[ ] is old law to be omitted.
LBD00549-06-1
A. 706--C 2
(D) "REFERENCE DATA" MEANS INFORMATION AGAINST WHICH AUTHENTICATION
DATA IS VERIFIED AT A POINT OF AUTHENTICATION BY A SMART ACCESS SYSTEM
IN ORDER TO GRANT A USER ENTRY TO A SMART ACCESS BUILDING OR COMMON AREA
OF SUCH BUILDING.
(E) "SECURITY BREACH" MEANS ANY INCIDENT THAT RESULTS IN UNAUTHORIZED
ACCESS OF DATA, APPLICATIONS, SERVICES, NETWORKS AND/OR DEVICES BY
BYPASSING UNDERLYING SECURITY MECHANISMS. A "SECURITY BREACH" OCCURS
WHEN AN INDIVIDUAL OR AN APPLICATION ILLEGITIMATELY ENTERS A PRIVATE,
CONFIDENTIAL OR UNAUTHORIZED LOGICAL INFORMATION TECHNOLOGY PERIMETER.
2. ENTRY. A. WHERE A LANDLORD INSTALLS OR PLANS TO INSTALL AN ELEC-
TRONIC OR COMPUTERIZED ENTRY SYSTEM ON ANY ENTRANCE FROM THE STREET,
PASSAGEWAY, COURT, YARD, CELLAR, OR OTHER COMMON AREA OF A CLASS A
MULTIPLE DWELLING, SUCH SYSTEM SHALL NOT RELY SOLELY ON A WEB-BASED
APPLICATION TO FACILITATE ENTRANCE BUT SHALL ALSO INCLUDE A KEY FOB, KEY
CARD, DIGITAL KEY OR PASSCODE FOR TENANT USE.
B. LANDLORDS MAY PROVIDE VARIOUS METHODS OF ENTRY INTO INDIVIDUAL
APARTMENTS INCLUDING A MECHANICAL KEY OR AN ELECTRONIC OR COMPUTERIZED
ENTRY SYSTEM OF A KEY FOB, KEY CARD OR DIGITAL KEY, PROVIDED, HOWEVER
THAT SUCH ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM SHALL NOT RELY SOLELY
ON A WEB-BASED APPLICATION.
C. NOTWITHSTANDING PARAGRAPH A OR B OF THIS SUBDIVISION, LANDLORDS
SHALL PROVIDE A NON-ELECTRONIC MEANS OF ENTRY WHERE REQUESTED BY THE
TENANT DUE TO A RELIGIOUS PREFERENCE.
D. ALL LAWFUL TENANTS AND OCCUPANTS SHALL BE PROVIDED WITH A KEY, KEY
FOB, DIGITAL KEY OR KEY CARD AT NO COST TO SUCH TENANTS. THE TERM "OCCU-
PANTS" SHALL INCLUDE CHILDREN UNDER THE AGE OF EIGHTEEN WHO SHALL BE
ISSUED A KEY, KEY FOB, DIGITAL KEY OR KEY CARD IF A PARENT OR GUARDIAN
REQUESTS SUCH CHILD BE PROVIDED WITH ONE. TENANTS MAY ALSO RECEIVE UP TO
FOUR ADDITIONAL KEYS, KEY FOBS, DIGITAL KEY OR KEY CARDS AT NO COST TO
THE TENANT FOR EMPLOYEES OR GUESTS. THE TERM "GUESTS" SHALL INCLUDE
FAMILY MEMBERS AND FRIENDS WHO CAN REASONABLY BE EXPECTED TO VISIT ON A
REGULAR BASIS OR VISIT AS NEEDED TO CARE FOR THE TENANT OR THE APARTMENT
IF THE TENANT IS AWAY. EMPLOYEES, INCLUDING CONTRACTORS, PROFESSIONAL
CAREGIVERS OR OTHER SERVICES PROVIDERS, MAY HAVE AN EXPIRATION DATE
PLACED ON THEIR KEY, KEY CARD, DIGITAL KEY OR KEY FOB, WHICH MAY BE
EXTENDED UPON THE TENANT'S OR OCCUPANT'S REQUEST. TENANTS MAY REQUEST A
NEW OR REPLACEMENT KEY, KEY FOB, DIGITAL KEY OR KEY CARD AT ANY TIME
THROUGHOUT THE COURSE OF THE TENANCY. THE LANDLORD OR HIS OR HER AGENT
SHALL PROVIDE THE FIRST REPLACEMENT KEY, KEY FOB, DIGITAL KEY OR KEY
CARD TO THE TENANT FREE OF CHARGE. THE COST OF SECOND AND SUBSEQUENT
REPLACEMENT CARDS SHALL NOT BE MORE THAN WHAT THE LANDLORD PAID FOR THE
REPLACEMENT UP TO AND NOT EXCEEDING TWENTY-FIVE DOLLARS.
E. THE LANDLORD SHALL NOT SET LIMITS ON THE NUMBER OF KEYS, KEY FOBS,
DIGITAL KEYS OR KEY CARDS A LAWFUL TENANT OR OCCUPANT MAY REQUEST.
F. ANY DOOR THAT HAS AN ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM SHALL
HAVE BACKUP POWER OR AN ALTERNATIVE MEANS OF ENTRY TO ENSURE THAT THE
ENTRY SYSTEM CONTINUES TO OPERATE DURING A POWER OUTAGE. A LANDLORD, OR
HIS OR HER AGENT, SHALL ROUTINELY INSPECT THE BACKUP POWER AND SHALL
REPLACE ACCORDING TO SYSTEM SPECIFICATIONS. OWNERS OR THEIR AGENTS
SHALL PROVIDE LAWFUL TENANTS AND OCCUPANTS WITH INFORMATION ABOUT WHOM
TO CONTACT IN THE EVENT THAT THE TENANT, OCCUPANT OR THE TENANT'S OR
OCCUPANT'S CHILDREN, GUESTS OR EMPLOYEES BECOME LOCKED OUT.
