S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  6463--A
 
                        2021-2022 Regular Sessions
 
                             I N  S E N A T E
 
                              April 29, 2021
                                ___________
 
 Introduced by Sens. KAVANAGH, KRUEGER -- read twice and ordered printed,
   and  when  printed  to  be  committed  to  the  Committee  on Housing,
   Construction and Community Development -- committee  discharged,  bill
   amended,  ordered reprinted as amended and recommitted to said commit-
   tee

 AN ACT to amend the multiple dwelling law  and  the  multiple  residence
   law,  in  relation  to  the  use  of  electronic or computerized entry
   systems and the information that may be gathered from such systems
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  The  multiple  dwelling  law  is  amended by adding a new
 section 50-b to read as follows:
   § 50-B. ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS. 1.  DEFINITIONS. FOR
 THE PURPOSES OF THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOW-
 ING MEANINGS:
   (A) "ACCOUNT INFORMATION" MEANS INFORMATION THAT IS USED  TO  GRANT  A
 USER  ENTRY  OR  ACCESS TO ANY ONLINE TOOLS THAT ARE USED TO MANAGE USER
 ACCOUNTS RELATED TO AN ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
   (B) "AUTHENTICATION DATA" MEANS DATA GENERATED OR COLLECTED AT A POINT
 OF AUTHENTICATION IN CONNECTION WITH GRANTING A USER ENTRY TO A CLASS  A
 MULTIPLE  DWELLING  OR  COMMON  AREA  WITH AN ELECTRONIC OR COMPUTERIZED
 ENTRY SYSTEM, EXCEPT THAT "AUTHENTICATION DATA" SHALL NOT  INCLUDE  DATA
 GENERATED  THROUGH OR COLLECTED BY A VIDEO OR CAMERA SYSTEM THAT IS USED
 TO MONITOR ENTRANCES BUT NOT TO GRANT ENTRY.
   (C) "CRITICAL SECURITY VULNERABILITY" MEANS A  SECURITY  VULNERABILITY
 THAT HAS A SIGNIFICANT RISK OF RESULTING IN AN UNAUTHORIZED ACCESS TO AN
 AREA SECURED BY AN ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
   (D)  "REFERENCE  DATA"  MEANS INFORMATION AGAINST WHICH AUTHENTICATION
 DATA IS VERIFIED AT A POINT OF AUTHENTICATION BY A SMART  ACCESS  SYSTEM
 IN ORDER TO GRANT A USER ENTRY TO A SMART ACCESS BUILDING OR COMMON AREA
 OF SUCH BUILDING.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD00549-07-1

 S. 6463--A                          2
 
   (E)  "SECURITY BREACH" MEANS ANY INCIDENT THAT RESULTS IN UNAUTHORIZED
 ACCESS OF DATA,  APPLICATIONS,  SERVICES,  NETWORKS  AND/OR  DEVICES  BY
 BYPASSING  UNDERLYING  SECURITY  MECHANISMS.  A "SECURITY BREACH" OCCURS
 WHEN AN INDIVIDUAL OR AN APPLICATION ILLEGITIMATELY  ENTERS  A  PRIVATE,
 CONFIDENTIAL OR UNAUTHORIZED LOGICAL INFORMATION TECHNOLOGY PERIMETER.
   2.  ENTRY.  A.  WHERE A LANDLORD INSTALLS OR PLANS TO INSTALL AN ELEC-
 TRONIC OR COMPUTERIZED ENTRY SYSTEM ON ANY  ENTRANCE  FROM  THE  STREET,
 PASSAGEWAY,  COURT,  YARD,  CELLAR,  OR  OTHER  COMMON AREA OF A CLASS A
 MULTIPLE DWELLING, SUCH SYSTEM SHALL NOT  RELY  SOLELY  ON  A  WEB-BASED
 APPLICATION TO FACILITATE ENTRANCE BUT SHALL ALSO INCLUDE A KEY FOB, KEY
 CARD, DIGITAL KEY OR PASSCODE FOR TENANT USE.
   B.  LANDLORDS  MAY  PROVIDE  VARIOUS  METHODS OF ENTRY INTO INDIVIDUAL
 APARTMENTS INCLUDING A MECHANICAL KEY OR AN ELECTRONIC  OR  COMPUTERIZED
 ENTRY  SYSTEM  OF  A KEY FOB, KEY CARD OR DIGITAL KEY, PROVIDED, HOWEVER
 THAT SUCH ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM SHALL NOT RELY  SOLELY
 ON A WEB-BASED APPLICATION.
   C.  NOTWITHSTANDING  PARAGRAPH  A  OR B OF THIS SUBDIVISION, LANDLORDS
 SHALL PROVIDE A NON-ELECTRONIC MEANS OF ENTRY  WHERE  REQUESTED  BY  THE
 TENANT DUE TO A RELIGIOUS PREFERENCE.
   D.  ALL LAWFUL TENANTS AND OCCUPANTS SHALL BE PROVIDED WITH A KEY, KEY
 FOB, DIGITAL KEY OR KEY CARD AT NO COST TO SUCH TENANTS. THE TERM "OCCU-
 PANTS" SHALL INCLUDE CHILDREN UNDER THE AGE OF  EIGHTEEN  WHO  SHALL  BE
 ISSUED  A  KEY, KEY FOB, DIGITAL KEY OR KEY CARD IF A PARENT OR GUARDIAN
 REQUESTS SUCH CHILD BE PROVIDED WITH ONE. TENANTS MAY ALSO RECEIVE UP TO
 FOUR ADDITIONAL KEYS, KEY FOBS, DIGITAL KEY OR KEY CARDS AT NO  COST  TO
 THE  TENANT  FOR  EMPLOYEES  OR  GUESTS. THE TERM "GUESTS" SHALL INCLUDE
 FAMILY MEMBERS AND FRIENDS WHO CAN REASONABLY BE EXPECTED TO VISIT ON  A
 REGULAR BASIS OR VISIT AS NEEDED TO CARE FOR THE TENANT OR THE APARTMENT
 IF  THE  TENANT  IS AWAY. EMPLOYEES, INCLUDING CONTRACTORS, PROFESSIONAL
 CAREGIVERS OR OTHER SERVICES PROVIDERS,  MAY  HAVE  AN  EXPIRATION  DATE
 PLACED  ON  THEIR  KEY,  KEY  CARD, DIGITAL KEY OR KEY FOB, WHICH MAY BE
 EXTENDED UPON THE TENANT'S OR OCCUPANT'S REQUEST.  TENANTS MAY REQUEST A
 NEW OR REPLACEMENT KEY, KEY FOB, DIGITAL KEY OR KEY  CARD  AT  ANY  TIME
 THROUGHOUT  THE COURSE OF THE TENANCY.  THE LANDLORD OR HIS OR HER AGENT
 SHALL PROVIDE THE FIRST REPLACEMENT KEY, KEY FOB,  DIGITAL  KEY  OR  KEY
 CARD  TO  THE  TENANT  FREE OF CHARGE. THE COST OF SECOND AND SUBSEQUENT
 REPLACEMENT CARDS SHALL NOT BE MORE THAN WHAT THE LANDLORD PAID FOR  THE
 REPLACEMENT UP TO AND NOT EXCEEDING TWENTY-FIVE DOLLARS.
   E.  THE LANDLORD SHALL NOT SET LIMITS ON THE NUMBER OF KEYS, KEY FOBS,
 DIGITAL KEYS OR KEY CARDS A LAWFUL TENANT OR OCCUPANT MAY REQUEST.
   F. ANY DOOR THAT HAS AN ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM  SHALL
 HAVE  BACKUP  POWER  OR AN ALTERNATIVE MEANS OF ENTRY TO ENSURE THAT THE
 ENTRY SYSTEM CONTINUES TO OPERATE DURING A POWER OUTAGE. A LANDLORD,  OR
 HIS  OR  HER  AGENT,  SHALL ROUTINELY INSPECT THE BACKUP POWER AND SHALL
 REPLACE ACCORDING TO SYSTEM SPECIFICATIONS.    OWNERS  OR  THEIR  AGENTS
 SHALL  PROVIDE  LAWFUL TENANTS AND OCCUPANTS WITH INFORMATION ABOUT WHOM
 TO CONTACT IN THE EVENT THAT THE TENANT, OCCUPANT  OR  THE  TENANT'S  OR
 OCCUPANT'S CHILDREN, GUESTS OR EMPLOYEES BECOME LOCKED OUT.
   3.  NOTICE. LANDLORDS OR THEIR AGENTS SHALL PROVIDE NOTICE TO A TENANT
 AT THE TIME THE TENANT SIGNS  THE  LEASE,  OR  WHEN  THE  ELECTRONIC  OR
 COMPUTERIZED ENTRY SYSTEM IS INSTALLED, OF THE PROVISIONS OF SUBDIVISION
 TWO OF THIS SECTION.
   4.  DATA  COLLECTION.  A.  IF  AN ELECTRONIC AND/OR COMPUTERIZED ENTRY
 SYSTEM IS UTILIZED TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING,  THE
 ONLY  REFERENCE, AUTHENTICATION, AND ACCOUNT INFORMATION GATHERED BY ANY
 ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM SHALL BE LIMITED TO  ACCOUNT

