LBD14858-01-2
A. 10036 2
STATE, THE DISPROPORTIONATE USE OF SUCH TECHNOLOGY IN LOCATIONS WHERE
ETHNIC AND RACIAL MINORITIES RESIDE, AND THE DISPROPORTIONATE REPRESEN-
TATION OF PARTICULAR ETHNIC AND RACIAL MINORITIES IN ANY UNDERLYING
DATASETS USED TO DEVELOP AND/OR IMPLEMENT SUCH TECHNOLOGY;
(II) EVALUATION OF THE EFFICACY AND ACCURACY OF THE BIOMETRIC RECOGNI-
TION TECHNOLOGY, INCLUDING THE ACCURACY OF SUCH TECHNOLOGY IN IDENTIFY-
ING PERSONS WHO BELONG TO A GROUP OR GROUPS PROTECTED FROM DISCRIMI-
NATION AS SET FORTH IN ARTICLE FIFTEEN OF THIS CHAPTER AND A DESCRIPTION
OF THE METHODOLOGY OF SUCH EVALUATION, INCLUDING WHETHER SUCH EVALUATION
INVOLVED A CONTROLLED OR REAL-WORLD STUDY;
(III) STEPS TAKEN OR PLANNED BY THE STATE OR LOCAL AGENCY TO ADDRESS
AND TO REDUCE ANY DISPARITIES OR INACCURACIES IDENTIFIED IN SUBPARA-
GRAPHS (I) OR (II) OF THIS PARAGRAPH, ALONG WITH THE STATE OR LOCAL
AGENCY'S REASONING FOR CONTINUING TO USE THE BIOMETRIC RECOGNITION TECH-
NOLOGY DESPITE THE DISPARATE IMPACT OR INACCURACY;
(IV) PROCEDURES TO ADDRESS AND CHALLENGE FALSE RESULTS AND PROTECTIVE
MEASURES AND PREVENTATIVE CHECKS AGAINST SUCH OCCURRENCES, AND AN
ASSESSMENT OF THE ADEQUACY OF SUCH PROCEDURES;
(V) WHAT PROTECTIONS ARE PUT IN PLACE FOR DUE PROCESS, PRIVACY, FREE
SPEECH AND ASSOCIATION, AND RACIAL, GENDER, AND RELIGIOUS EQUITY;
(VI) WHETHER THE STATE OR LOCAL AGENCY CONSIDERED A LESS-INTRUSIVE
ALTERNATIVE PRIOR TO UTILIZING THE TECHNOLOGY, AND IF SO, A DESCRIPTION
OF SUCH AN EXPLANATION FOR WHY SUCH ALTERNATIVE WAS NOT ULTIMATELY USED;
AND
(VII) COSTS ASSOCIATED WITH THE USE OF THE TECHNOLOGY AND STORAGE OF
RELEVANT DATA, INCLUDING ANY MAINTENANCE COSTS, ADMINISTRATIVE COSTS OR
OTHER COSTS INCURRED.
2. (A) UNLESS EXPLICITLY REQUIRED BY OTHER PROVISIONS OF STATE LAW, IT
SHALL BE UNLAWFUL FOR ANY STATE OR LOCAL AGENCY TO:
(I) ACQUIRE, ACCESS, OR USE ANY BIOMETRIC RECOGNITION TECHNOLOGY OR
ANY BIOMETRIC DATA; OR
(II) DIRECT THE USE OF ANY BIOMETRIC RECOGNITION TECHNOLOGY OR THE
COLLECTION OF ANY BIOMETRIC DATA BY A THIRD PARTY.
(B) TO THE EXTENT THAT ANY STATE OR LOCAL AGENCY IS CURRENTLY USING
ANY BIOMETRIC RECOGNITION TECHNOLOGY OR COLLECTING ANY BIOMETRIC DATA
AND SUCH USE OR COLLECTION IS NOT OTHERWISE REQUIRED BY ANY OTHER
PROVISION OF STATE LAW, SUCH STATE OR LOCAL AGENCY SHALL IMMEDIATELY
STOP USING SUCH TECHNOLOGY OR DATA.