3. NOTICE. LANDLORDS OR THEIR AGENTS SHALL PROVIDE NOTICE TO A TENANT
AT THE TIME THE TENANT SIGNS THE LEASE, OR WHEN THE ELECTRONIC OR
COMPUTERIZED ENTRY SYSTEM IS INSTALLED, OF THE PROVISIONS OF SUBDIVISION
TWO OF THIS SECTION.
A. 706--C 3
4. DATA COLLECTION. A. IF AN ELECTRONIC AND/OR COMPUTERIZED ENTRY
SYSTEM IS UTILIZED TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING, THE
ONLY REFERENCE, AUTHENTICATION, AND ACCOUNT INFORMATION GATHERED BY ANY
ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM SHALL BE LIMITED TO ACCOUNT
INFORMATION USED TO GRANT A USER ENTRY OR TO ACCESS ANY ONLINE TOOLS
USED TO MANAGE USER ACCOUNTS RELATED TO THE ELECTRONIC AND/OR COMPUTER-
IZED ENTRY SYSTEM, OR REFERENCE DATA, SUCH AS THE LESSEE OR TENANT'S
NAME, APARTMENT NUMBER, THE PREFERRED METHOD OF CONTACT FOR SUCH LESSEE
OR TENANT, OTHER DOORS OR COMMON AREAS TO WHICH THE USER HAS ACCESS,
MOVE-IN AND, IF AVAILABLE MOVE-OUT DATES, AND AUTHENTICATION DATA SUCH
AS TIME AND METHOD OF ACCESS FOR SECURITY PURPOSES AND A PHOTOGRAPH OF
ACCESS EVENTS FOR SECURITY PURPOSES. FOR ELECTRONIC AND COMPUTERIZED
ENTRY SYSTEMS THAT RELY ON THE COLLECTION OF BIOMETRIC DATA AND WHICH
HAVE ALREADY BEEN INSTALLED AT THE TIME THIS SECTION SHALL HAVE BECOME A
LAW, A BIOMETRIC IDENTIFIER MAY BE COLLECTED PURSUANT TO THIS SECTION IN
ORDER TO REGISTER A LESSEE OR TENANT FOR AN ELECTRONIC AND/OR COMPUTER-
IZED ENTRY SYSTEM. NO NEW ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEMS
THAT RELY ON THE COLLECTION OF BIOMETRIC DATA SHALL BE INSTALLED IN
CLASS A MULTIPLE DWELLINGS FOR THREE YEARS AFTER THE EFFECTIVE DATE OF
THIS SECTION.
(I) THE OWNER OF THE MULTIPLE DWELLING MAY COLLECT ONLY THE MINIMUM
DATA REQUIRED BY THE TECHNOLOGY USED IN THE ELECTRONIC AND/OR COMPUTER-
IZED ENTRY SYSTEM TO EFFECTUATE SUCH ENTRANCE AND PROTECT THE PRIVACY
AND SECURITY OF SUCH TENANTS.
(II) THE OWNER OR AGENT OF THE OWNER SHALL NOT REQUEST OR RETAIN, IN
ANY FORM, THE SOCIAL SECURITY NUMBER OF ANY TENANT OR OCCUPANT AS A
CONDITION OF USE OF THE ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM.
(III) THE OWNER, AGENT OF THE OWNER, OR THE VENDOR OF AN ELECTRONIC OR
COMPUTERIZED ENTRY SYSTEM ON BEHALF OF THE OWNER MAY RECORD EACH TIME A
KEY FOB, KEY CARD, DIGITAL KEY OR PASSCODE IS USED TO ENTER THE BUILD-
ING, BUT SHALL NOT RECORD ANY DEPARTURES.
(IV) A COPY OF SUCH DATA MAY BE RETAINED FOR REFERENCE AT THE POINT OF
AUTHENTICATION BY THE ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM. SUCH
REFERENCE DATA MAY BE RETAINED ONLY FOR TENANTS OR THOSE AUTHORIZED BY
THE TENANT OR OWNER OF THE MULTIPLE DWELLING.
(V) THE OWNER OF THE MULTIPLE DWELLING SHALL DESTROY OR ANONYMIZE
AUTHENTICATION DATA WITHIN A REASONABLE TIME, BUT NOT LATER THAN NINETY
DAYS AFTER THE DATE COLLECTED.
(VI) REFERENCE DATA FOR A TENANT OR THOSE AUTHORIZED BY A TENANT SHALL
BE DESTROYED OR ANONYMIZED WITHIN NINETY DAYS OF (1) THE TENANT PERMA-
NENTLY VACATING THE DWELLING, OR (2) A REQUEST BY THE TENANT TO WITHDRAW
AUTHORIZATION FOR THOSE PREVIOUSLY AUTHORIZED BY THE TENANT.
B. (I) FOR THE PURPOSES OF THIS SECTION, "BIOMETRIC IDENTIFIER" MEANS
A RETINA OR IRIS SCAN, FINGERPRINT, VOICEPRINT, OR RECORD OF HAND, FACE
GEOMETRY OR OTHER SIMILAR FEATURE.
(II) AN ENTITY MAY NOT CAPTURE A BIOMETRIC IDENTIFIER OF AN INDIVIDUAL
TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING UNLESS THE PERSON IS A
TENANT OR PERSON AUTHORIZED BY THE TENANT, AND INFORMS THE INDIVIDUAL
BEFORE CAPTURING THE BIOMETRIC IDENTIFIER; AND RECEIVES THEIR EXPRESS
CONSENT TO CAPTURE THE BIOMETRIC IDENTIFIER.
(III) ANY ENTITY THAT POSSESSES A BIOMETRIC IDENTIFIER OF AN INDIVID-
UAL THAT IS CAPTURED TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING:
(1) MAY NOT SELL, LEASE OR OTHERWISE DISCLOSE THE BIOMETRIC IDENTIFIER
TO ANOTHER PERSON UNLESS PURSUANT TO A GRAND JURY SUBPOENA OR COURT
ORDERED WARRANT, SUBPOENA, OR OTHER AUTHORIZED COURT ORDERED PROCESS.