 S. 6463--A                          3
 
 INFORMATION  USED  TO  GRANT  A USER ENTRY OR TO ACCESS ANY ONLINE TOOLS
 USED TO MANAGE USER ACCOUNTS RELATED TO THE ELECTRONIC AND/OR  COMPUTER-
 IZED  ENTRY  SYSTEM,  OR  REFERENCE DATA, SUCH AS THE LESSEE OR TENANT'S
 NAME,  APARTMENT NUMBER, THE PREFERRED METHOD OF CONTACT FOR SUCH LESSEE
 OR TENANT, OTHER DOORS OR COMMON AREAS TO WHICH  THE  USER  HAS  ACCESS,
 MOVE-IN  AND,  IF AVAILABLE MOVE-OUT DATES, AND AUTHENTICATION DATA SUCH
 AS TIME AND METHOD OF ACCESS FOR SECURITY PURPOSES AND A  PHOTOGRAPH  OF
 ACCESS  EVENTS  FOR  SECURITY  PURPOSES. FOR ELECTRONIC AND COMPUTERIZED
 ENTRY SYSTEMS THAT RELY ON THE COLLECTION OF BIOMETRIC  DATA  AND  WHICH
 HAVE ALREADY BEEN INSTALLED AT THE TIME THIS SECTION SHALL HAVE BECOME A
 LAW, A BIOMETRIC IDENTIFIER MAY BE COLLECTED PURSUANT TO THIS SECTION IN
 ORDER  TO REGISTER A LESSEE OR TENANT FOR AN ELECTRONIC AND/OR COMPUTER-
 IZED ENTRY SYSTEM.  NO NEW ELECTRONIC AND/OR COMPUTERIZED ENTRY  SYSTEMS
 THAT  RELY  ON  THE  COLLECTION  OF BIOMETRIC DATA SHALL BE INSTALLED IN
 CLASS A MULTIPLE DWELLINGS FOR THREE YEARS AFTER THE EFFECTIVE  DATE  OF
 THIS SECTION.
   (I)  THE  OWNER  OF THE MULTIPLE DWELLING MAY COLLECT ONLY THE MINIMUM
 DATA REQUIRED BY THE TECHNOLOGY USED IN THE ELECTRONIC AND/OR  COMPUTER-
 IZED  ENTRY  SYSTEM  TO EFFECTUATE SUCH ENTRANCE AND PROTECT THE PRIVACY
 AND SECURITY OF SUCH TENANTS.
   (II) THE OWNER OR AGENT OF THE OWNER SHALL NOT REQUEST OR  RETAIN,  IN
 ANY  FORM,  THE  SOCIAL  SECURITY  NUMBER OF ANY TENANT OR OCCUPANT AS A
 CONDITION OF USE OF THE ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM.
   (III) THE OWNER, AGENT OF THE OWNER, OR THE VENDOR OF AN ELECTRONIC OR
 COMPUTERIZED ENTRY SYSTEM ON BEHALF OF THE OWNER MAY RECORD EACH TIME  A
 KEY  FOB,  KEY CARD, DIGITAL KEY OR PASSCODE IS USED TO ENTER THE BUILD-
 ING, BUT SHALL NOT RECORD ANY DEPARTURES.
   (IV) A COPY OF SUCH DATA MAY BE RETAINED FOR REFERENCE AT THE POINT OF
 AUTHENTICATION BY THE ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.  SUCH
 REFERENCE  DATA  MAY BE RETAINED ONLY FOR TENANTS OR THOSE AUTHORIZED BY
 THE TENANT OR OWNER OF THE MULTIPLE DWELLING.
   (V) THE OWNER OF THE MULTIPLE  DWELLING  SHALL  DESTROY  OR  ANONYMIZE
 AUTHENTICATION  DATA WITHIN A REASONABLE TIME, BUT NOT LATER THAN NINETY
 DAYS AFTER THE DATE COLLECTED.
   (VI) REFERENCE DATA FOR A TENANT OR THOSE AUTHORIZED BY A TENANT SHALL
 BE DESTROYED OR ANONYMIZED WITHIN NINETY DAYS OF (1) THE  TENANT  PERMA-
 NENTLY VACATING THE DWELLING, OR (2) A REQUEST BY THE TENANT TO WITHDRAW
 AUTHORIZATION FOR THOSE PREVIOUSLY AUTHORIZED BY THE TENANT.
   B.  (I) FOR THE PURPOSES OF THIS SECTION, "BIOMETRIC IDENTIFIER" MEANS
 A RETINA OR IRIS SCAN, FINGERPRINT, VOICEPRINT, OR RECORD OF HAND,  FACE
 GEOMETRY OR OTHER SIMILAR FEATURE.
   (II) AN ENTITY MAY NOT CAPTURE A BIOMETRIC IDENTIFIER OF AN INDIVIDUAL
 TO  GAIN  ENTRANCE TO A CLASS A MULTIPLE DWELLING UNLESS THE PERSON IS A
 TENANT OR PERSON AUTHORIZED BY THE TENANT, AND  INFORMS  THE  INDIVIDUAL
 BEFORE  CAPTURING  THE  BIOMETRIC IDENTIFIER; AND RECEIVES THEIR EXPRESS
 CONSENT TO CAPTURE THE BIOMETRIC IDENTIFIER.
   (III) ANY ENTITY THAT POSSESSES A BIOMETRIC IDENTIFIER OF AN  INDIVID-
 UAL THAT IS CAPTURED TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING:
   (1) MAY NOT SELL, LEASE OR OTHERWISE DISCLOSE THE BIOMETRIC IDENTIFIER
 TO  ANOTHER  PERSON  UNLESS  PURSUANT  TO A GRAND JURY SUBPOENA OR COURT
 ORDERED WARRANT, SUBPOENA, OR OTHER AUTHORIZED COURT ORDERED PROCESS.
   (2) SHALL STORE, TRANSMIT AND PROTECT FROM  DISCLOSURE  THE  BIOMETRIC
 IDENTIFIER  USING REASONABLE CARE AND IN A MANNER THAT IS THE SAME AS OR
 MORE PROTECTIVE THAN THE MANNER IN WHICH THE  PERSON  STORES,  TRANSMITS
 AND PROTECTS CONFIDENTIAL INFORMATION THE PERSON POSSESSES; AND

