S. 10635 2
DISCONTINUED. USE OF SUCH SYSTEM SHALL BE DISCONTINUED NO LATER THAN TWO
YEARS AFTER THE EFFECTIVE DATE OF THIS SECTION.
§ 2. The multiple residence law is amended by adding a new section
130-a to read as follows:
§ 130-A. ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS. 1. DEFINITIONS. FOR
THE PURPOSES OF THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOW-
ING MEANINGS:
(A) "ACCOUNT INFORMATION" MEANS INFORMATION THAT IS USED TO GRANT A
USER ENTRY OR ACCESS TO ANY ONLINE TOOLS THAT ARE USED TO MANAGE USER
ACCOUNTS RELATED TO A SMART ACCESS SYSTEM.
(B) "AUTHENTICATION DATA" MEANS DATA GENERATED OR COLLECTED AT THE
POINT OF AUTHENTICATION IN CONNECTION WITH GRANTING A USER ENTRY TO A
MULTIPLE DWELLING, DWELLING UNIT OF SUCH BUILDING, OR COMMON AREA OF
SUCH BUILDING THROUGH A SMART ACCESS SYSTEM, EXCEPT THAT IT SHALL NOT
INCLUDE DATA GENERATED THROUGH OR COLLECTED BY A VIDEO OR CAMERA SYSTEM
THAT IS USED TO MONITOR ENTRANCES BUT NOT TO GRANT ENTRY.
(C) "BIOMETRIC IDENTIFIER INFORMATION" MEANS A PHYSIOLOGICAL, BIOLOG-
ICAL OR BEHAVIORAL CHARACTERISTIC THAT IS USED TO IDENTIFY, OR ASSIST IN
IDENTIFYING, AN INDIVIDUAL, INCLUDING, BUT NOT LIMITED TO: (I) A RETINA
OR IRIS SCAN, (II) A FINGERPRINT, (III) A VOICEPRINT, (IV) A SCAN OR
RECORD OF A PALM, HAND, OR FACE GEOMETRY, (V) GAIT OR MOVEMENT PATTERNS,
OR (VI) ANY OTHER SIMILAR IDENTIFYING CHARACTERISTIC THAT CAN BE USED
ALONE OR IN COMBINATION WITH EACH OTHER, OR WITH OTHER INFORMATION, TO
ESTABLISH INDIVIDUAL IDENTITY.
(D) "CRITICAL SECURITY VULNERABILITY" MEANS A SECURITY VULNERABILITY
THAT HAS A SIGNIFICANT RISK OF RESULTING IN AN UNAUTHORIZED ACCESS TO AN
AREA SECURED BY A SMART ACCESS SYSTEM.
(E) "REFERENCE DATA" MEANS INFORMATION AGAINST WHICH AUTHENTICATION
DATA IS VERIFIED AT A POINT OF AUTHENTICATION BY A SMART ACCESS SYSTEM
IN ORDER TO GRANT A USER ENTRY TO A MULTIPLE DWELLING, DWELLING UNIT OF
SUCH BUILDING, OR COMMON AREA OF SUCH BUILDING.
(F) "SECURITY BREACH" MEANS ANY INCIDENT THAT RESULTS IN UNAUTHORIZED
ACCESS OF DATA, APPLICATIONS, SERVICES, NETWORKS OR DEVICES BY BYPASSING
UNDERLYING SECURITY MECHANISMS. A "SECURITY BREACH" OCCURS WHEN AN INDI-
VIDUAL OR AN APPLICATION ILLEGITIMATELY ENTERS A PRIVATE, CONFIDENTIAL
OR UNAUTHORIZED LOGICAL INFORMATION TECHNOLOGY PERIMETER.
(G) "SMART ACCESS SYSTEM" MEANS ANY SYSTEM THAT USES ELECTRONIC OR
COMPUTERIZED TECHNOLOGY, A RADIO FREQUENCY IDENTIFICATION CARD, A MOBILE
PHONE APPLICATION, BIOMETRIC IDENTIFIER INFORMATION, OR ANY OTHER
DIGITAL TECHNOLOGY IN ORDER TO GRANT ACCESS TO A MULTIPLE DWELLING,
COMMON AREAS IN SUCH MULTIPLE DWELLING, OR TO AN INDIVIDUAL DWELLING
UNIT IN SUCH MULTIPLE DWELLING.
(H) "THIRD PARTY" MEANS AN ENTITY THAT INSTALLS, OPERATES OR OTHERWISE
DIRECTLY SUPPORTS A SMART ACCESS SYSTEM, AND HAS ONGOING ACCESS TO USER
DATA, EXCLUDING ANY ENTITY THAT SOLELY HOSTS SUCH DATA.