(C) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A STATE
OR LOCAL AGENCY OR AN EMPLOYEE OF A STATE OR LOCAL AGENCY FROM:
(I) OBTAINING OR POSSESSING ANY DEVICE EQUIPPED WITH BIOMETRIC RECOG-
NITION TECHNOLOGY, PROVIDED SUCH DEVICE IS BEING HELD AS EVIDENCE AND
THE STATE OR LOCAL AGENCY OR THE EMPLOYEE OF SUCH AGENCY DOES NOT ACCESS
OR USE THE BIOMETRIC RECOGNITION TECHNOLOGY OF SUCH DEVICE;
(II) ACQUIRING, ACCESSING, OR USING ANY BIOMETRIC RECOGNITION TECHNOL-
OGY ON A DEVICE OWNED BY THE STATE OR LOCAL AGENCY OR AN EMPLOYEE OF
SUCH AGENCY, FOR THE SOLE PURPOSE OF USER AUTHENTICATION OF AGENCY
EMPLOYEES PROVIDED THAT THE AGENCY DOES NOT ACCESS OR USE SUCH BIOMETRIC
RECOGNITION TECHNOLOGY FOR ANY OTHER PURPOSE OTHER THAN USER AUTHENTICA-
TION AND PROVIDED THAT NO BIOMETRIC DATA OF INDIVIDUALS NOT EMPLOYED BY
SUCH AGENCY ARE INTENTIONALLY ENTERED, RETAINED, OR PROCESSED BY SUCH
TECHNOLOGY;
(III) ACCESSING OR USING A TECHNOLOGY OR SERVICE NOT OWNED BY THE
STATE OR LOCAL AGENCY OR AN EMPLOYEE OF SUCH AGENCY BUT WHICH IS OPER-
ATED BY A THIRD PARTY, PROVIDED THAT THE AGENCY OR AN EMPLOYEE OF THE
AGENCY DOES NOT PROCESS, USE, REQUEST, OR RETAIN ANY INFORMATION CREATED
A. 10036 3
BY THE BIOMETRIC RECOGNITION TECHNOLOGY AND THAT NO BIOMETRIC DATA OF
INDIVIDUALS NOT EMPLOYED BY SUCH AGENCY ARE INTENTIONALLY ENTERED, OR
PROCESSED BY SUCH TECHNOLOGY; OR
(IV) ACQUIRING, ACCESSING, OR USING AN AUTOMATED OR SEMI-AUTOMATED
PROCESS FOR THE PURPOSE OF REDACTING A RECORDING FOR RELEASE OR DISCLO-
SURE OUTSIDE THE STATE OR LOCAL AGENCY TO PROTECT THE PRIVACY OF A
SUBJECT DEPICTED IN THE RECORDING, PROVIDED THAT THE PROCESS DOES NOT
GENERATE OR RESULT IN THE RETENTION OF ANY BIOMETRIC DATA.
(D) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A PUBLIC
HEALTH OR PUBLIC EDUCATION AGENCY FROM ACQUIRING, ACCESSING, OR USING
BIOMETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA FOR PURPOSES RELATED
TO PUBLIC HEALTH, RESEARCH, OR EDUCATION, PROVIDED THAT SUCH BIOMETRIC
RECOGNITION TECHNOLOGIES OR BIOMETRIC DATA ARE NOT SHARED WITH A LAW
ENFORCEMENT AGENCY.
(E) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A STATE
OR LOCAL AGENCY FROM:
(I) COLLECTING A GENETIC OR FINGERPRINT SAMPLE OR SAMPLES THAT ARE
ABANDONED AT THE SCENE OF AN ALLEGED CRIMINAL OFFENSE AND IS NOT
COLLECTED FROM THE PERSON OF A CRIMINAL SUSPECT; OR
(II) COLLECTING GENETIC SAMPLES FROM AN INDIVIDUAL WHO IS ALLEGED TO
BE THE VICTIM OF A CRIME AND WHO CONSENTS TO SUCH COLLECTION.