 S. 6463--A                          4
 
   (3)  SHALL  DESTROY THE BIOMETRIC IDENTIFIER WITHIN A REASONABLE TIME,
 BUT NOT LATER THAN FORTY-EIGHT HOURS AFTER THE  DATE  COLLECTED,  EXCEPT
 FOR REFERENCE DATA.  IF ANY PROHIBITED INFORMATION IS COLLECTED, SUCH AS
 THE  LIKENESS  OF  A  MINOR  OR  A  NON-TENANT, THE INFORMATION SHALL BE
 DESTROYED IMMEDIATELY.
   C.  THE  OWNER  OF  THE MULTIPLE DWELLING, OR THE MANAGING AGENT, MUST
 DEVELOP WRITTEN PROCEDURES  WHICH  DESCRIBE  THE  PROCESS  USED  TO  ADD
 PERSONS AUTHORIZED BY THE TENANT TO ELECTRONIC AND/OR COMPUTERIZED ENTRY
 SYSTEMS  ON  A TEMPORARY OR PERMANENT BASIS, SUCH AS VISITORS, CHILDREN,
 THEIR EMPLOYEES, AND CAREGIVERS TO SUCH BUILDING.
   (I) THE PROCEDURES MUST CLEARLY ESTABLISH THE OWNER'S RETENTION SCHED-
 ULE AND GUIDELINES FOR PERMANENTLY DESTROYING OR  ANONYMIZING  THE  DATA
 COLLECTED.
   (II)  THE  PROCEDURES  CANNOT  LIMIT TIME OR PLACE OF ENTRANCE BY SUCH
 PEOPLE AUTHORIZED BY THE TENANT EXCEPT AS REQUESTED BY THE TENANT.
   5. PROHIBITIONS. A. NO FORM OF LOCATION TRACKING,  INCLUDING  BUT  NOT
 LIMITED  TO  SATELLITE LOCATION BASED SERVICES, SHALL BE INCLUDED IN ANY
 EQUIPMENT, KEY, OR SOFTWARE PROVIDED TO TENANTS OR GUESTS AS PART OF  AN
 ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
   B.  IT  SHALL  BE  PROHIBITED  TO COLLECT THROUGH AN ELECTRONIC AND/OR
 COMPUTERIZED ENTRY SYSTEM THE LIKENESS OF A MINOR OCCUPANT,  INFORMATION
 ON  THE RELATIONSHIP STATUS OF TENANTS, LESSEES AND/OR GUESTS, OR TO USE
 A SMART ACCESS SYSTEM TO COLLECT OR TRACK INFORMATION ABOUT THE FREQUEN-
 CY AND TIME OF USE OF SUCH SYSTEM BY A TENANT AND/OR GUESTS TO HARASS OR
 EVICT A TENANT OR FOR ANY OTHER PURPOSE NOT  EXPRESSLY  RELATED  TO  THE
 OPERATION OF THE SMART ACCESS SYSTEM.
   C.  INFORMATION  THAT  IS ACQUIRED VIA THE USE OF AN ELECTRONIC AND/OR
 COMPUTERIZED ENTRY SYSTEM SHALL NOT BE USED FOR ANY PURPOSES OTHER  THAN
 MONITORING  BUILDING  ENTRANCES  AND  SHALL  NOT BE USED AS THE BASIS OR
 SUPPORT FOR AN ACTION TO EVICT A LESSEE OR TENANT, OR AN  ADMINISTRATIVE
 HEARING  SEEKING  A  CHANGE  IN REGULATORY COVERAGE FOR AN INDIVIDUAL OR
 UNIT.  HOWEVER, A TENANT MAY AUTHORIZE THEIR INFORMATION TO BE USED BY A
 THIRD PARTY, BUT SUCH A REQUEST MUST CLEARLY STATE WHO WILL HAVE  ACCESS
 TO  SUCH  INFORMATION, FOR WHAT PURPOSE IT WILL BE USED, AND THE PRIVACY
 POLICIES WHICH WILL PROTECT THEIR INFORMATION.  UNDER  NO  CIRCUMSTANCES
 MAY  A LEASE OR A RENEWAL BE CONTINGENT UPON AUTHORIZING SUCH USE. ELEC-
 TRONIC AND/OR COMPUTERIZED SYSTEMS MAY USE THIRD-PARTY SERVICES  TO  THE
 EXTENT REQUIRED TO MAINTAIN AND OPERATE SYSTEM INFRASTRUCTURE, INCLUDING
 CLOUD-BASED HOSTING AND STORAGE. THE PROVIDER OR PROVIDERS OF THIRD-PAR-
 TY  INFRASTRUCTURE  SERVICES MUST MEET OR EXCEED THE PRIVACY PROTECTIONS
 SET FORTH IN THIS SECTION AND WILL BE SUBJECT TO THE SAME LIABILITY  FOR
 BREACH OF ANY OF THE REQUIREMENTS OF THIS SECTION.
   D.  INFORMATION  AND DATA COLLECTED SHALL NOT BE MADE AVAILABLE TO ANY
 THIRD PARTY, UNLESS AUTHORIZED AS DESCRIBED  ABOVE,  INCLUDING  BUT  NOT
 LIMITED TO LAW ENFORCEMENT, EXCEPT UPON A GRAND JURY SUBPOENA OR A COURT
 ORDERED WARRANT, SUBPOENA, OR OTHER AUTHORIZED COURT ORDERED PROCESS.
   6.  STORAGE OF INFORMATION. ANY INFORMATION OR DATA COLLECTED SHALL BE
 STORED IN A SECURE MANNER TO PREVENT UNAUTHORIZED ACCESS BY BOTH EMPLOY-
 EES AND CONTRACTORS AND THOSE UNAFFILIATED WITH THE  LANDLORD  OR  THEIR
 AGENTS, EXCEPT AS OTHERWISE PROVIDED IN THIS SECTION. FUTURE OR CONTINU-
 ING  TENANCY  SHALL  NOT BE CONDITIONED UPON CONSENTING TO THE USE OF AN
 ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
   7. SOFTWARE ISSUES. WHENEVER A COMPANY THAT PRODUCES, MAKES  AVAILABLE
 OR INSTALLS ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS DISCOVERS A SECURI-
 TY  BREACH  OR  CRITICAL  SECURITY VULNERABILITY IN THEIR SOFTWARE, SUCH
 COMPANY SHALL NOTIFY CUSTOMERS OF SUCH VULNERABILITY WITHIN A REASONABLE