(I) "USER" MEANS A TENANT OR LAWFUL OCCUPANT OF A MULTIPLE DWELLING,
AND ANY PERSON A TENANT OR LAWFUL OCCUPANT HAS REQUESTED, IN WRITING OR
THROUGH A MOBILE APPLICATION, BE GRANTED ACCESS TO SUCH TENANT OR LAWFUL
OCCUPANT'S DWELLING UNIT AND SUCH BUILDING'S SMART ACCESS SYSTEM.
2. ENTRY. (A) WHERE AN OWNER INSTALLS OR PLANS TO INSTALL A SMART
ACCESS SYSTEM ON ANY ENTRANCE FROM THE STREET, PASSAGEWAY, COURT, YARD,
CELLAR, OR OTHER COMMON AREA OF A MULTIPLE DWELLING, SUCH SYSTEM SHALL
NOT RELY SOLELY ON A WEB-BASED APPLICATION TO FACILITATE ENTRANCE BUT
SHALL ALSO INCLUDE A KEY FOB, KEY CARD, DIGITAL KEY OR PASSCODE FOR
TENANT USE.
S. 10635 3
(B) OWNERS MAY PROVIDE VARIOUS METHODS OF ENTRY INTO INDIVIDUAL APART-
MENTS INCLUDING A MECHANICAL KEY OR A SMART ACCESS SYSTEM OF A KEY FOB,
KEY CARD OR DIGITAL KEY, PROVIDED, HOWEVER THAT SUCH SMART ACCESS SYSTEM
SHALL NOT RELY SOLELY ON A WEB-BASED APPLICATION.
(C) NOTWITHSTANDING PARAGRAPH (A) OR (B) OF THIS SUBDIVISION, OWNERS
SHALL PROVIDE A NON-ELECTRONIC MEANS OF ENTRY WHERE REQUESTED BY THE
TENANT OR LAWFUL OCCUPANT DUE TO A RELIGIOUS PREFERENCE.
(D) ALL LAWFUL TENANTS AND LAWFUL OCCUPANTS SHALL BE PROVIDED WITH A
KEY, KEY FOB, DIGITAL KEY OR KEY CARD AT NO COST TO SUCH TENANTS AND
LAWFUL OCCUPANTS. THE TERM "LAWFUL OCCUPANTS" SHALL INCLUDE CHILDREN
UNDER THE AGE OF EIGHTEEN WHO SHALL BE ISSUED A KEY, KEY FOB, DIGITAL
KEYS OR KEY CARD IF A PARENT OR GUARDIAN REQUESTS IN WRITING OR TO A
PHONE NUMBER PROVIDED BY THE OWNER THAT SUCH CHILD BE PROVIDED WITH ONE.
TENANTS AND LAWFUL OCCUPANTS MAY ALSO RECEIVE ADDITIONAL KEYS, KEY FOBS,
DIGITAL KEYS OR KEY CARDS AT NO COST TO THE TENANT OR LAWFUL OCCUPANT
FOR VERIFIED EMPLOYEES AND UP TO TWO ADDITIONAL KEYS, KEY FOBS, DIGITAL
KEYS OR KEY CARDS AT NO COST TO THE TENANT OR LAWFUL OCCUPANT FOR
GUESTS. THE TERM "GUESTS" SHALL INCLUDE FAMILY MEMBERS AND FRIENDS WHO
CAN REASONABLY BE EXPECTED TO VISIT ON A REGULAR BASIS OR VISIT AS NEED-
ED TO CARE FOR THE TENANT, LAWFUL OCCUPANT, OR THE DWELLING UNIT IF THE
TENANT OR LAWFUL OCCUPANT IS AWAY. EMPLOYEES, INCLUDING CONTRACTORS,
PROFESSIONAL CAREGIVERS OR OTHER SERVICES PROVIDERS, MAY HAVE AN EXPIRA-
TION DATE PLACED ON THEIR KEY, KEY CARD, DIGITAL KEY OR KEY FOB, WHICH
MAY BE EXTENDED UPON THE TENANT OR LAWFUL OCCUPANT'S REQUEST. TENANTS OR
LAWFUL OCCUPANTS MAY REQUEST A NEW OR REPLACEMENT KEY, KEY FOB, DIGITAL
KEY OR KEY CARD AT ANY TIME THROUGHOUT THE COURSE OF THE TENANCY. THE
OWNER OR THEIR AGENT SHALL PROVIDE THE FIRST REPLACEMENT KEY, KEY FOB,
DIGITAL KEY OR KEY CARD TO THE TENANT OR LAWFUL OCCUPANT FREE OF CHARGE.