3. ON OR BEFORE MAY FIRST, TWO THOUSAND TWENTY-TWO, AND ANNUALLY THER-
EAFTER, ANY STATE OR LOCAL AGENCY USING OR ACQUIRING FOR USE BIOMETRIC
RECOGNITION TECHNOLOGY OR BIOMETRIC DATA AS EXPLICITLY REQUIRED BY ANY
OTHER PROVISION OF STATE LAW SHALL:
(A) TRANSMIT A REPORT TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE
SENATE, THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE,
AND THE MINORITY LEADER OF THE ASSEMBLY DETAILING EACH BIOMETRIC RECOG-
NITION TECHNOLOGY OR TYPE OF BIOMETRIC DATA IT INTENDS TO ACQUIRE,
ACCESS, USE, COLLECT OR ANALYZE. EACH STATE OR LOCAL AGENCY REQUIRED TO
FILE A REPORT SHALL ALSO PUBLISH SUCH REPORT ON THE STATE OR LOCAL AGEN-
CY'S WEBSITE. SUCH REPORT SHALL ALSO INCLUDE, BUT NOT BE LIMITED TO, THE
FOLLOWING:
(I) THE TYPE OF BIOMETRIC DATA;
(II) THE TYPE AND VENDOR OF BIOMETRIC RECOGNITION TECHNOLOGY;
(III) THE STATE LAW THAT, IN THE STATE OR LOCAL AGENCY'S VIEW, EXPLIC-
ITLY REQUIRES SUCH ACQUISITION, ACCESS, USE, COLLECTION, OR ANALYSIS OR
BIOMETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA;
(IV) THE TIME PERIOD, IF ANY, THAT THE BIOMETRIC DATA WILL BE RETAINED
AND THE REASONS THE SPECIFIC BIOMETRIC DATA WILL BE RETAINED FOR DURING
THE DESIGNATED TIME PERIOD;
(V) WHETHER ANY BIOMETRIC DATA WILL BE SHARED WITH ANOTHER INDIVIDUAL
OR ENTITY AND IF SO, WITH WHAT INDIVIDUALS OR ENTITIES IT WILL BE
SHARED, AND WHETHER EXPLICIT AUTHORIZATION EXISTS FOR SUCH DATA TO BE
SHARED;
(VI) THE RISK OF AN UNAUTHORIZED ACCESS TO OR BREACH OF RETAINED BIOM-
ETRIC DATA, SAFEGUARDS OR SECURITY MEASURES DESIGNED TO MITIGATE ANY
SUCH RISK, AND APPROPRIATE CONSEQUENCES FOR FAILURE TO ADHERE TO SUCH
SAFEGUARDS OR SECURITY MEASURES IN THE EVENT OF UNAUTHORIZED ACCESS OR A
BREACH; AND
(VII) RELATED TO ANY UNAUTHORIZED BREACHES OF RETAINED BIOMETRIC DATA
SINCE MAY FIRST OF THE PREVIOUS YEAR, A DESCRIPTION OF: (1) ANY SUCH
BREACHES; (2) THE RESULTS OF ANY COMPLETED INVESTIGATIONS OF ANY SUCH
BREACHES; (3) ANY ATTEMPTS TO NOTIFY ANYONE IMPACTED BY ANY SUCH BREACH
OR WHOSE BIOMETRIC DATA MAY HAVE BEEN UNLAWFULLY ACCESSED; AND
A. 10036 4
(4) ANY ACTIONS THE STATE OR LOCAL AGENCY HAS TAKEN TO ADDRESS ANY
BREACHES.
(B) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE
OF THIS SECTION TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE,
THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE, AND THE
MINORITY LEADER OF THE ASSEMBLY AS WELL AS PUBLISHING SUCH ASSESSMENT TO
THE STATE AGENCY, POLICE AGENCY, OR THE STATE POLICE'S OWN WEB PAGE.
(C) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE
OF THIS SECTION TO THE CIVIL RIGHTS BUREAU OF THE OFFICE OF THE ATTORNEY
GENERAL, WHICH SHALL REVIEW SUCH ASSESSMENT AND MAKE RECOMMENDATIONS OR
TAKE OTHER ACTION AS MAY BE APPROPRIATE WITH RESPECT TO ANY DISPARITY OR
INACCURACY IDENTIFIED IN SUCH ASSESSMENT.
