENCES, AND AN ASSESSMENT OF THE ADEQUACY OF SUCH PROCEDURES; (V) WHAT PROTECTIONS ARE PUT IN PLACE FOR DUE PROCESS, PRIVACY, FREE SPEECH AND ASSOCIATION, AND RACIAL, GENDER, AND RELIGIOUS EQUITY; (VI) WHETHER THE STATE OR LOCAL AGENCY CONSIDERED A LESS-INTRUSIVE ALTERNATIVE PRIOR TO UTILIZING THE TECHNOLOGY, AND IF SO, A DESCRIPTION OF SUCH AN EXPLANATION FOR WHY SUCH ALTERNATIVE WAS NOT ULTIMATELY USED; AND (VII) COSTS ASSOCIATED WITH THE USE OF THE TECHNOLOGY AND STORAGE OF RELEVANT DATA, INCLUDING ANY MAINTENANCE COSTS, ADMINISTRATIVE COSTS OR OTHER COSTS INCURRED. 2. (A) UNLESS EXPLICITLY REQUIRED BY OTHER PROVISIONS OF STATE LAW, IT SHALL BE UNLAWFUL FOR ANY STATE OR LOCAL AGENCY TO: (I) ACQUIRE, ACCESS, OR USE ANY BIOMETRIC RECOGNITION TECHNOLOGY OR ANY BIOMETRIC DATA; OR (II) DIRECT THE USE OF ANY BIOMETRIC RECOGNITION TECHNOLOGY OR THE COLLECTION OF ANY BIOMETRIC DATA BY A THIRD PARTY. (B) TO THE EXTENT THAT ANY STATE OR LOCAL AGENCY IS CURRENTLY USING ANY BIOMETRIC RECOGNITION TECHNOLOGY OR COLLECTING ANY BIOMETRIC DATA AND SUCH USE OR COLLECTION IS NOT OTHERWISE REQUIRED BY ANY OTHER PROVISION OF STATE LAW, SUCH STATE OR LOCAL AGENCY SHALL IMMEDIATELY STOP USING SUCH TECHNOLOGY OR DATA. (C) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A STATE OR LOCAL AGENCY OR AN EMPLOYEE OF A STATE OR LOCAL AGENCY FROM: (I) OBTAINING OR POSSESSING ANY DEVICE EQUIPPED WITH BIOMETRIC RECOG- NITION TECHNOLOGY, PROVIDED SUCH DEVICE IS BEING HELD AS EVIDENCE AND THE STATE OR LOCAL AGENCY OR THE EMPLOYEE OF SUCH AGENCY DOES NOT ACCESS OR USE THE BIOMETRIC RECOGNITION TECHNOLOGY OF SUCH DEVICE; (II) ACQUIRING, ACCESSING, OR USING ANY BIOMETRIC RECOGNITION TECHNOL- OGY ON A DEVICE OWNED BY THE STATE OR LOCAL AGENCY OR AN EMPLOYEE OF SUCH AGENCY, FOR THE SOLE PURPOSE OF USER AUTHENTICATION OF AGENCY EMPLOYEES PROVIDED THAT THE AGENCY DOES NOT ACCESS OR USE SUCH BIOMETRIC RECOGNITION TECHNOLOGY FOR ANY OTHER PURPOSE OTHER THAN USER AUTHENTICA- TION AND PROVIDED THAT NO BIOMETRIC DATA OF INDIVIDUALS NOT EMPLOYED BY SUCH AGENCY ARE INTENTIONALLY ENTERED, RETAINED, OR PROCESSED BY SUCH TECHNOLOGY; (III) ACCESSING OR USING A TECHNOLOGY OR SERVICE NOT OWNED BY THE STATE OR LOCAL AGENCY OR AN EMPLOYEE OF SUCH AGENCY BUT WHICH IS OPER- ATED BY A THIRD PARTY, PROVIDED THAT THE AGENCY OR AN EMPLOYEE OF THE AGENCY DOES NOT PROCESS, USE, REQUEST, OR RETAIN ANY INFORMATION CREATED A. 10036 3 BY THE BIOMETRIC RECOGNITION TECHNOLOGY AND THAT NO BIOMETRIC DATA OF INDIVIDUALS NOT EMPLOYED BY SUCH AGENCY ARE INTENTIONALLY ENTERED, OR PROCESSED BY SUCH TECHNOLOGY; OR (IV) ACQUIRING, ACCESSING, OR USING AN AUTOMATED OR SEMI-AUTOMATED PROCESS FOR THE PURPOSE OF REDACTING A RECORDING FOR RELEASE OR DISCLO- SURE OUTSIDE THE STATE OR LOCAL AGENCY TO PROTECT THE PRIVACY OF A SUBJECT DEPICTED IN THE RECORDING, PROVIDED THAT THE PROCESS DOES NOT GENERATE OR RESULT IN THE RETENTION OF ANY BIOMETRIC DATA. (D) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A PUBLIC HEALTH OR PUBLIC EDUCATION AGENCY FROM ACQUIRING, ACCESSING, OR USING BIOMETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA FOR PURPOSES RELATED TO PUBLIC HEALTH, RESEARCH, OR EDUCATION, PROVIDED THAT SUCH BIOMETRIC RECOGNITION TECHNOLOGIES OR BIOMETRIC DATA ARE NOT SHARED WITH A LAW ENFORCEMENT AGENCY. (E) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A STATE OR LOCAL AGENCY FROM: (I) COLLECTING A GENETIC OR FINGERPRINT SAMPLE OR SAMPLES THAT ARE ABANDONED AT THE SCENE OF AN ALLEGED CRIMINAL OFFENSE AND IS NOT COLLECTED FROM THE PERSON OF A CRIMINAL SUSPECT; OR (II) COLLECTING GENETIC SAMPLES FROM AN INDIVIDUAL WHO IS ALLEGED TO BE THE VICTIM OF A CRIME AND WHO CONSENTS TO SUCH COLLECTION. 3. ON OR BEFORE MAY FIRST, TWO THOUSAND TWENTY-TWO, AND ANNUALLY THER- EAFTER, ANY STATE OR LOCAL AGENCY USING OR ACQUIRING FOR USE BIOMETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA AS EXPLICITLY REQUIRED BY ANY OTHER PROVISION OF STATE LAW SHALL: (A) TRANSMIT A REPORT TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE, AND THE MINORITY LEADER OF THE ASSEMBLY DETAILING EACH BIOMETRIC RECOG- NITION TECHNOLOGY OR TYPE OF BIOMETRIC DATA IT INTENDS TO ACQUIRE, ACCESS, USE, COLLECT OR ANALYZE. EACH STATE OR LOCAL AGENCY REQUIRED TO FILE A REPORT SHALL ALSO PUBLISH SUCH REPORT ON THE STATE OR LOCAL AGEN- CY'S WEBSITE. SUCH REPORT SHALL ALSO INCLUDE, BUT NOT BE LIMITED TO, THE FOLLOWING: (I) THE TYPE OF BIOMETRIC DATA; (II) THE TYPE AND VENDOR OF BIOMETRIC RECOGNITION TECHNOLOGY; (III) THE STATE LAW THAT, IN THE STATE OR LOCAL AGENCY'S VIEW, EXPLIC- ITLY REQUIRES SUCH ACQUISITION, ACCESS, USE, COLLECTION, OR ANALYSIS OR BIOMETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA; (IV) THE TIME PERIOD, IF ANY, THAT THE BIOMETRIC DATA WILL BE RETAINED AND THE REASONS THE SPECIFIC BIOMETRIC DATA WILL BE RETAINED FOR DURING THE DESIGNATED TIME PERIOD; (V) WHETHER ANY BIOMETRIC DATA WILL BE SHARED WITH ANOTHER INDIVIDUAL OR ENTITY AND IF SO, WITH WHAT INDIVIDUALS OR ENTITIES IT WILL BE SHARED, AND WHETHER EXPLICIT AUTHORIZATION EXISTS FOR SUCH DATA TO BE SHARED; (VI) THE RISK OF AN UNAUTHORIZED ACCESS TO OR BREACH OF RETAINED BIOM- ETRIC DATA, SAFEGUARDS OR SECURITY MEASURES DESIGNED TO MITIGATE ANY SUCH RISK, AND APPROPRIATE CONSEQUENCES FOR FAILURE TO ADHERE TO SUCH SAFEGUARDS OR SECURITY MEASURES IN THE EVENT OF UNAUTHORIZED ACCESS OR A BREACH; AND (VII) RELATED TO ANY UNAUTHORIZED BREACHES OF RETAINED BIOMETRIC DATA SINCE MAY FIRST OF THE PREVIOUS YEAR, A DESCRIPTION OF: (1) ANY SUCH BREACHES; (2) THE RESULTS OF ANY COMPLETED INVESTIGATIONS OF ANY SUCH BREACHES; (3) ANY ATTEMPTS TO NOTIFY ANYONE IMPACTED BY ANY SUCH BREACH OR WHOSE BIOMETRIC DATA MAY HAVE BEEN UNLAWFULLY ACCESSED; AND A. 10036 4 (4) ANY ACTIONS THE STATE OR LOCAL AGENCY HAS TAKEN TO ADDRESS ANY BREACHES. (B) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE OF THIS SECTION TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE, AND THE MINORITY LEADER OF THE ASSEMBLY AS WELL AS PUBLISHING SUCH ASSESSMENT TO THE STATE AGENCY, POLICE AGENCY, OR THE STATE POLICE'S OWN WEB PAGE. (C) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE OF THIS SECTION TO THE CIVIL RIGHTS BUREAU OF THE OFFICE OF THE ATTORNEY GENERAL, WHICH SHALL REVIEW SUCH ASSESSMENT AND MAKE RECOMMENDATIONS OR TAKE OTHER ACTION AS MAY BE APPROPRIATE WITH RESPECT TO ANY DISPARITY OR INACCURACY IDENTIFIED IN SUCH ASSESSMENT. § 2. The executive law is amended by adding a new section 235 to read as follows: § 235. USE OF BIOMETRIC RECOGNITION TECHNOLOGY PROHIBITED. 