THE COST OF SECOND AND SUBSEQUENT REPLACEMENT KEYS, KEY FOBS, DIGITAL
KEYS OR KEY CARDS SHALL NOT BE MORE THAN WHAT THE OWNER PAID FOR THE
REPLACEMENT UP TO AND NOT EXCEEDING FORTY DOLLARS.
(E) ANY OWNER OR AGENT OF AN OWNER THAT UTILIZES A SMART ACCESS SYSTEM
SHALL ESTABLISH A WRITTEN POLICY IN PLAIN LANGUAGE THAT PROVIDES A
DESCRIPTION OF THE SMART ACCESS SYSTEM OR SYSTEMS USED IN THE CLASS A
MULTIPLE DWELLING AND AN EXPLANATION OF THE POLICIES AND PROCEDURES IN
PLACE, INCLUDING BUT NOT LIMITED TO A WRITTEN POLICY GOVERNING TENANT
REQUESTS FOR ADDITIONAL KEYS, KEY FOBS, DIGITAL KEYS OR KEY CARDS. AN
OWNER MAY DECLINE REQUESTS FOR ADDITIONAL KEYS, KEY FOBS, DIGITAL KEYS
OR KEY CARDS IF SUCH REQUESTS ARE NOT CONSISTENT WITH THE OWNER'S WRIT-
TEN POLICY, PROVIDED HOWEVER THAT ANY WRITTEN POLICY THAT VIOLATES OR
CONTRADICTS THE PROVISIONS OF THIS SECTION OR ANY OTHER APPLICABLE LAW
SHALL BE NULL AND VOID. THE OWNER SHALL NOT SET LIMITS ON THE NUMBER OF
KEYS, KEY FOBS, DIGITAL KEYS OR KEY CARDS A TENANT OR LAWFUL OCCUPANT
MAY REQUEST.
(F) AN OWNER OR AGENT OF AN OWNER THAT UTILIZES A SMART ACCESS SYSTEM
SHALL PROVIDE TO TENANTS AND LAWFUL OCCUPANTS ANY WRITTEN PRIVACY POLICY
OF THE THIRD PARTY THAT DEVELOPED THE SMART ACCESS SYSTEM UTILIZED IN
SUCH BUILDING, AND ANY WRITTEN PRIVACY POLICY OF THE THIRD PARTY THAT
CURRENTLY OPERATES THE SMART ACCESS SYSTEM UTILIZED IN SUCH BUILDING.
THE OWNER SHALL ADDITIONALLY PROVIDE CONTACT INFORMATION AND CUSTOMER
SERVICE INFORMATION OF SUCH ENTITIES TO TENANTS AND LAWFUL OCCUPANTS.
(G) ANY DOOR THAT HAS A SMART ACCESS SYSTEM SHALL HAVE BACKUP POWER OR
AN ALTERNATIVE MEANS OF ENTRY TO ENSURE THAT THE ENTRY SYSTEM CONTINUES
TO OPERATE DURING A POWER OUTAGE OR OTHER SYSTEM DISRUPTION. AN OWNER,
OR THEIR AGENT, SHALL ROUTINELY INSPECT THE BACKUP POWER AND SHALL MAIN-
TAIN OR REPLACE IT ACCORDING TO SYSTEM SPECIFICATIONS. OWNERS OR THEIR
S. 10635 4
AGENTS SHALL PROVIDE TENANTS AND LAWFUL OCCUPANTS WITH INFORMATION ABOUT
WHOM TO CONTACT IN THE EVENT THAT THE TENANT, LAWFUL OCCUPANT OR THE
TENANT'S OR LAWFUL OCCUPANT'S CHILDREN, GUESTS OR EMPLOYEES BECOME
LOCKED OUT.
3. NOTICE. OWNERS OR THEIR AGENTS SHALL PROVIDE WRITTEN NOTICE TO A
TENANT OR LAWFUL OCCUPANT AT THE TIME THE TENANT OR LAWFUL OCCUPANT
SIGNS THE LEASE, OR WHEN THE SMART ACCESS SYSTEM IS INSTALLED, OF THE
PROVISIONS OF SUBDIVISION TWO OF THIS SECTION AND A COPY OF THE WRITTEN
POLICIES REQUIRED BY THIS SECTION. FOR SMART ACCESS SYSTEMS ALREADY IN
USE, THE OWNER OR AGENT OF THE OWNER SHALL PROVIDE A COPY OF THE WRITTEN
POLICIES WITHIN NINETY DAYS OF THE EFFECTIVE DATE OF THIS SECTION.