§ 2. The executive law is amended by adding a new section 235 to read
as follows:
§ 235. USE OF BIOMETRIC RECOGNITION TECHNOLOGY PROHIBITED. 1. FOR THE
PURPOSES OF THIS SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING
MEANINGS:
(A) "BIOMETRIC DATA" SHALL MEAN ANY MEASURABLE PHYSIOLOGICAL, BIOLOG-
ICAL OR BEHAVIORAL CHARACTERISTICS THAT ARE ATTRIBUTABLE TO A PERSON,
INCLUDING FACIAL CHARACTERISTICS, FINGERPRINT CHARACTERISTICS, HAND
CHARACTERISTICS, EYE CHARACTERISTICS, GENETIC CHARACTERISTICS, VOCAL
CHARACTERISTICS, THERMAL CHARACTERISTICS THAT CAN BE USED, EITHER SINGU-
LARLY OR IN COMBINATION WITH EACH OTHER OR CAN BE PAIRED OR COMBINED
WITH OTHER INFORMATION, TO ESTABLISH INDIVIDUAL IDENTITY.
(B) "BIOMETRIC RECOGNITION TECHNOLOGY" SHALL MEAN EITHER OR BOTH (I)
ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES BY WHICH A PERSON
IS IDENTIFIED OR ATTEMPTED TO BE IDENTIFIED BASED ON THEIR BIOMETRIC
DATA, INCLUDING IDENTIFICATION OF KNOWN OR UNKNOWN INDIVIDUALS OR
GROUPS; AND/OR (II) ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES
THAT GENERATES OR ASSISTS IN GENERATING, INFORMATION ABOUT ANY INDIVID-
UAL BASED ON THEIR BIOMETRIC DATA, INCLUDING BUT NOT LIMITED TO EMOTION,
AFFECT, OR BEHAVIOR DETECTION.
(C) "EQUITY IMPACT ASSESSMENT" SHALL MEAN AN AUDIT AND REPORT ADDRESS-
ING, AT A MINIMUM, THE FOLLOWING:
(I) EVALUATION OF POTENTIAL BENEFITS, HARMS, AND IMPACTS ON PERSONS OR
GROUPS OF PERSONS WHO ARE PROTECTED FROM DISCRIMINATION AS SET FORTH IN
ARTICLE FIFTEEN OF THIS CHAPTER, INCLUDING SPECIFIC CONSIDERATIONS BASED
ON A PERSON'S ETHNIC AND RACIAL BACKGROUND. SUCH EVALUATION SHALL ALSO
INCLUDE, ALTHOUGH NOT BE LIMITED TO THE DISPROPORTIONATE COLLECTION AND
USE OF SUCH TECHNOLOGY ON ETHNIC AND RACIAL MINORITIES IN NEW YORK
STATE, THE DISPROPORTIONATE USE OF SUCH TECHNOLOGY IN LOCATIONS WHERE
ETHNIC AND RACIAL MINORITIES RESIDE, AND THE DISPROPORTIONATE REPRESEN-
TATION OF PARTICULAR ETHNIC AND RACIAL MINORITIES IN ANY UNDERLYING
DATASETS USED TO DEVELOP AND/OR IMPLEMENT SUCH TECHNOLOGY;
(II) EVALUATION OF THE EFFICACY AND ACCURACY OF THE BIOMETRIC RECOGNI-
TION TECHNOLOGY, INCLUDING THE ACCURACY OF SUCH TECHNOLOGY IN IDENTIFY-
ING PERSONS WHO BELONG TO A GROUP OR GROUPS PROTECTED FROM DISCRIMI-
NATION AS SET FORTH IN ARTICLE FIFTEEN OF THIS CHAPTER, AND A
DESCRIPTION OF THE METHODOLOGY OF SUCH EVALUATION, INCLUDING WHETHER
SUCH EVALUATION INVOLVED A CONTROLLED OR REAL-WORLD STUDY;
(III) STEPS TAKEN OR PLANNED BY THE DIVISION OF STATE POLICE TO
ADDRESS AND TO REDUCE ANY DISPARITIES OR INACCURACIES IDENTIFIED IN
SUBPARAGRAPHS (I) OR (II) OF THIS PARAGRAPH, ALONG WITH THE AGENCY'S
REASONING FOR CONTINUING TO USE THE BIOMETRIC RECOGNITION TECHNOLOGY
DESPITE THE DISPARATE IMPACT OR INACCURACY;
A. 10036 5
(IV) PROCEDURES TO ADDRESS AND CHALLENGE FALSE RESULTS AND PROTECTIVE
MEASURES AND PREVENTATIVE CHECKS AGAINST SUCH OCCURRENCES, AND AN
ASSESSMENT OF THE ADEQUACY OF SUCH PROCEDURES;
(V) WHAT PROTECTIONS ARE PUT IN PLACE FOR DUE PROCESS, PRIVACY, FREE
SPEECH AND ASSOCIATION, AND RACIAL, GENDER, AND RELIGIOUS EQUITY;
(VI) WHETHER THE DIVISION OF STATE POLICE CONSIDERED A LESS-INTRUSIVE
ALTERNATIVE PRIOR TO UTILIZING THE TECHNOLOGY, AND IF SO, A DESCRIPTION
OF SUCH AN EXPLANATION FOR WHY SUCH ALTERNATIVE WAS NOT ULTIMATELY USED;
AND
(VII) COSTS ASSOCIATED WITH THE USE OF THE TECHNOLOGY AND STORAGE OF
RELEVANT DATA, INCLUDING ANY MAINTENANCE COSTS, ADMINISTRATIVE COSTS OR
OTHER COSTS INCURRED.