1. FOR THE PURPOSES OF THIS SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS: (A) "BIOMETRIC DATA" SHALL MEAN ANY MEASURABLE PHYSIOLOGICAL, BIOLOG- ICAL OR BEHAVIORAL CHARACTERISTICS THAT ARE ATTRIBUTABLE TO A PERSON, INCLUDING FACIAL CHARACTERISTICS, FINGERPRINT CHARACTERISTICS, HAND CHARACTERISTICS, EYE CHARACTERISTICS, GENETIC CHARACTERISTICS, VOCAL CHARACTERISTICS, THERMAL CHARACTERISTICS THAT CAN BE USED, EITHER SINGU- LARLY OR IN COMBINATION WITH EACH OTHER OR CAN BE PAIRED OR COMBINED WITH OTHER INFORMATION, TO ESTABLISH INDIVIDUAL IDENTITY. (B) "BIOMETRIC RECOGNITION TECHNOLOGY" SHALL MEAN EITHER OR BOTH (I) ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES BY WHICH A PERSON IS IDENTIFIED OR ATTEMPTED TO BE IDENTIFIED BASED ON THEIR BIOMETRIC DATA, INCLUDING IDENTIFICATION OF KNOWN OR UNKNOWN INDIVIDUALS OR GROUPS; AND/OR (II) ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES THAT GENERATES OR ASSISTS IN GENERATING, INFORMATION ABOUT ANY INDIVID- UAL BASED ON THEIR BIOMETRIC DATA, INCLUDING BUT NOT LIMITED TO EMOTION, AFFECT, OR BEHAVIOR DETECTION. (C) "EQUITY IMPACT ASSESSMENT" SHALL MEAN AN AUDIT AND REPORT ADDRESS- ING, AT A MINIMUM, THE FOLLOWING: (I) EVALUATION OF POTENTIAL BENEFITS, HARMS, AND IMPACTS ON PERSONS OR GROUPS OF PERSONS WHO ARE PROTECTED FROM DISCRIMINATION AS SET FORTH IN ARTICLE FIFTEEN OF THIS CHAPTER, INCLUDING SPECIFIC CONSIDERATIONS BASED ON A PERSON'S ETHNIC AND RACIAL BACKGROUND. SUCH EVALUATION SHALL ALSO INCLUDE, ALTHOUGH NOT BE LIMITED TO THE DISPROPORTIONATE COLLECTION AND USE OF SUCH TECHNOLOGY ON ETHNIC AND RACIAL MINORITIES IN NEW YORK STATE, THE DISPROPORTIONATE USE OF SUCH TECHNOLOGY IN LOCATIONS WHERE ETHNIC AND RACIAL MINORITIES RESIDE, AND THE DISPROPORTIONATE REPRESEN- TATION OF PARTICULAR ETHNIC AND RACIAL MINORITIES IN ANY UNDERLYING DATASETS USED TO DEVELOP AND/OR IMPLEMENT SUCH TECHNOLOGY; (II) EVALUATION OF THE EFFICACY AND ACCURACY OF THE BIOMETRIC RECOGNI- TION TECHNOLOGY, INCLUDING THE ACCURACY OF SUCH TECHNOLOGY IN IDENTIFY- ING PERSONS WHO BELONG TO A GROUP OR GROUPS PROTECTED FROM DISCRIMI- NATION AS SET FORTH IN ARTICLE FIFTEEN OF THIS CHAPTER, AND A DESCRIPTION OF THE METHODOLOGY OF SUCH EVALUATION, INCLUDING WHETHER SUCH EVALUATION INVOLVED A CONTROLLED OR REAL-WORLD STUDY; (III) STEPS TAKEN OR PLANNED BY THE DIVISION OF STATE POLICE TO ADDRESS AND TO REDUCE ANY DISPARITIES OR INACCURACIES IDENTIFIED IN SUBPARAGRAPHS (I) OR (II) OF THIS PARAGRAPH, ALONG WITH THE AGENCY'S REASONING FOR CONTINUING TO USE THE BIOMETRIC RECOGNITION TECHNOLOGY DESPITE THE DISPARATE IMPACT OR INACCURACY; A. 10036 5 (IV) PROCEDURES TO ADDRESS AND CHALLENGE FALSE RESULTS AND PROTECTIVE