4. DATA COLLECTION. (A) (I) THE REFERENCE DATA, AUTHENTICATION DATA,
AND ACCOUNT INFORMATION GATHERED BY ANY SMART ACCESS SYSTEM SHALL BE
LIMITED TO: (1) ACCOUNT INFORMATION NECESSARY TO ENABLE THE USE OF SUCH
SMART ACCESS SYSTEM; (2) REFERENCE DATA, INCLUDING THE USER'S NAME,
DWELLING UNIT NUMBER, AND DOORS OR COMMON AREAS TO WHICH THE USER HAS
ACCESS; (3) THE PREFERRED METHOD OF CONTACT FOR THE USER; (4) INFORMA-
TION USED TO GRANT THE USER ENTRY OR TO ACCESS ANY ONLINE TOOLS USED TO
MANAGE USER ACCOUNTS RELATED TO THE BUILDING; (5) LEASE INFORMATION
INCLUDING MOVE-IN AND, IF AVAILABLE, MOVE-OUT DATES; AND (6) AUTHENTICA-
TION DATA SUCH AS TIME AND METHOD OF ACCESS FOR SECURITY PURPOSES AND A
PHOTOGRAPH OF ACCESS EVENTS FOR SECURITY PURPOSES.
(II) NO REFERENCE DATA, AUTHENTICATION DATA, ACCOUNT INFORMATION, OR
OTHER DATA GATHERED OR STORED BY ANY SMART ACCESS SYSTEM SHALL BE SOLD,
LEASED, OR OTHERWISE DISCLOSED TO ANOTHER PARTY UNLESS REQUESTED PURSU-
ANT TO A GRAND JURY SUBPOENA, COURT ORDERED WARRANT, OR SUBPOENA, OR
OTHERWISE ORDERED BY A COURT OF COMPETENT JURISDICTION THROUGH AN ORDER
ENFORCEABLE IN NEW YORK STATE.
(B) NO SMART ACCESS SYSTEM OR OTHER SYSTEM THAT COLLECTS OR USES BIOM-
ETRIC DATA SHALL BE INSTALLED IN ANY MULTIPLE DWELLING AFTER THE EFFEC-
TIVE DATE OF THIS SECTION. FOR SMART ACCESS SYSTEMS THAT RELY ON THE
COLLECTION OF BIOMETRIC DATA THAT HAVE ALREADY BEEN INSTALLED BEFORE THE
EFFECTIVE DATE OF THIS SECTION, BIOMETRIC IDENTIFIER INFORMATION MAY BE
COLLECTED PURSUANT TO THIS SECTION IN ORDER TO REGISTER A USER AND OPER-
ATE SUCH SMART ACCESS SYSTEM, UNTIL USE OF SUCH SYSTEM IS DISCONTINUED.
USE OF SUCH SYSTEM SHALL BE DISCONTINUED NO LATER THAN TWO YEARS AFTER
THE EFFECTIVE DATE OF THIS SECTION.
(C) (I) THE OWNER OR AGENT OF THE OWNER OF A MULTIPLE DWELLING SHALL
COLLECT ONLY STRICTLY NECESSARY DATA REQUIRED BY THE TECHNOLOGY USED IN
THE SMART ACCESS SYSTEM TO IDENTIFY THE USER AND EFFECTUATE SUCH
ENTRANCE AND PROTECT THE PRIVACY AND SECURITY OF SUCH USERS.
(II) THE OWNER OR AGENT OF THE OWNER SHALL NOT REQUEST OR RETAIN, IN
ANY FORM, THE SOCIAL SECURITY NUMBER OF ANY PERSON AS A CONDITION OF USE
OF THE SMART ACCESS SYSTEM.
(III) THE OWNER, AGENT OF THE OWNER, OR THE VENDOR OF A SMART ACCESS
SYSTEM ON BEHALF OF THE OWNER MAY RECORD EACH TIME A KEY FOB, KEY CARD,
DIGITAL KEY OR PASSCODE IS USED TO ENTER THE BUILDING, BUT SHALL NOT
RECORD ANY DEPARTURES.
(IV) A COPY OF SUCH DATA MAY BE RETAINED FOR REFERENCE AT THE POINT OF
AUTHENTICATION BY THE SMART ACCESS SYSTEM. PROVIDED, HOWEVER, NO REFER-
ENCE DATA SHALL BE COLLECTED FOR USE IN A SMART ACCESS SYSTEM EXCEPT
WHERE SUCH USER HAS EXPRESSLY CONSENTED, IN WRITING, TO THE USE OF SUCH
REFERENCE DATA AND SMART ACCESS SYSTEM.