2. (A) UNLESS EXPLICITLY REQUIRED BY OTHER PROVISIONS OF STATE LAW, IT
SHALL BE UNLAWFUL FOR ANY MEMBER OF THE DIVISION OF STATE POLICE TO:
(I) ACQUIRE, ACCESS, OR USE ANY BIOMETRIC RECOGNITION TECHNOLOGY OR
ANY BIOMETRIC DATA; OR
(II) DIRECT THE USE OF ANY BIOMETRIC RECOGNITION TECHNOLOGY OR THE
COLLECTION OF ANY BIOMETRIC DATA BY A THIRD PARTY.
(B) TO THE EXTENT THAT THE DIVISION OF STATE POLICE IS CURRENTLY USING
ANY BIOMETRIC RECOGNITION TECHNOLOGY OR COLLECTING ANY BIOMETRIC DATA
AND SUCH USE OR COLLECTION IS NOT OTHERWISE REQUIRED BY ANY OTHER
PROVISION OF STATE LAW, THE DIVISION OF STATE POLICE SHALL IMMEDIATELY
STOP USING SUCH TECHNOLOGY OR DATA.
(C) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT THE
STATE POLICE OR A MEMBER OF THE STATE POLICE FROM:
(I) OBTAINING OR POSSESSING ANY DEVICE EQUIPPED WITH BIOMETRIC RECOG-
NITION TECHNOLOGY, PROVIDED SUCH DEVICE IS BEING HELD AS EVIDENCE AND
THE DIVISION OF STATE POLICE OR THE EMPLOYEE OF THE DIVISION OF STATE
POLICE DOES NOT ACCESS OR USE THE BIOMETRIC RECOGNITION TECHNOLOGY OF
SUCH DEVICE;
(II) ACQUIRING, ACCESSING, OR USING ANY BIOMETRIC RECOGNITION TECHNOL-
OGY ON A DEVICE OWNED BY THE DIVISION OF STATE POLICE OR AN EMPLOYEE OF
THE DIVISION OF STATE POLICE, FOR THE SOLE PURPOSE OF USER AUTHENTICA-
TION OF AGENCY EMPLOYEES PROVIDED THAT THE DIVISION OF STATE POLICE DOES
NOT ACCESS OR USE SUCH BIOMETRIC RECOGNITION TECHNOLOGY FOR ANY OTHER
PURPOSE OTHER THAN USER AUTHENTICATION AND PROVIDED THAT NO BIOMETRIC
DATA OF INDIVIDUALS NOT EMPLOYED BY THE DIVISION OF STATE POLICE ARE
INTENTIONALLY ENTERED, RETAINED, OR PROCESSED BY SUCH TECHNOLOGY;
(III) ACCESSING OR USING A TECHNOLOGY OR SERVICE NOT OWNED BY THE
DIVISION OF STATE POLICE OR AN EMPLOYEE OF THE DIVISION OF STATE POLICE
BUT WHICH IS OPERATED BY A THIRD PARTY, PROVIDED THAT THE DIVISION OF
STATE POLICE OR AN EMPLOYEE OF THE DIVISION OF STATE POLICE DOES NOT
PROCESS, USE, REQUEST, OR RETAIN ANY INFORMATION CREATED BY THE BIOME-
TRIC RECOGNITION TECHNOLOGY AND THAT NO BIOMETRIC DATA OF INDIVIDUALS
NOT EMPLOYED BY THE DIVISION OF STATE POLICE ARE INTENTIONALLY ENTERED,
OR PROCESSED BY SUCH TECHNOLOGY; OR
(IV) ACQUIRING, ACCESSING, OR USING AN AUTOMATED OR SEMI-AUTOMATED
PROCESS FOR THE PURPOSE OF REDACTING A RECORDING FOR RELEASE OR DISCLO-
SURE OUTSIDE THE DIVISION OF STATE POLICE TO PROTECT THE PRIVACY OF A
SUBJECT DEPICTED IN THE RECORDING, PROVIDED THAT THE PROCESS DOES NOT
GENERATE OR RESULT IN THE RETENTION OF ANY BIOMETRIC DATA.