MEASURES AND PREVENTATIVE CHECKS AGAINST SUCH OCCURRENCES, AND AN ASSESSMENT OF THE ADEQUACY OF SUCH PROCEDURES; (V) WHAT PROTECTIONS ARE PUT IN PLACE FOR DUE PROCESS, PRIVACY, FREE SPEECH AND ASSOCIATION, AND RACIAL, GENDER, AND RELIGIOUS EQUITY; (VI) WHETHER THE DIVISION OF STATE POLICE CONSIDERED A LESS-INTRUSIVE ALTERNATIVE PRIOR TO UTILIZING THE TECHNOLOGY, AND IF SO, A DESCRIPTION OF SUCH AN EXPLANATION FOR WHY SUCH ALTERNATIVE WAS NOT ULTIMATELY USED; AND (VII) COSTS ASSOCIATED WITH THE USE OF THE TECHNOLOGY AND STORAGE OF RELEVANT DATA, INCLUDING ANY MAINTENANCE COSTS, ADMINISTRATIVE COSTS OR OTHER COSTS INCURRED. 2. (A) UNLESS EXPLICITLY REQUIRED BY OTHER PROVISIONS OF STATE LAW, IT SHALL BE UNLAWFUL FOR ANY MEMBER OF THE DIVISION OF STATE POLICE TO: (I) ACQUIRE, ACCESS, OR USE ANY BIOMETRIC RECOGNITION TECHNOLOGY OR ANY BIOMETRIC DATA; OR (II) DIRECT THE USE OF ANY BIOMETRIC RECOGNITION TECHNOLOGY OR THE COLLECTION OF ANY BIOMETRIC DATA BY A THIRD PARTY. (B) TO THE EXTENT THAT THE DIVISION OF STATE POLICE IS CURRENTLY USING ANY BIOMETRIC RECOGNITION TECHNOLOGY OR COLLECTING ANY BIOMETRIC DATA AND SUCH USE OR COLLECTION IS NOT OTHERWISE REQUIRED BY ANY OTHER PROVISION OF STATE LAW, THE DIVISION OF STATE POLICE SHALL IMMEDIATELY STOP USING SUCH TECHNOLOGY OR DATA. (C) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT THE STATE POLICE OR A MEMBER OF THE STATE POLICE FROM: (I) OBTAINING OR POSSESSING ANY DEVICE EQUIPPED WITH BIOMETRIC RECOG- NITION TECHNOLOGY, PROVIDED SUCH DEVICE IS BEING HELD AS EVIDENCE AND THE DIVISION OF STATE POLICE OR THE EMPLOYEE OF THE DIVISION OF STATE POLICE DOES NOT ACCESS OR USE THE BIOMETRIC RECOGNITION TECHNOLOGY OF SUCH DEVICE; (II) ACQUIRING, ACCESSING, OR USING ANY BIOMETRIC RECOGNITION TECHNOL- OGY ON A DEVICE OWNED BY THE DIVISION OF STATE POLICE OR AN EMPLOYEE OF THE DIVISION OF STATE POLICE, FOR THE SOLE PURPOSE OF USER AUTHENTICA- TION OF AGENCY EMPLOYEES PROVIDED THAT THE DIVISION OF STATE POLICE DOES NOT ACCESS OR USE SUCH BIOMETRIC RECOGNITION TECHNOLOGY FOR ANY OTHER PURPOSE OTHER THAN USER AUTHENTICATION AND PROVIDED THAT NO BIOMETRIC DATA OF INDIVIDUALS NOT EMPLOYED BY THE DIVISION OF STATE POLICE ARE INTENTIONALLY ENTERED, RETAINED, OR PROCESSED BY SUCH TECHNOLOGY; (III) ACCESSING OR USING A TECHNOLOGY OR SERVICE NOT OWNED BY THE DIVISION OF STATE POLICE OR AN EMPLOYEE OF THE DIVISION OF STATE POLICE BUT WHICH IS OPERATED BY A THIRD PARTY, PROVIDED THAT THE DIVISION OF STATE POLICE OR AN EMPLOYEE OF THE DIVISION OF STATE POLICE DOES NOT PROCESS, USE, REQUEST, OR RETAIN ANY INFORMATION CREATED BY THE BIOME- TRIC RECOGNITION TECHNOLOGY AND THAT NO BIOMETRIC DATA OF INDIVIDUALS NOT EMPLOYED BY THE DIVISION OF STATE POLICE ARE INTENTIONALLY ENTERED, OR PROCESSED BY SUCH TECHNOLOGY; OR (IV) ACQUIRING, ACCESSING, OR USING AN AUTOMATED OR SEMI-AUTOMATED PROCESS FOR THE PURPOSE OF REDACTING A RECORDING FOR RELEASE OR DISCLO- SURE OUTSIDE THE DIVISION OF STATE POLICE TO PROTECT THE PRIVACY OF A SUBJECT DEPICTED IN THE RECORDING, PROVIDED THAT THE PROCESS DOES NOT GENERATE OR