Assembly Bill A8853

                             
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   8853
 
                           I N  A S S E M B L Y
 
                             January 18, 2024
                                ___________
 
 Introduced  by M. of A. WALLACE -- read once and referred to the Commit-
   tee on Education
 
 AN ACT to amend the state technology law, in relation to banning the use
   of biometric identifying technology in schools
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:

   Section 1. Subdivisions 2, 3 and 4 of section 106-b of the state tech-
 nology  law,  as  added by chapter 2 of the laws of 2021, are amended to
 read as follows:
   2. a. Except as authorized in paragraph b of this subdivision,  public
 and  nonpublic  elementary  and  secondary  schools,  including  charter
 schools, shall be prohibited  from  purchasing  or  utilizing  biometric
 identifying  technology  for  any  purpose,  including school security[,
 until July first, two thousand twenty-two or until the  commissioner  of
 education  authorizes such purchase or utilization as provided in subdi-
 vision three of this section, whichever occurs later].
   b. Schools  may  utilize  biometric  identifying  technology  for  the
 following purposes: (i) fingerprint identification of prospective school
 employees  where utilized for the purpose of compliance with a provision
 of the education law or the regulations of the commissioner of education
 or (ii) to exclusively identify employees that have consented in writing
 to the use of such technology or in the case  of  employees  represented
 under  article  fourteen  of  the  civil service law, where the employee
 organization representing such employee has consented in writing to  the
 use of such technology.
   [3.  a. The commissioner of education shall not authorize the purchase
 or utilization of biometric identifying technology,  including  but  not
 limited  to  facial  recognition  technology, without the director first
 issuing a report prepared  in  consultation  with  the  state  education
 department,  making recommendations as to the circumstances in which the
 utilization of such technology is appropriate in  public  and  nonpublic
 elementary  and  secondary  schools, including charter schools, and what
 restrictions and guidelines should  be  enacted  to  protect  individual
 privacy, civil rights, and civil liberty interests. Such report shall be

  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD13591-01-3
 A. 8853                             2

 made  public  and  presented to the governor, the temporary president of
 the senate, and the speaker of the assembly, and shall consider,  evalu-
 ate and present recommendations concerning:
   i.  the  privacy  implications  of collecting, storing, and/or sharing
 biometric information of students, teachers, school  personnel  and  the
 general public entering a school or school grounds;
   ii. the potential impact of the use of biometric identifying technolo-
 gy  on  student  civil liberties and student civil rights, including the
 risks and implications of the technology resulting in false facial iden-
 tifications, and whether  the  risks  of  false  facial  identifications
 differs  for  different subgroups of individuals based on race, national
 origin, gender, age and other factors, and any other reasonable accuracy
 concerns with respect to technology;
   iii. whether, and under what circumstances,  such  technology  may  be
 used  for  school  security  and the effectiveness of such technology to
 protect students and school personnel;
   iv. whether, and under what circumstances and in what manner, informa-
 tion collected may be used by schools and shared with students,  parents
 or guardians, outside agencies including law enforcement agencies, indi-
 viduals, litigants, the courts, and any other third parties;
   v. the length of time biometric information may be retained and wheth-
 er,  and  in  what manner, such information may be required to be perma-
 nently destroyed;
   vi. the risk of an unauthorized breach of  biometric  information  and
 appropriate consequences therefor;
   vii.  expected maintenance costs resulting from the storage and use of
 facial recognition images and other biometric information, including the
 cost of  appropriately  securing  sensitive  data,  performing  required
 updates to protect against an unauthorized breach of data, and potential
 costs associated with an unauthorized breach of data;
   viii.  analysis  of other schools and organizations, if any, that have
 implemented facial recognition technology and other biometric  identify-
 ing technology programs;
   ix. the appropriateness and potential implications of using any exist-
 ing databases, including but not limited to, local law enforcement data-
 bases, as part of biometric identifying technology;
   x.  whether,  and in what manner such biometric identifying technology
 should be assessed and audited, including but  not  limited  to,  vendor
 datasets,  adherence  to  appropriate standards of algorithmic fairness,
 accuracy, and other  performance  metrics,  including  with  respect  to
 subgroups of persons based on race, national origin, gender, and age;
   xi.  whether, and in what manner, the use of such technology should be
 disclosed by signs and the like in such schools, as well as communicated
 to parents, guardians, students, and district residents; and
   xii. existing legislation, including but not limited to section  two-d
 of  the  education  law,  that  may be implicated by or in conflict with
 biometric technology to ensure the maintenance of records related to the
 use of such technology, protect the privacy interests of data  subjects,
 and avoid any breaches of data.
   b.  The  director, in consultation with the commissioner of education,
 shall consult  with  stakeholders  and  other  interested  parties  when
 preparing  such  report. The state education department, the division of
 criminal justice services, law enforcement  authorities  and  the  state
 university of New York and the city university of New York shall, to the
 extent  practicable,  identify and provide representatives to the office
 A. 8853                             3

 of information technology, at the request of the director, in  order  to
 participate in the development and drafting of such report.
   4.  The  director  shall,  via  scheduled  public  hearings  and other
 outreach methods, seek feedback from  teachers,  school  administrators,
 parents,  individuals  with expertise in school safety and security, and
 individuals with expertise in data privacy issues  and  student  privacy
 issues,  and individuals with expertise in civil rights and civil liber-
 ties prior to making such recommendations.]
   § 2.  This act shall take effect immediately.