(D) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT THE
DIVISION OF STATE POLICE OR MEMBERS OF THE DIVISION OF STATE POLICE
FROM:
A. 10036 6
(I) COLLECTING A GENETIC OR FINGERPRINT SAMPLE OR SAMPLES THAT ARE
ABANDONED AT THE SCENE OF AN ALLEGED CRIMINAL OFFENSE AND IS NOT
COLLECTED FROM THE PERSON OF A CRIMINAL SUSPECT; OR
(II) COLLECTING GENETIC SAMPLES FROM AN INDIVIDUAL WHO IS ALLEGED TO
BE THE VICTIM OF A CRIME AND WHO CONSENTS TO SUCH COLLECTION.
3. ON OR BEFORE MAY FIRST, TWO THOUSAND TWENTY-TWO AND ANNUALLY THERE-
AFTER, ANY DIVISION OF STATE POLICE USING OR ACQUIRING FOR USE BIOMETRIC
RECOGNITION TECHNOLOGY OR BIOMETRIC DATA AS EXPLICITLY REQUIRED BY ANY
OTHER PROVISION OF STATE LAW SHALL:
(A) TRANSMIT A REPORT TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE
SENATE, THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE,
AND THE MINORITY LEADER OF THE ASSEMBLY DETAILING EACH BIOMETRIC RECOG-
NITION TECHNOLOGY OR TYPE OF BIOMETRIC DATA IT INTENDS TO ACQUIRE,
ACCESS, USE, COLLECT OR ANALYZE. EACH DIVISION OF STATE POLICE REQUIRED
TO FILE A REPORT SHALL ALSO PUBLISH SUCH REPORT ON THE DIVISION OF STATE
POLICE'S WEBSITE. SUCH REPORT SHALL ALSO INCLUDE, BUT NOT BE LIMITED TO,
THE FOLLOWING:
(I) THE TYPE OF BIOMETRIC DATA;
(II) THE TYPE AND VENDOR OF BIOMETRIC RECOGNITION TECHNOLOGY;
(III) THE STATE LAW THAT, IN THE DIVISION OF STATE POLICE'S VIEW,
EXPLICITLY REQUIRES SUCH ACQUISITION, ACCESS, USE, COLLECTION, OR ANALY-
SIS OR BIOMETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA;
(IV) THE TIME PERIOD, IF ANY, THAT THE BIOMETRIC DATA WILL BE RETAINED
AND THE REASONS THE SPECIFIC BIOMETRIC DATA WILL BE RETAINED FOR DURING
THE DESIGNATED TIME PERIOD;
(V) WHETHER ANY BIOMETRIC DATA WILL BE SHARED WITH ANOTHER INDIVIDUAL
OR ENTITY AND IF SO, WITH WHAT INDIVIDUALS OR ENTITIES IT WILL BE
SHARED, AND WHETHER EXPLICIT AUTHORIZATION EXISTS FOR SUCH DATA TO BE
SHARED;
(VI) THE RISK OF AN UNAUTHORIZED ACCESS TO OR BREACH OF RETAINED BIOM-
ETRIC DATA, SAFEGUARDS OR SECURITY MEASURES DESIGNED TO MITIGATE ANY
SUCH RISK, AND APPROPRIATE CONSEQUENCES FOR FAILURE TO ADHERE TO SUCH
SAFEGUARDS OR SECURITY MEASURES IN THE EVENT OF UNAUTHORIZED ACCESS OR A
BREACH; AND
(VII) RELATED TO ANY UNAUTHORIZED BREACHES OF RETAINED BIOMETRIC DATA
SINCE MAY FIRST OF THE PREVIOUS YEAR, A DESCRIPTION OF: (1) ANY SUCH
BREACHES; (2) THE RESULTS OF ANY COMPLETED INVESTIGATIONS OF ANY SUCH
BREACHES; (3) ANY ATTEMPTS TO NOTIFY ANYONE IMPACTED BY ANY SUCH BREACH
OR WHOSE BIOMETRIC DATA MAY HAVE BEEN UNLAWFULLY ACCESSED; AND (4) ANY
ACTIONS THE AGENCY HAS TAKEN TO ADDRESS ANY BREACHES.