 S. 6463--A                          5
 
 TIME OF DISCOVERY BUT NO LATER THAN TWENTY-FOUR  HOURS  AFTER  DISCOVERY
 AND  SHALL  MAKE SOFTWARE UPDATES AVAILABLE AND TAKE ANY OTHER ACTION AS
 MAY BE NECESSARY TO REPAIR THE VULNERABILITY WITHIN A  REASONABLE  TIME,
 BUT  NOT  LONGER THAN THIRTY DAYS AFTER DISCOVERY.  SMART ACCESS SYSTEMS
 AND VENDORS SHALL IMPLEMENT AND MAINTAIN REASONABLE SECURITY  PROCEDURES
 AND PRACTICES APPROPRIATE TO THE NATURE OF THE INFORMATION COLLECTED. IN
 THE EVENT THAT A SECURITY BREACH OR CRITICAL SECURITY VULNERABILITY THAT
 PERTAINS  TO  THE  EMBEDDED  SOFTWARE  OR  FIRMWARE  ON THE SMART ACCESS
 SYSTEMS IS DISCOVERED, SMART ACCESS SYSTEMS AND THEIR VENDORS SHALL:
   A. BE ABLE TO CREATE UPDATES TO THE FIRMWARE TO  CORRECT  THE  VULNER-
 ABILITIES;
   B.  CONTRACTUALLY  COMMIT TO CUSTOMERS THAT THE SMART ACCESS SYSTEM OR
 VENDOR WILL CREATE UPDATES TO THE EMBEDDED SOFTWARE OR FIRMWARE TO REME-
 DY THE VULNERABILITIES; AND
   C. MAKE SUCH SECURITY-RELATED SOFTWARE OR FIRMWARE  UPDATES  AVAILABLE
 FOR  FREE  TO  CUSTOMERS  FOR THE DURATION OF THE CONTRACT BETWEEN SMART
 ACCESS BUILDINGS AND SMART ACCESS SYSTEMS.
   8. WAIVER OF RIGHTS; VOID. ANY AGREEMENT BY A LESSEE OR  TENANT  OF  A
 DWELLING  WAIVING  OR  MODIFYING  HIS OR HER RIGHTS AS SET FORTH IN THIS
 SECTION SHALL BE VOID AS CONTRARY TO PUBLIC POLICY.
   9. PENALTIES. (A) A PERSON WHO VIOLATES THIS SECTION IS SUBJECT  TO  A
 CIVIL PENALTY OF NOT MORE THAN FIVE THOUSAND DOLLARS FOR EACH VIOLATION.
 THE  ATTORNEY  GENERAL MAY BRING AN ACTION TO RECOVER THE CIVIL PENALTY.
 AN INDIVIDUAL INJURED BY A VIOLATION OF THIS SECTION MAY BRING AN ACTION
 TO RECOVER DAMAGES. A COURT MAY ALSO AWARD ATTORNEYS' FEES TO A PREVAIL-
 ING PLAINTIFF.
   (B) WHERE A LANDLORD OR HIS OR HER AGENT USES AN ELECTRONIC OR COMPUT-
 ERIZED ENTRY SYSTEM TO HARASS OR  OTHERWISE  DEPRIVE  A  TENANT  OF  ANY
 RIGHTS AVAILABLE UNDER LAW, SUCH LANDLORD OR AGENT SHALL BE SUBJECT TO A
 CIVIL PENALTY OF TEN THOUSAND DOLLARS FOR EACH VIOLATION.
   (C)  FOR  PURPOSES  OF THIS SUBDIVISION, EACH DAY THE VIOLATION OCCURS
 SHALL BE CONSIDERED A SEPARATE VIOLATION.
   10. RENT REGULATED DWELLINGS. INSTALLATION OF AN ELECTRONIC OR COMPUT-
 ERIZED ENTRY SYSTEM PURSUANT TO THIS SECTION IN A RENT REGULATED  DWELL-
 ING  SHALL  CONSTITUTE A MODIFICATION OF SERVICES REQUIRING THE LANDLORD
 OF SUCH DWELLING OR HIS OR HER AGENT TO APPLY TO THE DIVISION OF HOUSING
 AND COMMUNITY RENEWAL FOR APPROVAL BEFORE PERFORMING SUCH  INSTALLATION.
 SUCH INSTALLATION SHALL NOT QUALIFY AS A BASIS FOR RENT REDUCTION.
   11.  EXEMPTIONS.  A.  NOTHING HEREIN SHALL APPLY TO MULTIPLE DWELLINGS
 OWNED OR MANAGED BY AN ENTITY SUBJECT TO 42 U.S.C. § 1437  ET  SEQ.,  OR
 ANY OF ITS SUBSIDIARIES.
   B.  NOTHING  IN THIS SECTION SHALL LIMIT THE AUTHORITY OF THE DIVISION
 OF HOUSING AND  COMMUNITY  RENEWAL  TO  IMPOSE  ADDITIONAL  REQUIREMENTS
 REGARDING ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS INSTALLED IN MULTIPLE
 DWELLINGS FOR WHICH THE DIVISION IS REQUIRED TO APPROVE SUBSTITUTIONS OR
 MODIFICATIONS OF SERVICES.
   §  2.  The  multiple  residence law is amended by adding a new section
 130-a to read as follows:
   § 130-A. ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS. 1. DEFINITIONS. FOR
 THE PURPOSES OF THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOW-
 ING MEANINGS:
   (A) "ACCOUNT INFORMATION" MEANS INFORMATION THAT IS USED  TO  GRANT  A
 USER  ENTRY  OR  ACCESS TO ANY ONLINE TOOLS THAT ARE USED TO MANAGE USER
 ACCOUNTS RELATED TO AN ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
   (B) "AUTHENTICATION DATA" MEANS DATA GENERATED OR COLLECTED AT A POINT
 OF AUTHENTICATION IN CONNECTION WITH GRANTING A USER ENTRY TO A CLASS  A