RESULT IN THE RETENTION OF ANY BIOMETRIC DATA. (D) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT THE DIVISION OF STATE POLICE OR MEMBERS OF THE DIVISION OF STATE POLICE FROM: A. 10036 6 (I) COLLECTING A GENETIC OR FINGERPRINT SAMPLE OR SAMPLES THAT ARE ABANDONED AT THE SCENE OF AN ALLEGED CRIMINAL OFFENSE AND IS NOT COLLECTED FROM THE PERSON OF A CRIMINAL SUSPECT; OR (II) COLLECTING GENETIC SAMPLES FROM AN INDIVIDUAL WHO IS ALLEGED TO BE THE VICTIM OF A CRIME AND WHO CONSENTS TO SUCH COLLECTION. 3. ON OR BEFORE MAY FIRST, TWO THOUSAND TWENTY-TWO AND ANNUALLY THERE- AFTER, ANY DIVISION OF STATE POLICE USING OR ACQUIRING FOR USE BIOMETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA AS EXPLICITLY REQUIRED BY ANY OTHER PROVISION OF STATE LAW SHALL: (A) TRANSMIT A REPORT TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE, AND THE MINORITY LEADER OF THE ASSEMBLY DETAILING EACH BIOMETRIC RECOG- NITION TECHNOLOGY OR TYPE OF BIOMETRIC DATA IT INTENDS TO ACQUIRE, ACCESS, USE, COLLECT OR ANALYZE. EACH DIVISION OF STATE POLICE REQUIRED TO FILE A REPORT SHALL ALSO PUBLISH SUCH REPORT ON THE DIVISION OF STATE POLICE'S WEBSITE. SUCH REPORT SHALL ALSO INCLUDE, BUT NOT BE LIMITED TO, THE FOLLOWING: (I) THE TYPE OF BIOMETRIC DATA; (II) THE TYPE AND VENDOR OF BIOMETRIC RECOGNITION TECHNOLOGY; (III) THE STATE LAW THAT, IN THE DIVISION OF STATE POLICE'S VIEW, EXPLICITLY REQUIRES SUCH ACQUISITION, ACCESS, USE, COLLECTION, OR ANALY- SIS OR BIOMETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA; (IV) THE TIME PERIOD, IF ANY, THAT THE BIOMETRIC DATA WILL BE RETAINED AND THE REASONS THE SPECIFIC BIOMETRIC DATA WILL BE RETAINED FOR DURING THE DESIGNATED TIME PERIOD; (V) WHETHER ANY BIOMETRIC DATA WILL BE SHARED WITH ANOTHER INDIVIDUAL OR ENTITY AND IF SO, WITH WHAT INDIVIDUALS OR ENTITIES IT WILL BE SHARED, AND WHETHER EXPLICIT AUTHORIZATION EXISTS FOR SUCH DATA TO BE SHARED; (VI) THE RISK OF AN UNAUTHORIZED ACCESS TO OR BREACH OF RETAINED BIOM- ETRIC DATA, SAFEGUARDS OR SECURITY MEASURES DESIGNED TO MITIGATE ANY SUCH RISK, AND APPROPRIATE CONSEQUENCES FOR FAILURE TO ADHERE TO SUCH SAFEGUARDS OR SECURITY MEASURES IN THE EVENT OF UNAUTHORIZED ACCESS OR A BREACH; AND (VII) RELATED TO ANY UNAUTHORIZED BREACHES OF RETAINED BIOMETRIC DATA SINCE MAY FIRST OF THE PREVIOUS YEAR, A DESCRIPTION OF: (1) ANY SUCH BREACHES; (2) THE RESULTS OF ANY COMPLETED INVESTIGATIONS OF ANY SUCH BREACHES; (3) ANY ATTEMPTS TO NOTIFY ANYONE IMPACTED BY ANY SUCH BREACH OR WHOSE BIOMETRIC DATA MAY HAVE BEEN UNLAWFULLY ACCESSED; AND (4) ANY ACTIONS THE AGENCY HAS TAKEN TO ADDRESS ANY BREACHES. (B) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE OF THIS SECTION TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE, AND THE MINORITY LEADER OF THE ASSEMBLY AS WELL AS PUBLISHING SUCH ASSESSMENT TO THE STATE AGENCY, POLICE AGENCY, OR THE DIVISION OF STATE POLICE'S OWN WEB PAGE. (C) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE OF THIS SECTION TO THE CIVIL RIGHTS BUREAU OF THE OFFICE OF THE ATTORNEY GENERAL, WHICH SHALL REVIEW SUCH ASSESSMENT AND MAKE RECOMMENDATIONS OR TAKE OTHER ACTION AS MAY BE APPROPRIATE WITH RESPECT TO ANY DISPARITY OR INACCURACY IDENTIFIED IN SUCH ASSESSMENT. § 3. The executive law is amended by adding a new section 837-x to read as follows: § 837-X. USE OF BIOMETRIC RECOGNITION TECHNOLOGY PROHIBITED. 