A. 706--C 4
(2) SHALL STORE, TRANSMIT AND PROTECT FROM DISCLOSURE THE BIOMETRIC
IDENTIFIER USING REASONABLE CARE AND IN A MANNER THAT IS THE SAME AS OR
MORE PROTECTIVE THAN THE MANNER IN WHICH THE PERSON STORES, TRANSMITS
AND PROTECTS CONFIDENTIAL INFORMATION THE PERSON POSSESSES; AND
(3) SHALL DESTROY THE BIOMETRIC IDENTIFIER WITHIN A REASONABLE TIME,
BUT NOT LATER THAN FORTY-EIGHT HOURS AFTER THE DATE COLLECTED, EXCEPT
FOR REFERENCE DATA. IF ANY PROHIBITED INFORMATION IS COLLECTED, SUCH AS
THE LIKENESS OF A MINOR OR A NON-TENANT, THE INFORMATION SHALL BE
DESTROYED IMMEDIATELY.
C. THE OWNER OF THE MULTIPLE DWELLING, OR THE MANAGING AGENT, MUST
DEVELOP WRITTEN PROCEDURES WHICH DESCRIBE THE PROCESS USED TO ADD
PERSONS AUTHORIZED BY THE TENANT TO ELECTRONIC AND/OR COMPUTERIZED ENTRY
SYSTEMS ON A TEMPORARY OR PERMANENT BASIS, SUCH AS VISITORS, CHILDREN,
THEIR EMPLOYEES, AND CAREGIVERS TO SUCH BUILDING.
(I) THE PROCEDURES MUST CLEARLY ESTABLISH THE OWNER'S RETENTION SCHED-
ULE AND GUIDELINES FOR PERMANENTLY DESTROYING OR ANONYMIZING THE DATA
COLLECTED.
(II) THE PROCEDURES CANNOT LIMIT TIME OR PLACE OF ENTRANCE BY SUCH
PEOPLE AUTHORIZED BY THE TENANT EXCEPT AS REQUESTED BY THE TENANT.
5. PROHIBITIONS. A. NO FORM OF LOCATION TRACKING, INCLUDING BUT NOT
LIMITED TO SATELLITE LOCATION BASED SERVICES, SHALL BE INCLUDED IN ANY
EQUIPMENT, KEY, OR SOFTWARE PROVIDED TO TENANTS OR GUESTS AS PART OF AN
ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
B. IT SHALL BE PROHIBITED TO COLLECT THROUGH AN ELECTRONIC AND/OR
COMPUTERIZED ENTRY SYSTEM THE LIKENESS OF A MINOR OCCUPANT, INFORMATION
ON THE RELATIONSHIP STATUS OF TENANTS, LESSEES AND/OR GUESTS, OR TO USE
A SMART ACCESS SYSTEM TO COLLECT OR TRACK INFORMATION ABOUT THE FREQUEN-
CY AND TIME OF USE OF SUCH SYSTEM BY A TENANT AND/OR GUESTS TO HARASS OR
EVICT A TENANT OR FOR ANY OTHER PURPOSE NOT EXPRESSLY RELATED TO THE
OPERATION OF THE SMART ACCESS SYSTEM.
C. INFORMATION THAT IS ACQUIRED VIA THE USE OF AN ELECTRONIC AND/OR
COMPUTERIZED ENTRY SYSTEM SHALL NOT BE USED FOR ANY PURPOSES OTHER THAN
MONITORING BUILDING ENTRANCES AND SHALL NOT BE USED AS THE BASIS OR
SUPPORT FOR AN ACTION TO EVICT A LESSEE OR TENANT, OR AN ADMINISTRATIVE
HEARING SEEKING A CHANGE IN REGULATORY COVERAGE FOR AN INDIVIDUAL OR
UNIT. HOWEVER, A TENANT MAY AUTHORIZE THEIR INFORMATION TO BE USED BY A
THIRD PARTY, BUT SUCH A REQUEST MUST CLEARLY STATE WHO WILL HAVE ACCESS
TO SUCH INFORMATION, FOR WHAT PURPOSE IT WILL BE USED, AND THE PRIVACY
POLICIES WHICH WILL PROTECT THEIR INFORMATION. UNDER NO CIRCUMSTANCES
MAY A LEASE OR A RENEWAL BE CONTINGENT UPON AUTHORIZING SUCH USE. ELEC-
TRONIC AND/OR COMPUTERIZED SYSTEMS MAY USE THIRD-PARTY SERVICES TO THE
EXTENT REQUIRED TO MAINTAIN AND OPERATE SYSTEM INFRASTRUCTURE, INCLUDING
CLOUD-BASED HOSTING AND STORAGE. THE PROVIDER OR PROVIDERS OF THIRD-PAR-
TY INFRASTRUCTURE SERVICES MUST MEET OR EXCEED THE PRIVACY PROTECTIONS
SET FORTH IN THIS SECTION AND WILL BE SUBJECT TO THE SAME LIABILITY FOR
BREACH OF ANY OF THE REQUIREMENTS OF THIS SECTION.
D. INFORMATION AND DATA COLLECTED SHALL NOT BE MADE AVAILABLE TO ANY
THIRD PARTY, UNLESS AUTHORIZED AS DESCRIBED ABOVE, INCLUDING BUT NOT
LIMITED TO LAW ENFORCEMENT, EXCEPT UPON A GRAND JURY SUBPOENA OR A COURT
ORDERED WARRANT, SUBPOENA, OR OTHER AUTHORIZED COURT ORDERED PROCESS.