(B) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE
OF THIS SECTION TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE,
THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE, AND THE
MINORITY LEADER OF THE ASSEMBLY AS WELL AS PUBLISHING SUCH ASSESSMENT TO
THE STATE AGENCY, POLICE AGENCY, OR THE DIVISION OF STATE POLICE'S OWN
WEB PAGE.
(C) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE
OF THIS SECTION TO THE CIVIL RIGHTS BUREAU OF THE OFFICE OF THE ATTORNEY
GENERAL, WHICH SHALL REVIEW SUCH ASSESSMENT AND MAKE RECOMMENDATIONS OR
TAKE OTHER ACTION AS MAY BE APPROPRIATE WITH RESPECT TO ANY DISPARITY OR
INACCURACY IDENTIFIED IN SUCH ASSESSMENT.
§ 3. The executive law is amended by adding a new section 837-x to
read as follows:
§ 837-X. USE OF BIOMETRIC RECOGNITION TECHNOLOGY PROHIBITED. 1. FOR
THE PURPOSES OF THIS SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOW-
ING MEANINGS:
A. 10036 7
(A) "BIOMETRIC DATA" SHALL MEAN ANY MEASURABLE PHYSIOLOGICAL, BIOLOG-
ICAL OR BEHAVIORAL CHARACTERISTICS THAT ARE ATTRIBUTABLE TO A PERSON,
INCLUDING FACIAL CHARACTERISTICS, FINGERPRINT CHARACTERISTICS, HAND
CHARACTERISTICS, EYE CHARACTERISTICS, GENETIC CHARACTERISTICS, VOCAL
CHARACTERISTICS, THERMAL CHARACTERISTICS THAT CAN BE USED, EITHER SINGU-
LARLY OR IN COMBINATION WITH EACH OTHER OR CAN BE PAIRED OR COMBINED
WITH OTHER INFORMATION, TO ESTABLISH INDIVIDUAL IDENTITY.
(B) "BIOMETRIC RECOGNITION TECHNOLOGY" SHALL MEAN EITHER OR BOTH (I)
ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES BY WHICH A PERSON
IS IDENTIFIED OR ATTEMPTED TO BE IDENTIFIED BASED ON THEIR BIOMETRIC
DATA, INCLUDING IDENTIFICATION OF KNOWN OR UNKNOWN INDIVIDUALS OR
GROUPS; AND/OR (II) ANY AUTOMATED OR SEMI-AUTOMATED PROCESS OR PROCESSES
THAT GENERATES OR ASSISTS IN GENERATING, INFORMATION ABOUT ANY INDIVID-
UAL BASED ON THEIR BIOMETRIC DATA, INCLUDING BUT NOT LIMITED TO EMOTION,
AFFECT, OR BEHAVIOR DETECTION.