1. FOR THE PURPOSES OF THIS SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOW- ING MEANINGS: A. 10036 7 (A) "BIOMETRIC DATA" SHALL MEAN ANY MEASURABLE PHYSIOLOGICAL, BIOLOG- ICAL OR BEHAVIORAL CHARACTERISTICS THAT ARE ATTRIBUTABLE TO A PERSON, INCLUDING FACIAL CHARACTERISTICS, FINGERPRINT CHARACTERISTICS, HAND CHARACTERISTICS, EYE CHARACTERISTICS, GENETIC CHARACTERISTICS, VOCAL CHARACTERISTICS, THERMAL CHARACTERISTICS THAT CAN BE USED, EITHER SINGU- LARLY OR IN COMBINATION WITH EACH OTHER OR CAN BE PAIRED OR COMBINED WITH OTHER INFORMATION, TO ESTABLISH INDIVIDUAL IDENTITY. (B) "BIOMETRIC RECOGNITION TECHNOLOGY" SHALL MEAN EITHER OR BOTH (I) ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES BY WHICH A PERSON IS IDENTIFIED OR ATTEMPTED TO BE IDENTIFIED BASED ON THEIR BIOMETRIC DATA, INCLUDING IDENTIFICATION OF KNOWN OR UNKNOWN INDIVIDUALS OR GROUPS; AND/OR (II) ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES THAT GENERATES OR ASSISTS IN GENERATING, INFORMATION ABOUT ANY INDIVID- UAL BASED ON THEIR BIOMETRIC DATA, INCLUDING BUT NOT LIMITED TO EMOTION, AFFECT, OR BEHAVIOR DETECTION. (C) "EQUITY IMPACT ASSESSMENT" SHALL MEAN AN AUDIT AND REPORT ADDRESS- ING, AT A MINIMUM, THE FOLLOWING: (I) EVALUATION OF POTENTIAL BENEFITS, HARMS, AND IMPACTS ON PERSONS OR GROUPS OF PERSONS WHO ARE PROTECTED FROM DISCRIMINATION AS SET FORTH IN ARTICLE FIFTEEN OF THIS CHAPTER, INCLUDING SPECIFIC CONSIDERATIONS BASED ON A PERSON'S ETHNIC AND RACIAL BACKGROUND. SUCH EVALUATION SHALL ALSO INCLUDE, ALTHOUGH NOT BE LIMITED TO THE DISPROPORTIONATE COLLECTION AND USE OF SUCH TECHNOLOGY ON ETHNIC AND RACIAL MINORITIES IN NEW YORK STATE, THE DISPROPORTIONATE USE OF SUCH TECHNOLOGY IN LOCATIONS WHERE ETHNIC AND RACIAL MINORITIES RESIDE, AND THE DISPROPORTIONATE REPRESEN- TATION OF PARTICULAR ETHNIC AND RACIAL MINORITIES IN ANY UNDERLYING DATASETS USED TO DEVELOP AND/OR IMPLEMENT SUCH TECHNOLOGY; (II) EVALUATION OF THE EFFICACY AND ACCURACY OF THE BIOMETRIC RECOGNI- TION TECHNOLOGY, INCLUDING THE ACCURACY OF SUCH TECHNOLOGY IN IDENTIFY- ING PERSONS WHO BELONG TO A GROUP OR GROUPS PROTECTED FROM DISCRIMI- NATION AS SET FORTH IN ARTICLE FIFTEEN OF THIS CHAPTER, AND A DESCRIPTION OF THE METHODOLOGY OF SUCH EVALUATION, INCLUDING WHETHER SUCH EVALUATION INVOLVED A CONTROLLED OR REAL-WORLD STUDY; (III) STEPS TAKEN OR PLANNED BY THE AGENCY TO ADDRESS AND TO REDUCE ANY DISPARITIES OR INACCURACIES IDENTIFIED IN SUBPARAGRAPHS (I) OR (II) OF THIS PARAGRAPH, ALONG WITH THE POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER'S REASONING FOR CONTINUING TO USE THE BIOMETRIC RECOGNITION TECHNOLOGY DESPITE THE DISPARATE IMPACT OR INACCURACY; (IV) PROCEDURES TO ADDRESS AND CHALLENGE FALSE RESULTS AND PROTECTIVE MEASURES AND PREVENTATIVE CHECKS AGAINST SUCH OCCURRENCES, AND AN