(V) THE OWNER OR AGENT OF THE OWNER OF THE MULTIPLE DWELLING OR ANY
THIRD PARTY SHALL DESTROY OR ANONYMIZE AUTHENTICATION DATA COLLECTED
FROM OR GENERATED BY SUCH SMART ACCESS SYSTEM WITHIN A REASONABLE TIME,
S. 10635 5
BUT NOT LATER THAN NINETY DAYS AFTER THE DATE COLLECTED, EXCEPT FOR THE
AUTHENTICATION DATA THAT IS RETAINED IN AN ANONYMIZED FORMAT. SUCH
ANONYMIZED DATA SHALL NOT BE DEANONYMIZED OR RE-IDENTIFIED, AND MAY BE
RETAINED FOR UP TO ONE YEAR, OR LONGER PURSUANT TO SUBPARAGRAPH (VII) OF
THIS PARAGRAPH, BEFORE DESTRUCTION. THE OWNER OR THIRD PARTY SHALL
PROVIDE PROOF OF DESTRUCTION OR ANONYMIZATION TO ANY TENANT OR LAWFUL
OCCUPANT UPON REQUEST.
(VI) REFERENCE DATA FOR A USER SHALL BE DESTROYED OR ANONYMIZED BY THE
OWNER, THE AGENT OF THE OWNER, OR THIRD PARTY WITHIN NINETY DAYS OF (1)
THE TENANT OR LAWFUL OCCUPANT PERMANENTLY VACATING THE DWELLING, OR (2)
A REQUEST BY THE TENANT OR LAWFUL OCCUPANT TO WITHDRAW AUTHORIZATION FOR
THOSE PREVIOUSLY AUTHORIZED BY THE TENANT OR LAWFUL OCCUPANT. THE OWNER
OF THE MULTIPLE DWELLING, THE AGENT OF THE OWNER, OR APPROPRIATE THIRD
PARTY, IF ANY, SHALL PROVIDE PROOF OF DESTRUCTION OR ANONYMIZATION OF
REFERENCE DATA TO THE TENANT OR LAWFUL OCCUPANT UPON REQUEST.
(VII) AN OWNER OR AGENT OF AN OWNER OF A CLASS A MULTIPLE DWELLING
THAT UTILIZES A SMART ACCESS SYSTEM AND ANY THIRD PARTY THAT HAS AN
OBLIGATION TO DESTROY DATA PURSUANT TO THIS SECTION SHALL NOT BE
REQUIRED TO DESTROY ANY DATA THAT IS STRICTLY NECESSARY TO DETECT
CYBERSECURITY INCIDENTS, PROTECT AGAINST MALICIOUS DECEPTIVE, FRAUDU-
LENT, OR ILLEGAL ACTIVITY, OR PROSECUTE THOSE RESPONSIBLE FOR THAT
ACTIVITY; IS NECESSARY TO DEBUG, IDENTIFY, REPAIR ERRORS THAT IMPAIR
EXISTING INTENDED FUNCTIONALITY; OR IS NECESSARY TO COMPLY WITH ANOTHER
LAW, LEGAL OBLIGATION, OR COURT ORDER.
(D) (I) A THIRD PARTY SHALL NOT CAPTURE BIOMETRIC IDENTIFIER INFORMA-
TION OF AN INDIVIDUAL TO GAIN ENTRANCE TO A MULTIPLE DWELLING UNLESS THE
OWNER CLEARLY AND CONSPICUOUSLY DISCLOSES NEAR ALL ENTRANCES TO THE
BUILDING USED BY TENANTS OR LAWFUL OCCUPANTS THAT THE BUILDING UTILIZES
A SMART ACCESS SYSTEM THAT COLLECTS BIOMETRIC IDENTIFIER INFORMATION.
(II) ANY THIRD PARTY THAT POSSESSES BIOMETRIC IDENTIFIER INFORMATION
OF AN INDIVIDUAL THAT IS CAPTURED BY A SMART ACCESS SYSTEM:
(1) SHALL NOT SELL, LEASE OR OTHERWISE DISCLOSE THE BIOMETRIC IDENTI-
FIER INFORMATION TO ANOTHER PARTY UNLESS PURSUANT TO A GRAND JURY
SUBPOENA, COURT ORDERED WARRANT, OR SUBPOENA, OR OTHERWISE ORDERED BY A
COURT OF COMPETENT JURISDICTION THROUGH AN ORDER ENFORCEABLE IN NEW YORK
STATE.