 S. 6463--A                          6

 MULTIPLE  DWELLING  OR  COMMON  AREA  WITH AN ELECTRONIC OR COMPUTERIZED
 ENTRY SYSTEM, EXCEPT THAT "AUTHENTICATION DATA" SHALL NOT  INCLUDE  DATA
 GENERATED  THROUGH OR COLLECTED BY A VIDEO OR CAMERA SYSTEM THAT IS USED
 TO MONITOR ENTRANCES BUT NOT TO GRANT ENTRY.
   (C)  "CRITICAL  SECURITY VULNERABILITY" MEANS A SECURITY VULNERABILITY
 THAT HAS A SIGNIFICANT RISK OF RESULTING IN AN UNAUTHORIZED ACCESS TO AN
 AREA SECURED BY AN ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
   (D) "REFERENCE DATA" MEANS INFORMATION  AGAINST  WHICH  AUTHENTICATION
 DATA  IS  VERIFIED AT A POINT OF AUTHENTICATION BY A SMART ACCESS SYSTEM
 IN ORDER TO GRANT A USER ENTRY TO A SMART ACCESS BUILDING OR COMMON AREA
 OF SUCH BUILDING.
   (E) "SECURITY BREACH" MEANS ANY INCIDENT THAT RESULTS IN  UNAUTHORIZED
 ACCESS  OF  DATA,  APPLICATIONS,  SERVICES,  NETWORKS  AND/OR DEVICES BY
 BYPASSING UNDERLYING SECURITY MECHANISMS.  A  "SECURITY  BREACH"  OCCURS
 WHEN  AN  INDIVIDUAL  OR AN APPLICATION ILLEGITIMATELY ENTERS A PRIVATE,
 CONFIDENTIAL OR UNAUTHORIZED LOGICAL INFORMATION TECHNOLOGY PERIMETER.
   2. ENTRY. (A) WHERE A LANDLORD INSTALLS OR PLANS TO INSTALL  AN  ELEC-
 TRONIC  OR  COMPUTERIZED  ENTRY  SYSTEM ON ANY ENTRANCE FROM THE STREET,
 PASSAGEWAY, COURT, YARD, CELLAR, OR OTHER  COMMON  AREA  OF  A  CLASS  A
 MULTIPLE  DWELLING,  SUCH  SYSTEM  SHALL  NOT RELY SOLELY ON A WEB-BASED
 APPLICATION TO FACILITATE ENTRANCE BUT SHALL ALSO INCLUDE A KEY FOB, KEY
 CARD, DIGITAL KEY OR PASSCODE FOR TENANT USE.
   (B) LANDLORDS MAY PROVIDE VARIOUS METHODS  OF  ENTRY  INTO  INDIVIDUAL
 APARTMENTS  INCLUDING  A MECHANICAL KEY OR AN ELECTRONIC OR COMPUTERIZED
 ENTRY SYSTEM OF A KEY FOB, KEY CARD OR DIGITAL  KEY,  PROVIDED,  HOWEVER
 THAT  SUCH ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM SHALL NOT RELY SOLELY
 ON A WEB-BASED APPLICATION.
   (C) NOTWITHSTANDING PARAGRAPH (A) OR (B) OF  THIS  SUBDIVISION,  LAND-
 LORDS  SHALL  PROVIDE A NON-ELECTRONIC MEANS OF ENTRY WHERE REQUESTED BY
 THE TENANT DUE TO A RELIGIOUS PREFERENCE.
   (D) ALL LAWFUL TENANTS AND OCCUPANTS SHALL BE PROVIDED WITH A KEY, KEY
 FOB, DIGITAL KEY OR KEY CARD AT NO COST TO SUCH TENANTS. THE TERM "OCCU-
 PANTS" SHALL INCLUDE CHILDREN UNDER THE AGE OF  EIGHTEEN  WHO  SHALL  BE
 ISSUED  A  KEY, KEY FOB, DIGITAL KEY OR KEY CARD IF A PARENT OR GUARDIAN
 REQUESTS SUCH CHILD BE PROVIDED WITH ONE. TENANTS MAY ALSO RECEIVE UP TO
 FOUR ADDITIONAL KEYS, KEY FOBS, DIGITAL KEY OR KEY CARDS AT NO  COST  TO
 THE  TENANT  FOR  EMPLOYEES  OR  GUESTS. THE TERM "GUESTS" SHALL INCLUDE
 FAMILY MEMBERS AND FRIENDS WHO CAN REASONABLY BE EXPECTED TO VISIT ON  A
 REGULAR BASIS OR VISIT AS NEEDED TO CARE FOR THE TENANT OR THE APARTMENT
 IF  THE  TENANT  IS AWAY. EMPLOYEES, INCLUDING CONTRACTORS, PROFESSIONAL
 CAREGIVERS OR OTHER SERVICES PROVIDERS,  MAY  HAVE  AN  EXPIRATION  DATE
 PLACED  ON  THEIR  KEY,  KEY  CARD, DIGITAL KEY OR KEY FOB, WHICH MAY BE
 EXTENDED UPON THE TENANT'S OR OCCUPANT'S REQUEST. TENANTS MAY REQUEST  A
 NEW  OR  REPLACEMENT  KEY,  KEY FOB, DIGITAL KEY OR KEY CARD AT ANY TIME
 THROUGHOUT THE COURSE OF THE TENANCY. THE LANDLORD OR HIS OR  HER  AGENT
 SHALL  PROVIDE  THE  FIRST  REPLACEMENT KEY, KEY FOB, DIGITAL KEY OR KEY
 CARD TO THE TENANT FREE OF CHARGE. THE COST  OF  SECOND  AND  SUBSEQUENT
 REPLACEMENT  CARDS SHALL NOT BE MORE THAN WHAT THE LANDLORD PAID FOR THE
 REPLACEMENT UP TO AND NOT EXCEEDING TWENTY-FIVE DOLLARS.
   (E) THE LANDLORD SHALL NOT SET LIMITS ON THE NUMBER OF KEYS, KEY FOBS,
 DIGITAL KEYS OR KEY CARDS A LAWFUL TENANT OR OCCUPANT MAY REQUEST.
   (F) ANY DOOR THAT HAS AN ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM SHALL
 HAVE BACKUP POWER OR AN ALTERNATIVE MEANS OF ENTRY TO  ENSURE  THAT  THE
 ENTRY  SYSTEM CONTINUES TO OPERATE DURING A POWER OUTAGE. A LANDLORD, OR
 HIS OR HER AGENT, SHALL ROUTINELY INSPECT THE  BACKUP  POWER  AND  SHALL
 REPLACE ACCORDING TO SYSTEM SPECIFICATIONS. OWNERS OR THEIR AGENTS SHALL