ASSESSMENT OF THE ADEQUACY OF SUCH PROCEDURES; (V) WHAT PROTECTIONS ARE PUT IN PLACE FOR DUE PROCESS, PRIVACY, FREE SPEECH AND ASSOCIATION, AND RACIAL, GENDER, AND RELIGIOUS EQUITY; (VI) WHETHER THE POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER CONSIDERED A LESS-INTRUSIVE ALTERNATIVE PRIOR TO UTILIZING THE TECHNOLO- GY, AND IF SO, A DESCRIPTION OF SUCH AN EXPLANATION FOR WHY SUCH ALTER- NATIVE WAS NOT ULTIMATELY USED; AND (VII) COSTS ASSOCIATED WITH THE USE OF THE TECHNOLOGY AND STORAGE OF RELEVANT DATA, INCLUDING ANY MAINTENANCE COSTS, ADMINISTRATIVE COSTS OR OTHER COSTS INCURRED. 2. (A) UNLESS EXPLICITLY REQUIRED BY OTHER PROVISIONS OF STATE LAW, IT SHALL BE UNLAWFUL FOR ANY POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER TO: (I) ACQUIRE, ACCESS, OR USE ANY BIOMETRIC RECOGNITION TECHNOLOGY OR ANY BIOMETRIC DATA; OR A. 10036 8 (II) DIRECT THE USE OF ANY BIOMETRIC RECOGNITION TECHNOLOGY OR THE COLLECTION OF ANY BIOMETRIC DATA BY A THIRD PARTY. (B) TO THE EXTENT THAT ANY POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER IS CURRENTLY USING ANY BIOMETRIC RECOGNITION TECHNOLOGY OR COLLECTING ANY BIOMETRIC DATA AND SUCH USE OR COLLECTION IS NOT OTHER- WISE REQUIRED BY ANY OTHER PROVISION OF STATE LAW, SUCH POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER SHALL IMMEDIATELY STOP USING SUCH TECH- NOLOGY OR DATA. (C) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER FROM: (I) OBTAINING OR POSSESSING ANY DEVICE EQUIPPED WITH BIOMETRIC RECOG- NITION TECHNOLOGY, PROVIDED SUCH DEVICE IS BEING HELD AS EVIDENCE AND THE POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER DOES NOT ACCESS OR USE THE BIOMETRIC RECOGNITION TECHNOLOGY OF SUCH DEVICE; OR (II) ACQUIRING, ACCESSING, OR USING ANY BIOMETRIC RECOGNITION TECHNOL- OGY ON A DEVICE OWNED BY THE POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER FOR THE SOLE PURPOSE OF USER AUTHENTICATION OF POLICE AGENCY EMPLOYEES, POLICE OFFICERS OR PEACE OFFICERS PROVIDED THAT THE POLICE AGENCY DOES NOT ACCESS OR USE SUCH BIOMETRIC RECOGNITION TECHNOLOGY FOR ANY OTHER PURPOSE OTHER THAN USER AUTHENTICATION AND PROVIDED THAT NO BIOMETRIC DATA OF INDIVIDUALS NOT EMPLOYED BY THE POLICE AGENCY ARE INTENTIONALLY ENTERED, RETAINED, OR PROCESSED BY SUCH TECHNOLOGY; OR (III) ACCESSING OR USING A TECHNOLOGY OR SERVICE NOT OWNED BY THE POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER BUT WHICH IS OPERATED BY A THIRD PARTY, PROVIDED THAT THE POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER DOES NOT PROCESS, USE, REQUEST, OR RETAIN ANY INFORMATION CREATED BY THE BIOMETRIC RECOGNITION TECHNOLOGY AND THAT NO DATA OF INDIVIDUALS NOT EMPLOYED BY THE POLICE AGENCY ARE INTENTIONALLY ENTERED, OR PROCESSED BY SUCH TECHNOLOGY; OR (IV) ACQUIRING, ACCESSING, OR USING AN AUTOMATED OR SEMI-AUTOMATED PROCESS FOR THE PURPOSE OF REDACTING A RECORDING FOR RELEASE OR DISCLO- SURE OUTSIDE THE POLICE AGENCY TO PROTECT THE PRIVACY OF A SUBJECT DEPICTED IN THE RECORDING, PROVIDED THAT THE PROCESS DOES NOT GENERATE OR RESULT IN THE RETENTION OF ANY BIOMETRIC DATA. (D) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER FROM: (I) COLLECTING A GENETIC OR FINGERPRINT SAMPLE OR SAMPLES THAT ARE ABANDONED AT THE SCENE OF AN ALLEGED CRIMINAL OFFENSE AND IS NOT COLLECTED FROM THE PERSON OF A CRIMINAL SUSPECT; OR (II) COLLECTING GENETIC SAMPLES FROM AN INDIVIDUAL WHO IS ALLEGED TO BE THE VICTIM OF A CRIME AND WHO CONSENTS TO SUCH COLLECTION. 