6. STORAGE OF INFORMATION. ANY INFORMATION OR DATA COLLECTED SHALL BE
STORED IN A SECURE MANNER TO PREVENT UNAUTHORIZED ACCESS BY BOTH EMPLOY-
EES AND CONTRACTORS AND THOSE UNAFFILIATED WITH THE LANDLORD OR THEIR
AGENTS, EXCEPT AS OTHERWISE PROVIDED IN THIS SECTION. FUTURE OR CONTINU-
ING TENANCY SHALL NOT BE CONDITIONED UPON CONSENTING TO THE USE OF AN
ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
A. 706--C 5
7. SOFTWARE ISSUES. WHENEVER A COMPANY THAT PRODUCES, MAKES AVAILABLE
OR INSTALLS ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS DISCOVERS A SECURI-
TY BREACH OR CRITICAL SECURITY VULNERABILITY IN THEIR SOFTWARE, SUCH
COMPANY SHALL NOTIFY CUSTOMERS OF SUCH VULNERABILITY WITHIN A REASONABLE
TIME OF DISCOVERY BUT NO LATER THAN TWENTY-FOUR HOURS AFTER DISCOVERY
AND SHALL MAKE SOFTWARE UPDATES AVAILABLE AND TAKE ANY OTHER ACTION AS
MAY BE NECESSARY TO REPAIR THE VULNERABILITY WITHIN A REASONABLE TIME,
BUT NOT LONGER THAN THIRTY DAYS AFTER DISCOVERY. SMART ACCESS SYSTEMS
AND VENDORS SHALL IMPLEMENT AND MAINTAIN REASONABLE SECURITY PROCEDURES
AND PRACTICES APPROPRIATE TO THE NATURE OF THE INFORMATION COLLECTED. IN
THE EVENT THAT A SECURITY BREACH OR CRITICAL SECURITY VULNERABILITY THAT
PERTAINS TO THE EMBEDDED SOFTWARE OR FIRMWARE ON THE SMART ACCESS
SYSTEMS IS DISCOVERED, SMART ACCESS SYSTEMS AND THEIR VENDORS SHALL:
A. BE ABLE TO CREATE UPDATES TO THE FIRMWARE TO CORRECT THE VULNER-
ABILITIES;
B. CONTRACTUALLY COMMIT TO CUSTOMERS THAT THE SMART ACCESS SYSTEM OR
VENDOR WILL CREATE UPDATES TO THE EMBEDDED SOFTWARE OR FIRMWARE TO REME-
DY THE VULNERABILITIES; AND
C. MAKE SUCH SECURITY-RELATED SOFTWARE OR FIRMWARE UPDATES AVAILABLE
FOR FREE TO CUSTOMERS FOR THE DURATION OF THE CONTRACT BETWEEN SMART
ACCESS BUILDINGS AND SMART ACCESS SYSTEMS.
8. WAIVER OF RIGHTS; VOID. ANY AGREEMENT BY A LESSEE OR TENANT OF A
DWELLING WAIVING OR MODIFYING HIS OR HER RIGHTS AS SET FORTH IN THIS
SECTION SHALL BE VOID AS CONTRARY TO PUBLIC POLICY.
9. PENALTIES. (A) A PERSON WHO VIOLATES THIS SECTION IS SUBJECT TO A
CIVIL PENALTY OF NOT MORE THAN FIVE THOUSAND DOLLARS FOR EACH VIOLATION.
THE ATTORNEY GENERAL MAY BRING AN ACTION TO RECOVER THE CIVIL PENALTY.
AN INDIVIDUAL INJURED BY A VIOLATION OF THIS SECTION MAY BRING AN ACTION
TO RECOVER DAMAGES. A COURT MAY ALSO AWARD ATTORNEYS' FEES TO A PREVAIL-
ING PLAINTIFF.
(B) WHERE A LANDLORD OR HIS OR HER AGENT USES AN ELECTRONIC OR COMPUT-
ERIZED ENTRY SYSTEM TO HARASS OR OTHERWISE DEPRIVE A TENANT OF ANY
RIGHTS AVAILABLE UNDER LAW, SUCH LANDLORD OR AGENT SHALL BE SUBJECT TO A
CIVIL PENALTY OF TEN THOUSAND DOLLARS FOR EACH VIOLATION.
(C) FOR PURPOSES OF THIS SUBDIVISION, EACH DAY THE VIOLATION OCCURS
SHALL BE CONSIDERED A SEPARATE VIOLATION.
10. RENT REGULATED DWELLINGS. INSTALLATION OF AN ELECTRONIC OR COMPUT-
ERIZED ENTRY SYSTEM PURSUANT TO THIS SECTION IN A RENT REGULATED DWELL-
ING SHALL CONSTITUTE A MODIFICATION OF SERVICES REQUIRING THE LANDLORD
OF SUCH DWELLING OR HIS OR HER AGENT TO APPLY TO THE DIVISION OF HOUSING
AND COMMUNITY RENEWAL FOR APPROVAL BEFORE PERFORMING SUCH INSTALLATION.
SUCH INSTALLATION SHALL NOT QUALIFY AS A BASIS FOR RENT REDUCTION.
11. EXEMPTIONS. A. NOTHING HEREIN SHALL APPLY TO MULTIPLE DWELLINGS
OWNED OR MANAGED BY AN ENTITY SUBJECT TO 42 U.S.C. § 1437 ET SEQ., OR
ANY OF ITS SUBSIDIARIES.
B. NOTHING IN THIS SECTION SHALL LIMIT THE AUTHORITY OF THE DIVISION
OF HOUSING AND COMMUNITY RENEWAL TO IMPOSE ADDITIONAL REQUIREMENTS
REGARDING ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS INSTALLED IN MULTIPLE
DWELLINGS FOR WHICH THE DIVISION IS REQUIRED TO APPROVE SUBSTITUTIONS OR
MODIFICATIONS OF SERVICES.
§ 2. The multiple residence law is amended by adding a new section
130-a to read as follows:
§ 130-A. ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS. 1. DEFINITIONS. FOR
THE PURPOSES OF THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOW-
ING MEANINGS:
A. 706--C 6
(A) "ACCOUNT INFORMATION" MEANS INFORMATION THAT IS USED TO GRANT A
USER ENTRY OR ACCESS TO ANY ONLINE TOOLS THAT ARE USED TO MANAGE USER
ACCOUNTS RELATED TO AN ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
(B) "AUTHENTICATION DATA" MEANS DATA GENERATED OR COLLECTED AT A POINT
OF AUTHENTICATION IN CONNECTION WITH GRANTING A USER ENTRY TO A CLASS A
MULTIPLE DWELLING OR COMMON AREA WITH AN ELECTRONIC OR COMPUTERIZED
ENTRY SYSTEM, EXCEPT THAT "AUTHENTICATION DATA" SHALL NOT INCLUDE DATA
GENERATED THROUGH OR COLLECTED BY A VIDEO OR CAMERA SYSTEM THAT IS USED
TO MONITOR ENTRANCES BUT NOT TO GRANT ENTRY.