 S. 6463--A                          7
 
 PROVIDE  LAWFUL  TENANTS  AND  OCCUPANTS  WITH INFORMATION ABOUT WHOM TO
 CONTACT IN THE EVENT THAT THE TENANT, OCCUPANT OR THE TENANT'S OR  OCCU-
 PANT'S CHILDREN, GUESTS OR EMPLOYEES BECOME LOCKED OUT.
   3.  NOTICE. LANDLORDS OR THEIR AGENTS SHALL PROVIDE NOTICE TO A TENANT
 AT THE TIME THE TENANT SIGNS  THE  LEASE,  OR  WHEN  THE  ELECTRONIC  OR
 COMPUTERIZED ENTRY SYSTEM IS INSTALLED, OF THE PROVISIONS OF SUBDIVISION
 TWO OF THIS SECTION.
   4.  DATA  COLLECTION.  (A)  IF AN ELECTRONIC AND/OR COMPUTERIZED ENTRY
 SYSTEM IS UTILIZED TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING,  THE
 ONLY  REFERENCE, AUTHENTICATION, AND ACCOUNT INFORMATION GATHERED BY ANY
 ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM SHALL BE LIMITED TO  ACCOUNT
 INFORMATION  USED  TO  GRANT  A USER ENTRY OR TO ACCESS ANY ONLINE TOOLS
 USED TO MANAGE USER ACCOUNTS RELATED TO THE ELECTRONIC AND/OR  COMPUTER-
 IZED  ENTRY  SYSTEM,  OR  REFERENCE DATA, SUCH AS THE LESSEE OR TENANT'S
 NAME, APARTMENT NUMBER, THE PREFERRED METHOD OF CONTACT FOR SUCH  LESSEE
 OR  TENANT,  OTHER  DOORS  OR COMMON AREAS TO WHICH THE USER HAS ACCESS,
 MOVE-IN AND, IF AVAILABLE MOVE-OUT DATES, AND AUTHENTICATION  DATA  SUCH
 AS  TIME  AND METHOD OF ACCESS FOR SECURITY PURPOSES AND A PHOTOGRAPH OF
 ACCESS EVENTS FOR SECURITY PURPOSES.  FOR  ELECTRONIC  AND  COMPUTERIZED
 ENTRY  SYSTEMS  THAT  RELY ON THE COLLECTION OF BIOMETRIC DATA AND WHICH
 HAVE ALREADY BEEN INSTALLED AT THE TIME THIS SECTION SHALL HAVE BECOME A
 LAW, A BIOMETRIC IDENTIFIER MAY BE COLLECTED PURSUANT TO THIS SECTION IN
 ORDER TO REGISTER A LESSEE OR TENANT FOR AN ELECTRONIC AND/OR  COMPUTER-
 IZED  ENTRY  SYSTEM. NO NEW ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEMS
 THAT RELY ON THE COLLECTION OF BIOMETRIC  DATA  SHALL  BE  INSTALLED  IN
 CLASS  A  MULTIPLE DWELLINGS FOR THREE YEARS AFTER THE EFFECTIVE DATE OF
 THIS SECTION.
   (I) THE OWNER OF THE MULTIPLE DWELLING MAY COLLECT  ONLY  THE  MINIMUM
 DATA  REQUIRED BY THE TECHNOLOGY USED IN THE ELECTRONIC AND/OR COMPUTER-
 IZED ENTRY SYSTEM TO EFFECTUATE SUCH ENTRANCE AND  PROTECT  THE  PRIVACY
 AND SECURITY OF SUCH TENANTS.
   (II)  THE  OWNER OR AGENT OF THE OWNER SHALL NOT REQUEST OR RETAIN, IN
 ANY FORM, THE SOCIAL SECURITY NUMBER OF ANY  TENANT  OR  OCCUPANT  AS  A
 CONDITION OF USE OF THE ELECTRONIC OR COMPUTERIZED ENTRY SYSTEM.
   (III) THE OWNER, AGENT OF THE OWNER, OR THE VENDOR OF AN ELECTRONIC OR
 COMPUTERIZED  ENTRY SYSTEM ON BEHALF OF THE OWNER MAY RECORD EACH TIME A
 KEY FOB, KEY CARD, DIGITAL KEY OR PASSCODE IS USED TO ENTER  THE  BUILD-
 ING, BUT SHALL NOT RECORD ANY DEPARTURES.
   (IV) A COPY OF SUCH DATA MAY BE RETAINED FOR REFERENCE AT THE POINT OF
 AUTHENTICATION BY THE ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.  SUCH
 REFERENCE  DATA  MAY BE RETAINED ONLY FOR TENANTS OR THOSE AUTHORIZED BY
 THE TENANT OR OWNER OF THE MULTIPLE DWELLING.
   (V) THE OWNER OF THE MULTIPLE  DWELLING  SHALL  DESTROY  OR  ANONYMIZE
 AUTHENTICATION  DATA WITHIN A REASONABLE TIME, BUT NOT LATER THAN NINETY
 DAYS AFTER THE DATE COLLECTED.
   (VI) REFERENCE DATA FOR A TENANT OR THOSE AUTHORIZED BY A TENANT SHALL
 BE DESTROYED OR ANONYMIZED WITHIN NINETY DAYS OF (1) THE  TENANT  PERMA-
 NENTLY VACATING THE DWELLING, OR (2) A REQUEST BY THE TENANT TO WITHDRAW
 AUTHORIZATION FOR THOSE PREVIOUSLY AUTHORIZED BY THE TENANT.
   (B) (I) FOR THE PURPOSES OF THIS SECTION, "BIOMETRIC IDENTIFIER" MEANS
 A  RETINA OR IRIS SCAN, FINGERPRINT, VOICEPRINT, OR RECORD OF HAND, FACE
 GEOMETRY OR OTHER SIMILAR FEATURE.
   (II) AN ENTITY MAY NOT CAPTURE A BIOMETRIC IDENTIFIER OF AN INDIVIDUAL
 TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING UNLESS THE PERSON  IS  A
 TENANT  OR  PERSON  AUTHORIZED BY THE TENANT, AND INFORMS THE INDIVIDUAL