(2) SHALL STORE, TRANSMIT AND PROTECT FROM DISCLOSURE THE BIOMETRIC
IDENTIFIER INFORMATION USING REASONABLE CARE AND IN A MANNER THAT IS THE
SAME AS OR MORE PROTECTIVE THAN THE MANNER IN WHICH THE PERSON STORES,
TRANSMITS AND PROTECTS CONFIDENTIAL INFORMATION THE PERSON POSSESSES;
AND
(3) SHALL DESTROY THE BIOMETRIC IDENTIFIER INFORMATION WITHIN A
REASONABLE TIME, BUT NOT LATER THAN THIRTY DAYS AFTER THE DATE
COLLECTED, EXCEPT FOR REFERENCE DATA, AND PROVIDE PROOF OF SUCH
DESTRUCTION TO THE TENANT OR LAWFUL OCCUPANT UPON REQUEST. IF ANY
PROHIBITED INFORMATION IS COLLECTED, SUCH AS THE LIKENESS OF A MINOR OR
A NON-TENANT, THE INFORMATION SHALL BE DESTROYED PROMPTLY BUT NO LATER
THAN FORTY-EIGHT HOURS AFTER DETECTION OF SUCH PROHIBITED INFORMATION.
(E) THE OWNER OF THE MULTIPLE DWELLING, OR THE MANAGING AGENT, SHALL
DEVELOP AND PROVIDE TO TENANTS AND LAWFUL OCCUPANTS WRITTEN PROCEDURES
WHICH DESCRIBE THE PROCESS USED TO ADD PERSONS AUTHORIZED BY THE TENANT
OR LAWFUL OCCUPANT TO THE SMART ACCESS SYSTEM ON A TEMPORARY OR PERMA-
NENT BASIS, SUCH AS VISITORS, CHILDREN, THEIR EMPLOYEES, AND CAREGIVERS
TO SUCH BUILDING.
S. 10635 6
(I) THE PROCEDURES SHALL CLEARLY ESTABLISH THE OWNER'S RETENTION SCHE-
DULE AND GUIDELINES FOR PERMANENTLY DESTROYING OR ANONYMIZING THE DATA
COLLECTED.
(II) THE PROCEDURES SHALL NOT LIMIT TIME OR PLACE OF ENTRANCE BY SUCH
PEOPLE DULY AUTHORIZED BY THE TENANT OR LAWFUL OCCUPANT IN WRITING
EXCEPT AS REQUESTED BY THE TENANT OR LAWFUL OCCUPANT.
5. PROHIBITIONS. (A) NO FORM OF LOCATION TRACKING BEYOND ONE HUNDRED
FEET OF THE MULTIPLE DWELLING, INCLUDING BUT NOT LIMITED TO SATELLITE
LOCATION BASED SERVICES, SHALL BE PERMITTED IN ANY EQUIPMENT, KEY, OR
SOFTWARE PROVIDED TO USERS AS PART OF A SMART ACCESS SYSTEM. LOCATION
TRACKING FEATURES SHALL BE CAPABLE OF BEING DISABLED WHEN THE SYSTEM IS
NOT IN USE FOR THE PURPOSES OF GRANTING ACCESS TO A CLASS A MULTIPLE
DWELLING, COMMON AREAS IN SUCH MULTIPLE DWELLING, OR TO AN INDIVIDUAL
DWELLING UNIT IN SUCH MULTIPLE DWELLING.
(B) IT SHALL BE PROHIBITED TO USE A SMART ACCESS SYSTEM TO CAPTURE THE
REFERENCE DATA OF ANY MINOR, EXCEPT AS AUTHORIZED IN WRITING BY SUCH
MINOR'S PARENT OR LEGAL GUARDIAN, OR INFORMATION ON THE RELATIONSHIP
STATUS OR HEALTH STATUS OF TENANTS OR LAWFUL OCCUPANTS AND THEIR GUESTS
OR EMPLOYEES. IT IS FURTHER PROHIBITED TO USE A SMART ACCESS SYSTEM TO
COLLECT OR TRACK INDIVIDUALLY IDENTIFIABLE OR REASONABLY LINKABLE INFOR-
MATION ABOUT THE FREQUENCY AND TIME OF USE OF SUCH SYSTEM TO AN INDIVID-
UAL TENANT OR LAWFUL OCCUPANT AND THEIR GUESTS OR EMPLOYEES TO HARASS OR
EVICT A TENANT OR LAWFUL OCCUPANT OR FOR ANY OTHER PURPOSE NOT EXPRESSLY
RELATED TO THE OPERATION OF THE SMART ACCESS SYSTEM. SUCH USAGE DATA MAY
BE COLLECTED ONLY IN ANONYMIZED AND AGGREGATED FORM.