(C) "CRITICAL SECURITY VULNERABILITY" MEANS A SECURITY VULNERABILITY
THAT HAS A SIGNIFICANT RISK OF RESULTING IN AN UNAUTHORIZED ACCESS TO AN
AREA SECURED BY AN ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
(D) "REFERENCE DATA" MEANS INFORMATION AGAINST WHICH AUTHENTICATION
DATA IS VERIFIED AT A POINT OF AUTHENTICATION BY A SMART ACCESS SYSTEM
IN ORDER TO GRANT A USER ENTRY TO A SMART ACCESS BUILDING OR COMMON AREA
OF SUCH BUILDING.
(E) "SECURITY BREACH" MEANS ANY INCIDENT THAT RESULTS IN UNAUTHORIZED
ACCESS OF DATA, APPLICATIONS, SERVICES, NETWORKS AND/OR DEVICES BY
BYPASSING UNDERLYING SECURITY MECHANISMS. A "SECURITY BREACH" OCCURS
WHEN AN INDIVIDUAL OR AN APPLICATION ILLEGITIMATELY ENTERS A PRIVATE,
CONFIDENTIAL OR UNAUTHORIZED LOGICAL INFORMATION TECHNOLOGY PERIMETER.
2. ENTRY. (A) WHERE A LANDLORD INSTALLS OR PLANS TO INSTALL AN ELEC-
TRONIC OR COMPUTERIZED ENTRY SYSTEM ON ANY ENTRANCE FROM THE STREET,
PASSAGEWAY, COURT, YARD, CELLAR, OR OTHER COMMON AREA OF A CLASS A
MULTIPLE DWELLING, SUCH SYSTEM SHALL NOT RELY SOLELY ON A WEB-BASED
APPLICATION TO FACILITATE ENTRANCE BUT SHALL ALSO INCLUDE A KEY FOB, KEY
CARD, DIGITAL KEY OR PASSCODE FOR TENANT USE.
(B) LANDLORDS MAY PROVIDE VARIOUS METHODS OF ENTRY INTO INDIVIDUAL
APARTMENTS INCLUDING A MECHANICAL KEY OR AN ELECTRONIC OR COMPUTERIZED
ENTRY SYSTEM OF A KEY FOB, KEY CARD OR DIGITAL KEY, PROVIDED, HOWEVER
THAT SUCH ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM SHALL NOT RELY SOLELY
ON A WEB-BASED APPLICATION.
(C) NOTWITHSTANDING PARAGRAPH (A) OR (B) OF THIS SUBDIVISION, LAND-
LORDS SHALL PROVIDE A NON-ELECTRONIC MEANS OF ENTRY WHERE REQUESTED BY
THE TENANT DUE TO A RELIGIOUS PREFERENCE.
(D) ALL LAWFUL TENANTS AND OCCUPANTS SHALL BE PROVIDED WITH A KEY, KEY
FOB, DIGITAL KEY OR KEY CARD AT NO COST TO SUCH TENANTS. THE TERM "OCCU-
PANTS" SHALL INCLUDE CHILDREN UNDER THE AGE OF EIGHTEEN WHO SHALL BE
ISSUED A KEY, KEY FOB, DIGITAL KEY OR KEY CARD IF A PARENT OR GUARDIAN
REQUESTS SUCH CHILD BE PROVIDED WITH ONE. TENANTS MAY ALSO RECEIVE UP TO
FOUR ADDITIONAL KEYS, KEY FOBS, DIGITAL KEY OR KEY CARDS AT NO COST TO
THE TENANT FOR EMPLOYEES OR GUESTS. THE TERM "GUESTS" SHALL INCLUDE
FAMILY MEMBERS AND FRIENDS WHO CAN REASONABLY BE EXPECTED TO VISIT ON A
REGULAR BASIS OR VISIT AS NEEDED TO CARE FOR THE TENANT OR THE APARTMENT
IF THE TENANT IS AWAY. EMPLOYEES, INCLUDING CONTRACTORS, PROFESSIONAL
CAREGIVERS OR OTHER SERVICES PROVIDERS, MAY HAVE AN EXPIRATION DATE
PLACED ON THEIR KEY, KEY CARD, DIGITAL KEY OR KEY FOB, WHICH MAY BE
EXTENDED UPON THE TENANT'S OR OCCUPANT'S REQUEST. TENANTS MAY REQUEST A
NEW OR REPLACEMENT KEY, KEY FOB, DIGITAL KEY OR KEY CARD AT ANY TIME
THROUGHOUT THE COURSE OF THE TENANCY. THE LANDLORD OR HIS OR HER AGENT
SHALL PROVIDE THE FIRST REPLACEMENT KEY, KEY FOB, DIGITAL KEY OR KEY
CARD TO THE TENANT FREE OF CHARGE. THE COST OF SECOND AND SUBSEQUENT
REPLACEMENT CARDS SHALL NOT BE MORE THAN WHAT THE LANDLORD PAID FOR THE
REPLACEMENT UP TO AND NOT EXCEEDING TWENTY-FIVE DOLLARS.
(E) THE LANDLORD SHALL NOT SET LIMITS ON THE NUMBER OF KEYS, KEY FOBS,
DIGITAL KEYS OR KEY CARDS A LAWFUL TENANT OR OCCUPANT MAY REQUEST.
A. 706--C 7
(F) ANY DOOR THAT HAS AN ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM SHALL
HAVE BACKUP POWER OR AN ALTERNATIVE MEANS OF ENTRY TO ENSURE THAT THE
ENTRY SYSTEM CONTINUES TO OPERATE DURING A POWER OUTAGE. A LANDLORD, OR
HIS OR HER AGENT, SHALL ROUTINELY INSPECT THE BACKUP POWER AND SHALL
REPLACE ACCORDING TO SYSTEM SPECIFICATIONS. OWNERS OR THEIR AGENTS SHALL
PROVIDE LAWFUL TENANTS AND OCCUPANTS WITH INFORMATION ABOUT WHOM TO
CONTACT IN THE EVENT THAT THE TENANT, OCCUPANT OR THE TENANT'S OR OCCU-
PANT'S CHILDREN, GUESTS OR EMPLOYEES BECOME LOCKED OUT.