3. ON OR BEFORE MAY FIRST, TWO THOUSAND TWENTY-TWO AND ANNUALLY THERE- AFTER, ANY POLICE AGENCY USING OR ACQUIRING FOR USE BIOMETRIC RECOGNI- TION TECHNOLOGY OR BIOMETRIC DATA AS EXPLICITLY REQUIRED BY ANY OTHER PROVISION OF STATE LAW SHALL: (A) TRANSMIT A REPORT TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE, AND THE MINORITY LEADER OF THE ASSEMBLY DETAILING EACH BIOMETRIC RECOG- NITION TECHNOLOGY OR TYPE OF BIOMETRIC DATA IT INTENDS TO ACQUIRE, ACCESS, USE, COLLECT OR ANALYZE. EACH POLICE AGENCY REQUIRED TO FILE A REPORT SHALL ALSO PUBLISH SUCH REPORT ON THE POLICE AGENCY'S WEBSITE. SUCH REPORT SHALL ALSO INCLUDE, BUT NOT BE LIMITED TO, THE FOLLOWING: (I) THE TYPE OF BIOMETRIC DATA; (II) THE TYPE AND VENDOR OF BIOMETRIC RECOGNITION TECHNOLOGY; A. 10036 9 (III) THE STATE LAW THAT, IN THE POLICE AGENCY'S VIEW, EXPLICITLY REQUIRES SUCH ACQUISITION, ACCESS, USE, COLLECTION, OR ANALYSIS OR BIOM- ETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA; (IV) THE TIME PERIOD, IF ANY, THAT THE BIOMETRIC DATA WILL BE RETAINED AND THE REASONS THE SPECIFIC BIOMETRIC DATA WILL BE RETAINED FOR DURING THE DESIGNATED TIME PERIOD; (V) WHETHER ANY BIOMETRIC DATA WILL BE SHARED WITH ANOTHER INDIVIDUAL OR ENTITY AND IF SO, WITH WHAT INDIVIDUALS OR ENTITIES IT WILL BE SHARED, AND WHETHER EXPLICIT AUTHORIZATION EXISTS FOR SUCH DATA TO BE SHARED; (VI) THE RISK OF AN UNAUTHORIZED ACCESS TO OR BREACH OF RETAINED BIOM- ETRIC DATA, SAFEGUARDS OR SECURITY MEASURES DESIGNED TO MITIGATE ANY SUCH RISK, AND APPROPRIATE CONSEQUENCES FOR FAILURE TO ADHERE TO SUCH SAFEGUARDS OR SECURITY MEASURES IN THE EVENT OF UNAUTHORIZED ACCESS OR A BREACH; AND (VII) RELATED TO ANY UNAUTHORIZED BREACHES OF RETAINED BIOMETRIC DATA SINCE MAY FIRST OF THE PREVIOUS YEAR, A DESCRIPTION OF: (1) ANY SUCH BREACHES; (2) THE RESULTS OF ANY COMPLETED INVESTIGATIONS OF ANY SUCH BREACHES; (3) ANY ATTEMPTS TO NOTIFY ANYONE IMPACTED BY ANY SUCH BREACH OR WHOSE BIOMETRIC DATA MAY HAVE BEEN UNLAWFULLY ACCESSED; AND (4) ANY ACTIONS THE AGENCY HAS TAKEN TO ADDRESS ANY BREACHES. (B) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE OF THIS SECTION TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE, AND THE MINORITY LEADER OF THE ASSEMBLY AS WELL AS PUBLISHING SUCH ASSESSMENT TO THE STATE AGENCY, POLICE AGENCY, OR THE STATE POLICE'S OWN WEB PAGE. (C) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE OF THIS SECTION TO THE CIVIL RIGHTS BUREAU OF THE OFFICE OF THE ATTORNEY GENERAL, WHICH SHALL REVIEW SUCH ASSESSMENT AND MAKE RECOMMENDATIONS OR TAKE OTHER ACTION AS MAY BE APPROPRIATE WITH RESPECT TO ANY DISPARITY OR INACCURACY IDENTIFIED IN SUCH ASSESSMENT. § 4. This act shall take effect immediately.