(C) INFORMATION THAT IS ACQUIRED VIA THE USE OF A SMART ACCESS SYSTEM
SHALL NOT BE USED FOR ANY PURPOSES OTHER THAN GRANTING ACCESS TO AND
MONITORING BUILDING ENTRANCES AND SHALL NOT BE USED AS A BASIS OR
SUPPORT FOR AN ACTION TO EVICT A LESSEE, TENANT, OR LAWFUL OCCUPANT, OR
AN ADMINISTRATIVE HEARING SEEKING A CHANGE IN REGULATORY COVERAGE FOR AN
INDIVIDUAL OR UNIT. HOWEVER, A TENANT OR LAWFUL OCCUPANT MAY AUTHORIZE
THEIR INFORMATION TO BE USED BY A THIRD PARTY, BUT SUCH A REQUEST SHALL
CLEARLY STATE WHO WILL HAVE ACCESS TO SUCH INFORMATION, FOR WHAT PURPOSE
IT WILL BE USED, AND THE PRIVACY POLICIES WHICH WILL PROTECT THEIR
INFORMATION. UNDER NO CIRCUMSTANCES SHALL A LEASE OR A RENEWAL BE
CONTINGENT UPON AUTHORIZING SUCH USE. SMART ACCESS SYSTEMS MAY USE
THIRD-PARTY SERVICES TO THE EXTENT REQUIRED TO MAINTAIN AND OPERATE
SYSTEM INFRASTRUCTURE, INCLUDING CLOUD-BASED HOSTING AND STORAGE. THE
PROVIDER OR PROVIDERS OF THIRD-PARTY INFRASTRUCTURE SERVICES SHALL MEET
OR EXCEED THE PRIVACY PROTECTIONS SET FORTH IN THIS SECTION AND SHALL BE
SUBJECT TO THE SAME LIABILITY FOR BREACH OF ANY OF THE REQUIREMENTS OF
THIS SECTION. THIRD-PARTY SERVICES USED BY THE SMART ACCESS SYSTEM SHALL
BE DISCLOSED TO TENANTS OR LAWFUL OCCUPANTS AS PART OF THE WRITTEN POLI-
CY REQUIRED BY THIS SECTION.
(D) INFORMATION AND DATA COLLECTED BUT NOT ANONYMIZED OR AGGREGATED
SHALL NOT BE MADE AVAILABLE TO ANY THIRD PARTY, UNLESS AUTHORIZED AS
DESCRIBED IN PARAGRAPH (C) OF THIS SUBDIVISION, INCLUDING BUT NOT LIMIT-
ED TO LAW ENFORCEMENT, EXCEPT UPON A GRAND JURY SUBPOENA OR A COURT
ORDERED WARRANT, SUBPOENA, OR OTHER AUTHORIZED COURT ORDERED PROCESS.
6. STORAGE OF INFORMATION. ANY INFORMATION OR DATA COLLECTED SHALL BE
STORED IN A SECURE MANNER TO PREVENT UNAUTHORIZED ACCESS BY BOTH EMPLOY-
EES AND CONTRACTORS AND THOSE UNAFFILIATED WITH THE OWNER OR THEIR
AGENTS, EXCEPT AS OTHERWISE PROVIDED IN THIS SECTION. FUTURE OR CONTINU-
ING TENANCY SHALL NOT BE CONDITIONED UPON CONSENTING TO THE USE OF A
SMART ACCESS SYSTEM.
S. 10635 7
7. SOFTWARE AND HARDWARE ISSUES. WHENEVER A COMPANY THAT PRODUCES,
MAKES AVAILABLE OR INSTALLS SMART ACCESS SYSTEMS DISCOVERS A SECURITY
BREACH OR CRITICAL SECURITY VULNERABILITY IN THEIR SOFTWARE OR HARDWARE,
SUCH COMPANY SHALL NOTIFY CUSTOMERS OF SUCH VULNERABILITY WITHIN A
REASONABLE TIME OF DISCOVERY BUT NO LATER THAN TWENTY-FOUR HOURS AFTER
DISCOVERY AND SHALL MAKE SOFTWARE UPDATES AVAILABLE AND TAKE ANY OTHER
ACTION AS MAY BE NECESSARY TO REPAIR THE VULNERABILITY WITHIN A REASON-
ABLE TIME, BUT NOT LONGER THAN THIRTY DAYS AFTER DISCOVERY. SMART ACCESS
SYSTEMS AND VENDORS SHALL IMPLEMENT AND MAINTAIN REASONABLE SECURITY
PROCEDURES AND PRACTICES APPROPRIATE TO THE NATURE OF THE INFORMATION
COLLECTED. IN THE EVENT THAT A SECURITY BREACH OR CRITICAL SECURITY
VULNERABILITY THAT PERTAINS TO THE EMBEDDED SOFTWARE, HARDWARE, OR FIRM-
WARE ON THE SMART ACCESS SYSTEMS IS DISCOVERED, SMART ACCESS SYSTEMS AND
THEIR VENDORS SHALL:
(A) BE ABLE TO CREATE UPDATES TO CORRECT THE VULNERABILITIES;
(B) CONTRACTUALLY COMMIT TO CUSTOMERS THAT THE SMART ACCESS SYSTEM OR
VENDOR WILL CREATE UPDATES TO THE EMBEDDED SOFTWARE, HARDWARE, OR FIRM-
WARE TO REMEDY THE VULNERABILITIES; AND
(C) MAKE SUCH SECURITY-RELATED SOFTWARE, HARDWARE, OR FIRMWARE UPDATES
AVAILABLE FOR FREE TO CUSTOMERS FOR THE DURATION OF THE CONTRACT BETWEEN
THE BUILDING AND SMART ACCESS SYSTEMS.