3. NOTICE. LANDLORDS OR THEIR AGENTS SHALL PROVIDE NOTICE TO A TENANT
AT THE TIME THE TENANT SIGNS THE LEASE, OR WHEN THE ELECTRONIC OR
COMPUTERIZED ENTRY SYSTEM IS INSTALLED, OF THE PROVISIONS OF SUBDIVISION
TWO OF THIS SECTION.
4. DATA COLLECTION. (A) IF AN ELECTRONIC AND/OR COMPUTERIZED ENTRY
SYSTEM IS UTILIZED TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING, THE
ONLY REFERENCE, AUTHENTICATION, AND ACCOUNT INFORMATION GATHERED BY ANY
ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM SHALL BE LIMITED TO ACCOUNT
INFORMATION USED TO GRANT A USER ENTRY OR TO ACCESS ANY ONLINE TOOLS
USED TO MANAGE USER ACCOUNTS RELATED TO THE ELECTRONIC AND/OR COMPUTER-
IZED ENTRY SYSTEM, OR REFERENCE DATA, SUCH AS THE LESSEE OR TENANT'S
NAME, APARTMENT NUMBER, THE PREFERRED METHOD OF CONTACT FOR SUCH LESSEE
OR TENANT, OTHER DOORS OR COMMON AREAS TO WHICH THE USER HAS ACCESS,
MOVE-IN AND, IF AVAILABLE MOVE-OUT DATES, AND AUTHENTICATION DATA SUCH
AS TIME AND METHOD OF ACCESS FOR SECURITY PURPOSES AND A PHOTOGRAPH OF
ACCESS EVENTS FOR SECURITY PURPOSES. FOR ELECTRONIC AND COMPUTERIZED
ENTRY SYSTEMS THAT RELY ON THE COLLECTION OF BIOMETRIC DATA AND WHICH
HAVE ALREADY BEEN INSTALLED AT THE TIME THIS SECTION SHALL HAVE BECOME A
LAW, A BIOMETRIC IDENTIFIER MAY BE COLLECTED PURSUANT TO THIS SECTION IN
ORDER TO REGISTER A LESSEE OR TENANT FOR AN ELECTRONIC AND/OR COMPUTER-
IZED ENTRY SYSTEM. NO NEW ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEMS
THAT RELY ON THE COLLECTION OF BIOMETRIC DATA SHALL BE INSTALLED IN
CLASS A MULTIPLE DWELLINGS FOR THREE YEARS AFTER THE EFFECTIVE DATE OF
THIS SECTION.
(I) THE OWNER OF THE MULTIPLE DWELLING MAY COLLECT ONLY THE MINIMUM
DATA REQUIRED BY THE TECHNOLOGY USED IN THE ELECTRONIC AND/OR COMPUTER-
IZED ENTRY SYSTEM TO EFFECTUATE SUCH ENTRANCE AND PROTECT THE PRIVACY
AND SECURITY OF SUCH TENANTS.
(II) THE OWNER OR AGENT OF THE OWNER SHALL NOT REQUEST OR RETAIN, IN
ANY FORM, THE SOCIAL SECURITY NUMBER OF ANY TENANT OR OCCUPANT AS A
CONDITION OF USE OF THE ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM.
(III) THE OWNER, AGENT OF THE OWNER, OR THE VENDOR OF AN ELECTRONIC OR
COMPUTERIZED ENTRY SYSTEM ON BEHALF OF THE OWNER MAY RECORD EACH TIME A
KEY FOB, KEY CARD, DIGITAL KEY OR PASSCODE IS USED TO ENTER THE BUILD-
ING, BUT SHALL NOT RECORD ANY DEPARTURES.
(IV) A COPY OF SUCH DATA MAY BE RETAINED FOR REFERENCE AT THE POINT OF
AUTHENTICATION BY THE ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM. SUCH
REFERENCE DATA MAY BE RETAINED ONLY FOR TENANTS OR THOSE AUTHORIZED BY
THE TENANT OR OWNER OF THE MULTIPLE DWELLING.
(V) THE OWNER OF THE MULTIPLE DWELLING SHALL DESTROY OR ANONYMIZE
AUTHENTICATION DATA WITHIN A REASONABLE TIME, BUT NOT LATER THAN NINETY
DAYS AFTER THE DATE COLLECTED.
(VI) REFERENCE DATA FOR A TENANT OR THOSE AUTHORIZED BY A TENANT SHALL
BE DESTROYED OR ANONYMIZED WITHIN NINETY DAYS OF (1) THE TENANT PERMA-
NENTLY VACATING THE DWELLING, OR (2) A REQUEST BY THE TENANT TO WITHDRAW
AUTHORIZATION FOR THOSE PREVIOUSLY AUTHORIZED BY THE TENANT.
A. 706--C 8
(B) (I) FOR THE PURPOSES OF THIS SECTION, "BIOMETRIC IDENTIFIER" MEANS
A RETINA OR IRIS SCAN, FINGERPRINT, VOICEPRINT, OR RECORD OF HAND, FACE
GEOMETRY OR OTHER SIMILAR FEATURE.
(II) AN ENTITY MAY NOT CAPTURE A BIOMETRIC IDENTIFIER OF AN INDIVIDUAL
TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING UNLESS THE PERSON IS A
TENANT OR PERSON AUTHORIZED BY THE TENANT, AND INFORMS THE INDIVIDUAL
BEFORE CAPTURING THE BIOMETRIC IDENTIFIER; AND RECEIVES THEIR EXPRESS
CONSENT TO CAPTURE THE BIOMETRIC IDENTIFIER.