 S. 6463--A                          8
 
 BEFORE CAPTURING THE BIOMETRIC IDENTIFIER; AND  RECEIVES  THEIR  EXPRESS
 CONSENT TO CAPTURE THE BIOMETRIC IDENTIFIER.
   (III)  ANY ENTITY THAT POSSESSES A BIOMETRIC IDENTIFIER OF AN INDIVID-
 UAL THAT IS CAPTURED TO GAIN ENTRANCE TO A CLASS A MULTIPLE DWELLING:
   (1) MAY NOT SELL, LEASE OR OTHERWISE DISCLOSE THE BIOMETRIC IDENTIFIER
 TO ANOTHER PERSON UNLESS PURSUANT TO A  GRAND  JURY  SUBPOENA  OR  COURT
 ORDERED WARRANT, SUBPOENA, OR OTHER AUTHORIZED COURT ORDERED PROCESS.
   (2)  SHALL  STORE,  TRANSMIT AND PROTECT FROM DISCLOSURE THE BIOMETRIC
 IDENTIFIER USING REASONABLE CARE AND IN A MANNER THAT IS THE SAME AS  OR
 MORE  PROTECTIVE  THAN  THE MANNER IN WHICH THE PERSON STORES, TRANSMITS
 AND PROTECTS CONFIDENTIAL INFORMATION THE PERSON POSSESSES; AND
   (3) SHALL DESTROY THE BIOMETRIC IDENTIFIER WITHIN A  REASONABLE  TIME,
 BUT  NOT  LATER  THAN FORTY-EIGHT HOURS AFTER THE DATE COLLECTED, EXCEPT
 FOR REFERENCE DATA. IF ANY PROHIBITED INFORMATION IS COLLECTED, SUCH  AS
 THE  LIKENESS  OF  A  MINOR  OR  A  NON-TENANT, THE INFORMATION SHALL BE
 DESTROYED IMMEDIATELY.
   (C) THE OWNER OF THE MULTIPLE DWELLING, OR THE  MANAGING  AGENT,  MUST
 DEVELOP  WRITTEN  PROCEDURES  WHICH  DESCRIBE  THE  PROCESS  USED TO ADD
 PERSONS AUTHORIZED BY THE TENANT TO ELECTRONIC AND/OR COMPUTERIZED ENTRY
 SYSTEMS ON A TEMPORARY OR PERMANENT BASIS, SUCH AS  VISITORS,  CHILDREN,
 THEIR EMPLOYEES, AND CAREGIVERS TO SUCH BUILDING.
   (I) THE PROCEDURES MUST CLEARLY ESTABLISH THE OWNER'S RETENTION SCHED-
 ULE  AND  GUIDELINES  FOR PERMANENTLY DESTROYING OR ANONYMIZING THE DATA
 COLLECTED.
   (II) THE PROCEDURES CANNOT LIMIT TIME OR PLACE  OF  ENTRANCE  BY  SUCH
 PEOPLE AUTHORIZED BY THE TENANT EXCEPT AS REQUESTED BY THE TENANT.
   5.  PROHIBITIONS.  (A) NO FORM OF LOCATION TRACKING, INCLUDING BUT NOT
 LIMITED TO SATELLITE LOCATION BASED SERVICES, SHALL BE INCLUDED  IN  ANY
 EQUIPMENT,  KEY, OR SOFTWARE PROVIDED TO TENANTS OR GUESTS AS PART OF AN
 ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
   (B) IT SHALL BE PROHIBITED TO COLLECT  THROUGH  AN  ELECTRONIC  AND/OR
 COMPUTERIZED  ENTRY SYSTEM THE LIKENESS OF A MINOR OCCUPANT, INFORMATION
 ON THE RELATIONSHIP STATUS OF TENANTS, LESSEES AND/OR GUESTS, OR TO  USE
 A SMART ACCESS SYSTEM TO COLLECT OR TRACK INFORMATION ABOUT THE FREQUEN-
 CY AND TIME OF USE OF SUCH SYSTEM BY A TENANT AND/OR GUESTS TO HARASS OR
 EVICT  A  TENANT  OR  FOR ANY OTHER PURPOSE NOT EXPRESSLY RELATED TO THE
 OPERATION OF THE SMART ACCESS SYSTEM.
   (C) INFORMATION THAT IS ACQUIRED VIA THE USE OF AN  ELECTRONIC  AND/OR
 COMPUTERIZED  ENTRY SYSTEM SHALL NOT BE USED FOR ANY PURPOSES OTHER THAN
 MONITORING BUILDING ENTRANCES AND SHALL NOT BE  USED  AS  THE  BASIS  OR
 SUPPORT  FOR AN ACTION TO EVICT A LESSEE OR TENANT, OR AN ADMINISTRATIVE
 HEARING SEEKING A CHANGE IN REGULATORY COVERAGE  FOR  AN  INDIVIDUAL  OR
 UNIT.  HOWEVER, A TENANT MAY AUTHORIZE THEIR INFORMATION TO BE USED BY A
 THIRD PARTY, BUT SUCH A REQUEST MUST CLEARLY STATE WHO WILL HAVE  ACCESS
 TO  SUCH  INFORMATION, FOR WHAT PURPOSE IT WILL BE USED, AND THE PRIVACY
 POLICIES WHICH WILL PROTECT THEIR INFORMATION.  UNDER  NO  CIRCUMSTANCES
 MAY  A LEASE OR A RENEWAL BE CONTINGENT UPON AUTHORIZING SUCH USE. ELEC-
 TRONIC AND/OR COMPUTERIZED SYSTEMS MAY USE THIRD-PARTY SERVICES  TO  THE
 EXTENT REQUIRED TO MAINTAIN AND OPERATE SYSTEM INFRASTRUCTURE, INCLUDING
 CLOUD-BASED HOSTING AND STORAGE. THE PROVIDER OR PROVIDERS OF THIRD-PAR-
 TY  INFRASTRUCTURE  SERVICES MUST MEET OR EXCEED THE PRIVACY PROTECTIONS
 SET FORTH IN THIS SECTION AND WILL BE SUBJECT TO THE SAME LIABILITY  FOR
 BREACH OF ANY OF THE REQUIREMENTS OF THIS SECTION.
   (D)  INFORMATION AND DATA COLLECTED SHALL NOT BE MADE AVAILABLE TO ANY
 THIRD PARTY, UNLESS AUTHORIZED AS DESCRIBED  ABOVE,  INCLUDING  BUT  NOT