8. WAIVER OF RIGHTS; VOID. ANY AGREEMENT BY A LESSEE OR TENANT OF A
DWELLING WAIVING OR MODIFYING THEIR RIGHTS AS SET FORTH IN THIS SECTION
SHALL BE VOID AS CONTRARY TO PUBLIC POLICY.
9. PENALTIES. (A) A PERSON WHO VIOLATES THIS SECTION SHALL BE SUBJECT
TO A CIVIL PENALTY OF NOT MORE THAN FIVE THOUSAND DOLLARS FOR EACH
VIOLATION. THE ATTORNEY GENERAL MAY BRING AN ACTION TO RECOVER THE
CIVIL PENALTY. AN INDIVIDUAL INJURED BY A VIOLATION OF THIS SECTION MAY
BRING AN ACTION TO RECOVER DAMAGES. A COURT MAY ALSO AWARD ATTORNEYS'
FEES TO A PREVAILING PLAINTIFF.
(B) WHERE AN OWNER OR THEIR AGENT RECEIVES A JUDGMENT THAT THEIR USE
OF A SMART ACCESS SYSTEM RESULTED IN HARASSMENT OR OTHERWISE DEPRIVED A
TENANT OR LAWFUL OCCUPANT OF ANY RIGHTS AVAILABLE UNDER LAW, SUCH OWNER
OR AGENT SHALL BE SUBJECT TO A CIVIL PENALTY OF NOT MORE THAN TEN THOU-
SAND DOLLARS FOR EACH VIOLATION, PROVIDED HOWEVER THAT THE TOTAL PENALTY
SHALL NOT EXCEED ONE HUNDRED THOUSAND DOLLARS.
(C) FOR PURPOSES OF THIS SUBDIVISION, EACH DAY THE VIOLATION OCCURS
SHALL BE CONSIDERED A SEPARATE VIOLATION.
10. RENT REGULATED DWELLINGS. INSTALLATION OF A SMART ACCESS SYSTEM
PURSUANT TO THIS SECTION IN A DWELLING SUBJECT TO THE EMERGENCY TENANT
PROTECTION ACT OF NINETEEN SEVENTY-FOUR, THE EMERGENCY HOUSING RENT
CONTROL LAW, THE LOCAL EMERGENCY HOUSING RENT CONTROL ACT, OR THE RENT
STABILIZATION LAW OF NINETEEN HUNDRED SIXTY-NINE SHALL CONSTITUTE A
MODIFICATION OF SERVICES REQUIRING THE OWNER OF SUCH DWELLING OR THEIR
AGENT TO APPLY TO THE DIVISION OF HOUSING AND COMMUNITY RENEWAL FOR
APPROVAL BEFORE PERFORMING SUCH INSTALLATION. SUCH INSTALLATION SHALL
NOT QUALIFY AS A BASIS FOR RENT REDUCTION.
11. EXEMPTIONS. (A) NOTHING HEREIN SHALL APPLY TO MULTIPLE DWELLINGS
OWNED OR MANAGED BY AN ENTITY SUBJECT TO 42 U.S.C. § 1437 ET SEQ., OR
ANY OF ITS SUBSIDIARIES, OR MULTIPLE DWELLINGS THAT ARE PRIMARILY OCCU-
PIED BY TRANSIENT OCCUPANTS FOR A PERIOD OF LESS THAN THIRTY DAYS.
(B) NOTHING IN THIS SECTION SHALL LIMIT THE AUTHORITY OF THE DIVISION
OF HOUSING AND COMMUNITY RENEWAL TO IMPOSE ADDITIONAL REQUIREMENTS
REGARDING SMART ACCESS SYSTEMS INSTALLED IN MULTIPLE DWELLINGS FOR WHICH
THE DIVISION IS REQUIRED TO APPROVE SUBSTITUTIONS OR MODIFICATIONS OF
SERVICES.
S. 10635 8
§ 3. Severability. If any provision of this act, or any application of
any provision of this act, is held to be invalid, that shall not affect
the validity or effectiveness of any other provision of this act, or of
any other application of any provision of this act, which can be given
effect without that provision or application; and to that end, the
provisions and applications of this act are severable.
§ 4. This act shall take effect on the one hundred eightieth day after
it shall have become a law.