(III) ANY ENTITY THAT POSSESSES A BIOMETRIC IDENTIFIER OF AN INDIVID-
UAL THAT IS CAPTURED TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING:
(1) MAY NOT SELL, LEASE OR OTHERWISE DISCLOSE THE BIOMETRIC IDENTIFIER
TO ANOTHER PERSON UNLESS PURSUANT TO A GRAND JURY SUBPOENA OR COURT
ORDERED WARRANT, SUBPOENA, OR OTHER AUTHORIZED COURT ORDERED PROCESS.
(2) SHALL STORE, TRANSMIT AND PROTECT FROM DISCLOSURE THE BIOMETRIC
IDENTIFIER USING REASONABLE CARE AND IN A MANNER THAT IS THE SAME AS OR
MORE PROTECTIVE THAN THE MANNER IN WHICH THE PERSON STORES, TRANSMITS
AND PROTECTS CONFIDENTIAL INFORMATION THE PERSON POSSESSES; AND
(3) SHALL DESTROY THE BIOMETRIC IDENTIFIER WITHIN A REASONABLE TIME,
BUT NOT LATER THAN FORTY-EIGHT HOURS AFTER THE DATE COLLECTED, EXCEPT
FOR REFERENCE DATA. IF ANY PROHIBITED INFORMATION IS COLLECTED, SUCH AS
THE LIKENESS OF A MINOR OR A NON-TENANT, THE INFORMATION SHALL BE
DESTROYED IMMEDIATELY.
(C) THE OWNER OF THE MULTIPLE DWELLING, OR THE MANAGING AGENT, MUST
DEVELOP WRITTEN PROCEDURES WHICH DESCRIBE THE PROCESS USED TO ADD
PERSONS AUTHORIZED BY THE TENANT TO ELECTRONIC AND/OR COMPUTERIZED ENTRY
SYSTEMS ON A TEMPORARY OR PERMANENT BASIS, SUCH AS VISITORS, CHILDREN,
THEIR EMPLOYEES, AND CAREGIVERS TO SUCH BUILDING.
(I) THE PROCEDURES MUST CLEARLY ESTABLISH THE OWNER'S RETENTION SCHED-
ULE AND GUIDELINES FOR PERMANENTLY DESTROYING OR ANONYMIZING THE DATA
COLLECTED.
(II) THE PROCEDURES CANNOT LIMIT TIME OR PLACE OF ENTRANCE BY SUCH
PEOPLE AUTHORIZED BY THE TENANT EXCEPT AS REQUESTED BY THE TENANT.
5. PROHIBITIONS. (A) NO FORM OF LOCATION TRACKING, INCLUDING BUT NOT
LIMITED TO SATELLITE LOCATION BASED SERVICES, SHALL BE INCLUDED IN ANY
EQUIPMENT, KEY, OR SOFTWARE PROVIDED TO TENANTS OR GUESTS AS PART OF AN
ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
(B) IT SHALL BE PROHIBITED TO COLLECT THROUGH AN ELECTRONIC AND/OR
COMPUTERIZED ENTRY SYSTEM THE LIKENESS OF A MINOR OCCUPANT, INFORMATION
ON THE RELATIONSHIP STATUS OF TENANTS, LESSEES AND/OR GUESTS, OR TO USE
A SMART ACCESS SYSTEM TO COLLECT OR TRACK INFORMATION ABOUT THE FREQUEN-
CY AND TIME OF USE OF SUCH SYSTEM BY A TENANT AND/OR GUESTS TO HARASS OR
EVICT A TENANT OR FOR ANY OTHER PURPOSE NOT EXPRESSLY RELATED TO THE
OPERATION OF THE SMART ACCESS SYSTEM.
(C) INFORMATION THAT IS ACQUIRED VIA THE USE OF AN ELECTRONIC AND/OR
COMPUTERIZED ENTRY SYSTEM SHALL NOT BE USED FOR ANY PURPOSES OTHER THAN
MONITORING BUILDING ENTRANCES AND SHALL NOT BE USED AS THE BASIS OR
SUPPORT FOR AN ACTION TO EVICT A LESSEE OR TENANT, OR AN ADMINISTRATIVE
HEARING SEEKING A CHANGE IN REGULATORY COVERAGE FOR AN INDIVIDUAL OR
UNIT. HOWEVER, A TENANT MAY AUTHORIZE THEIR INFORMATION TO BE USED BY A
THIRD PARTY, BUT SUCH A REQUEST MUST CLEARLY STATE WHO WILL HAVE ACCESS
TO SUCH INFORMATION, FOR WHAT PURPOSE IT WILL BE USED, AND THE PRIVACY
POLICIES WHICH WILL PROTECT THEIR INFORMATION. UNDER NO CIRCUMSTANCES
MAY A LEASE OR A RENEWAL BE CONTINGENT UPON AUTHORIZING SUCH USE. ELEC-
TRONIC AND/OR COMPUTERIZED SYSTEMS MAY USE THIRD-PARTY SERVICES TO THE
EXTENT REQUIRED TO MAINTAIN AND OPERATE SYSTEM INFRASTRUCTURE, INCLUDING
CLOUD-BASED HOSTING AND STORAGE. THE PROVIDER OR PROVIDERS OF THIRD-PAR-
A. 706--C 9
TY INFRASTRUCTURE SERVICES MUST MEET OR EXCEED THE PRIVACY PROTECTIONS
SET FORTH IN THIS SECTION AND WILL BE SUBJECT TO THE SAME LIABILITY FOR
BREACH OF ANY OF THE REQUIREMENTS OF THIS SECTION.
(D) INFORMATION AND DATA COLLECTED SHALL NOT BE MADE AVAILABLE TO ANY
THIRD PARTY, UNLESS AUTHORIZED AS DESCRIBED ABOVE, INCLUDING BUT NOT
LIMITED TO LAW ENFORCEMENT, EXCEPT UPON A GRAND JURY SUBPOENA OR A COURT
ORDERED WARRANT, SUBPOENA, OR OTHER AUTHORIZED COURT ORDERED PROCESS.