 S. 6463--A                          9
 
 LIMITED TO LAW ENFORCEMENT, EXCEPT UPON A GRAND JURY SUBPOENA OR A COURT
 ORDERED WARRANT, SUBPOENA, OR OTHER AUTHORIZED COURT ORDERED PROCESS.
   6.  STORAGE OF INFORMATION. ANY INFORMATION OR DATA COLLECTED SHALL BE
 STORED IN A SECURE MANNER TO PREVENT UNAUTHORIZED ACCESS BY BOTH EMPLOY-
 EES AND CONTRACTORS AND THOSE UNAFFILIATED WITH THE  LANDLORD  OR  THEIR
 AGENTS, EXCEPT AS OTHERWISE PROVIDED IN THIS SECTION. FUTURE OR CONTINU-
 ING  TENANCY  SHALL  NOT BE CONDITIONED UPON CONSENTING TO THE USE OF AN
 ELECTRONIC AND/OR COMPUTERIZED ENTRY SYSTEM.
   7. SOFTWARE ISSUES. WHENEVER A COMPANY THAT PRODUCES, MAKES  AVAILABLE
 OR INSTALLS ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS DISCOVERS A SECURI-
 TY  BREACH  OR  CRITICAL  SECURITY VULNERABILITY IN THEIR SOFTWARE, SUCH
 COMPANY SHALL NOTIFY CUSTOMERS OF SUCH VULNERABILITY WITHIN A REASONABLE
 TIME OF DISCOVERY BUT NO LATER THAN TWENTY-FOUR  HOURS  AFTER  DISCOVERY
 AND  SHALL  MAKE SOFTWARE UPDATES AVAILABLE AND TAKE ANY OTHER ACTION AS
 MAY BE NECESSARY TO REPAIR THE VULNERABILITY WITHIN A  REASONABLE  TIME,
 BUT  NOT  LONGER  THAN THIRTY DAYS AFTER DISCOVERY. SMART ACCESS SYSTEMS
 AND VENDORS SHALL IMPLEMENT AND MAINTAIN REASONABLE SECURITY  PROCEDURES
 AND PRACTICES APPROPRIATE TO THE NATURE OF THE INFORMATION COLLECTED. IN
 THE EVENT THAT A SECURITY BREACH OR CRITICAL SECURITY VULNERABILITY THAT
 PERTAINS  TO  THE  EMBEDDED  SOFTWARE  OR  FIRMWARE  ON THE SMART ACCESS
 SYSTEMS IS DISCOVERED, SMART ACCESS SYSTEMS AND THEIR VENDORS SHALL:
   (A) BE ABLE TO CREATE UPDATES TO THE FIRMWARE TO CORRECT  THE  VULNER-
 ABILITIES;
   (B)  CONTRACTUALLY COMMIT TO CUSTOMERS THAT THE SMART ACCESS SYSTEM OR
 VENDOR WILL CREATE UPDATES TO THE EMBEDDED SOFTWARE OR FIRMWARE TO REME-
 DY THE VULNERABILITIES; AND
   (C) MAKE SUCH SECURITY-RELATED SOFTWARE OR FIRMWARE UPDATES  AVAILABLE
 FOR  FREE  TO  CUSTOMERS  FOR THE DURATION OF THE CONTRACT BETWEEN SMART
 ACCESS BUILDINGS AND SMART ACCESS SYSTEMS.
   8. WAIVER OF RIGHTS; VOID. ANY AGREEMENT BY A LESSEE OR  TENANT  OF  A
 DWELLING  WAIVING  OR  MODIFYING  HIS OR HER RIGHTS AS SET FORTH IN THIS
 SECTION SHALL BE VOID AS CONTRARY TO PUBLIC POLICY.
   9. PENALTIES. (A) A PERSON WHO VIOLATES THIS SECTION IS SUBJECT  TO  A
 CIVIL PENALTY OF NOT MORE THAN FIVE THOUSAND DOLLARS FOR EACH VIOLATION.
 THE  ATTORNEY  GENERAL MAY BRING AN ACTION TO RECOVER THE CIVIL PENALTY.
 AN INDIVIDUAL INJURED BY A VIOLATION OF THIS SECTION MAY BRING AN ACTION
 TO RECOVER DAMAGES. A COURT MAY ALSO AWARD ATTORNEYS' FEES TO A PREVAIL-
 ING PLAINTIFF.
   (B) WHERE A LANDLORD OR HIS OR HER AGENT USES AN ELECTRONIC OR COMPUT-
 ERIZED ENTRY SYSTEM TO HARASS OR  OTHERWISE  DEPRIVE  A  TENANT  OF  ANY
 RIGHTS AVAILABLE UNDER LAW, SUCH LANDLORD OR AGENT SHALL BE SUBJECT TO A
 CIVIL PENALTY OF TEN THOUSAND DOLLARS FOR EACH VIOLATION.
   (C)  FOR  PURPOSES  OF THIS SUBDIVISION, EACH DAY THE VIOLATION OCCURS
 SHALL BE CONSIDERED A SEPARATE VIOLATION.
   10. RENT REGULATED DWELLINGS. INSTALLATION OF AN ELECTRONIC OR COMPUT-
 ERIZED ENTRY SYSTEM PURSUANT TO THIS SECTION IN A RENT REGULATED  DWELL-
 ING  SHALL  CONSTITUTE A MODIFICATION OF SERVICES REQUIRING THE LANDLORD
 OF SUCH DWELLING OR HIS OR HER AGENT TO APPLY TO THE DIVISION OF HOUSING
 AND COMMUNITY RENEWAL FOR APPROVAL BEFORE PERFORMING SUCH  INSTALLATION.
 SUCH INSTALLATION SHALL NOT QUALIFY AS A BASIS FOR RENT REDUCTION.
   11.  EXEMPTIONS.  (A) NOTHING HEREIN SHALL APPLY TO MULTIPLE DWELLINGS
 OWNED OR MANAGED BY AN ENTITY SUBJECT TO 42 U.S.C. § 1437  ET  SEQ.,  OR
 ANY OF ITS SUBSIDIARIES.
   (B)  NOTHING IN THIS SECTION SHALL LIMIT THE AUTHORITY OF THE DIVISION
 OF HOUSING AND  COMMUNITY  RENEWAL  TO  IMPOSE  ADDITIONAL  REQUIREMENTS
 REGARDING ELECTRONIC OR COMPUTERIZED ENTRY SYSTEMS INSTALLED IN MULTIPLE

 S. 6463--A                         10
 
 DWELLINGS FOR WHICH THE DIVISION IS REQUIRED TO APPROVE SUBSTITUTIONS OR
 MODIFICATIONS OF SERVICES.
   § 3. Severability. If any provision of this act, or any application of
 any  provision of this act, is held to be invalid, that shall not affect
 the  validity or effectiveness of any other provision of this act, or of
 any other application of any provision of this act, which can  be  given
 effect  without  that  provision  or  application;  and to that end, the
 provisions and applications of this act are severable.
   § 4. This act shall take effect on the one hundred eightieth day after
 it shall have become a law.