6. STORAGE OF INFORMATION. ANY INFORMATION OR DATA COLLECTED SHALL BE
STORED IN A SECURE MANNER TO PREVENT UNAUTHORIZED ACCESS BY BOTH EMPLOY-
EES AND CONTRACTORS AND THOSE UNAFFILIATED WITH THE LANDLORD OR THEIR
AGENTS, EXCEPT AS OTHERWISE PROVIDED IN THIS SECTION. FUTURE OR CONTINU-
ING TENANCY SHALL NOT BE CONDITIONED UPON CONSENTING TO THE USE OF AN
ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
7. SOFTWARE ISSUES. WHENEVER A COMPANY THAT PRODUCES, MAKES AVAILABLE
OR INSTALLS ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS DISCOVERS A SECURI-
TY BREACH OR CRITICAL SECURITY VULNERABILITY IN THEIR SOFTWARE, SUCH
COMPANY SHALL NOTIFY CUSTOMERS OF SUCH VULNERABILITY WITHIN A REASONABLE
TIME OF DISCOVERY BUT NO LATER THAN TWENTY-FOUR HOURS AFTER DISCOVERY
AND SHALL MAKE SOFTWARE UPDATES AVAILABLE AND TAKE ANY OTHER ACTION AS
MAY BE NECESSARY TO REPAIR THE VULNERABILITY WITHIN A REASONABLE TIME,
BUT NOT LONGER THAN THIRTY DAYS AFTER DISCOVERY. SMART ACCESS SYSTEMS
AND VENDORS SHALL IMPLEMENT AND MAINTAIN REASONABLE SECURITY PROCEDURES
AND PRACTICES APPROPRIATE TO THE NATURE OF THE INFORMATION COLLECTED. IN
THE EVENT THAT A SECURITY BREACH OR CRITICAL SECURITY VULNERABILITY THAT
PERTAINS TO THE EMBEDDED SOFTWARE OR FIRMWARE ON THE SMART ACCESS
SYSTEMS IS DISCOVERED, SMART ACCESS SYSTEMS AND THEIR VENDORS SHALL:
(A) BE ABLE TO CREATE UPDATES TO THE FIRMWARE TO CORRECT THE VULNER-
ABILITIES;
(B) CONTRACTUALLY COMMIT TO CUSTOMERS THAT THE SMART ACCESS SYSTEM OR
VENDOR WILL CREATE UPDATES TO THE EMBEDDED SOFTWARE OR FIRMWARE TO REME-
DY THE VULNERABILITIES; AND
(C) MAKE SUCH SECURITY-RELATED SOFTWARE OR FIRMWARE UPDATES AVAILABLE
FOR FREE TO CUSTOMERS FOR THE DURATION OF THE CONTRACT BETWEEN SMART
ACCESS BUILDINGS AND SMART ACCESS SYSTEMS.
8. WAIVER OF RIGHTS; VOID. ANY AGREEMENT BY A LESSEE OR TENANT OF A
DWELLING WAIVING OR MODIFYING HIS OR HER RIGHTS AS SET FORTH IN THIS
SECTION SHALL BE VOID AS CONTRARY TO PUBLIC POLICY.
9. PENALTIES. (A) A PERSON WHO VIOLATES THIS SECTION IS SUBJECT TO A
CIVIL PENALTY OF NOT MORE THAN FIVE THOUSAND DOLLARS FOR EACH VIOLATION.
THE ATTORNEY GENERAL MAY BRING AN ACTION TO RECOVER THE CIVIL PENALTY.
AN INDIVIDUAL INJURED BY A VIOLATION OF THIS SECTION MAY BRING AN ACTION
TO RECOVER DAMAGES. A COURT MAY ALSO AWARD ATTORNEYS' FEES TO A PREVAIL-
ING PLAINTIFF.
(B) WHERE A LANDLORD OR HIS OR HER AGENT USES AN ELECTRONIC OR COMPUT-
ERIZED ENTRY SYSTEM TO HARASS OR OTHERWISE DEPRIVE A TENANT OF ANY
RIGHTS AVAILABLE UNDER LAW, SUCH LANDLORD OR AGENT SHALL BE SUBJECT TO A
CIVIL PENALTY OF TEN THOUSAND DOLLARS FOR EACH VIOLATION.
(C) FOR PURPOSES OF THIS SUBDIVISION, EACH DAY THE VIOLATION OCCURS
SHALL BE CONSIDERED A SEPARATE VIOLATION.
10. RENT REGULATED DWELLINGS. INSTALLATION OF AN ELECTRONIC OR COMPUT-
ERIZED ENTRY SYSTEM PURSUANT TO THIS SECTION IN A RENT REGULATED DWELL-
ING SHALL CONSTITUTE A MODIFICATION OF SERVICES REQUIRING THE LANDLORD
OF SUCH DWELLING OR HIS OR HER AGENT TO APPLY TO THE DIVISION OF HOUSING
AND COMMUNITY RENEWAL FOR APPROVAL BEFORE PERFORMING SUCH INSTALLATION.
SUCH INSTALLATION SHALL NOT QUALIFY AS A BASIS FOR RENT REDUCTION.
A. 706--C 10
11. EXEMPTIONS. (A) NOTHING HEREIN SHALL APPLY TO MULTIPLE DWELLINGS
OWNED OR MANAGED BY AN ENTITY SUBJECT TO 42 U.S.C. § 1437 ET SEQ., OR
ANY OF ITS SUBSIDIARIES.
(B) NOTHING IN THIS SECTION SHALL LIMIT THE AUTHORITY OF THE DIVISION
OF HOUSING AND COMMUNITY RENEWAL TO IMPOSE ADDITIONAL REQUIREMENTS
REGARDING ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS INSTALLED IN MULTIPLE
DWELLINGS FOR WHICH THE DIVISION IS REQUIRED TO APPROVE SUBSTITUTIONS OR
MODIFICATIONS OF SERVICES.
§ 3. Severability. If any provision of this act, or any application of
any provision of this act, is held to be invalid, that shall not affect
the validity or effectiveness of any other provision of this act, or of
any other application of any provision of this act, which can be given
effect without that provision or application; and to that end, the
provisions and applications of this act are severable.
§ 4. This act shall take effect on the one hundred eightieth day after
it shall have become a law.