(C) "EQUITY IMPACT ASSESSMENT" SHALL MEAN AN AUDIT AND REPORT ADDRESS-
ING, AT A MINIMUM, THE FOLLOWING:
(I) EVALUATION OF POTENTIAL BENEFITS, HARMS, AND IMPACTS ON PERSONS OR
GROUPS OF PERSONS WHO ARE PROTECTED FROM DISCRIMINATION AS SET FORTH IN
ARTICLE FIFTEEN OF THIS CHAPTER, INCLUDING SPECIFIC CONSIDERATIONS BASED
ON A PERSON'S ETHNIC AND RACIAL BACKGROUND. SUCH EVALUATION SHALL ALSO
INCLUDE, ALTHOUGH NOT BE LIMITED TO THE DISPROPORTIONATE COLLECTION AND
USE OF SUCH TECHNOLOGY ON ETHNIC AND RACIAL MINORITIES IN NEW YORK
STATE, THE DISPROPORTIONATE USE OF SUCH TECHNOLOGY IN LOCATIONS WHERE
ETHNIC AND RACIAL MINORITIES RESIDE, AND THE DISPROPORTIONATE REPRESEN-
TATION OF PARTICULAR ETHNIC AND RACIAL MINORITIES IN ANY UNDERLYING
DATASETS USED TO DEVELOP AND/OR IMPLEMENT SUCH TECHNOLOGY;
(II) EVALUATION OF THE EFFICACY AND ACCURACY OF THE BIOMETRIC RECOGNI-
TION TECHNOLOGY, INCLUDING THE ACCURACY OF SUCH TECHNOLOGY IN IDENTIFY-
ING PERSONS WHO BELONG TO A GROUP OR GROUPS PROTECTED FROM DISCRIMI-
NATION AS SET FORTH IN ARTICLE FIFTEEN OF THIS CHAPTER, AND A
DESCRIPTION OF THE METHODOLOGY OF SUCH EVALUATION, INCLUDING WHETHER
SUCH EVALUATION INVOLVED A CONTROLLED OR REAL-WORLD STUDY;
(III) STEPS TAKEN OR PLANNED BY THE AGENCY TO ADDRESS AND TO REDUCE
ANY DISPARITIES OR INACCURACIES IDENTIFIED IN SUBPARAGRAPHS (I) OR (II)
OF THIS PARAGRAPH, ALONG WITH THE POLICE AGENCY, POLICE OFFICER OR PEACE
OFFICER'S REASONING FOR CONTINUING TO USE THE BIOMETRIC RECOGNITION
TECHNOLOGY DESPITE THE DISPARATE IMPACT OR INACCURACY;
(IV) PROCEDURES TO ADDRESS AND CHALLENGE FALSE RESULTS AND PROTECTIVE
MEASURES AND PREVENTATIVE CHECKS AGAINST SUCH OCCURRENCES, AND AN
ASSESSMENT OF THE ADEQUACY OF SUCH PROCEDURES;
(V) WHAT PROTECTIONS ARE PUT IN PLACE FOR DUE PROCESS, PRIVACY, FREE
SPEECH AND ASSOCIATION, AND RACIAL, GENDER, AND RELIGIOUS EQUITY;
(VI) WHETHER THE POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER
CONSIDERED A LESS-INTRUSIVE ALTERNATIVE PRIOR TO UTILIZING THE TECHNOLO-
GY, AND IF SO, A DESCRIPTION OF SUCH AN EXPLANATION FOR WHY SUCH ALTER-
NATIVE WAS NOT ULTIMATELY USED; AND
(VII) COSTS ASSOCIATED WITH THE USE OF THE TECHNOLOGY AND STORAGE OF
RELEVANT DATA, INCLUDING ANY MAINTENANCE COSTS, ADMINISTRATIVE COSTS OR
OTHER COSTS INCURRED.
2. (A) UNLESS EXPLICITLY REQUIRED BY OTHER PROVISIONS OF STATE LAW, IT
SHALL BE UNLAWFUL FOR ANY POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER
TO:
(I) ACQUIRE, ACCESS, OR USE ANY BIOMETRIC RECOGNITION TECHNOLOGY OR
ANY BIOMETRIC DATA; OR
A. 10036 8
(II) DIRECT THE USE OF ANY BIOMETRIC RECOGNITION TECHNOLOGY OR THE
COLLECTION OF ANY BIOMETRIC DATA BY A THIRD PARTY.
(B) TO THE EXTENT THAT ANY POLICE AGENCY, POLICE OFFICER OR PEACE
OFFICER IS CURRENTLY USING ANY BIOMETRIC RECOGNITION TECHNOLOGY OR
COLLECTING ANY BIOMETRIC DATA AND SUCH USE OR COLLECTION IS NOT OTHER-
WISE REQUIRED BY ANY OTHER PROVISION OF STATE LAW, SUCH POLICE AGENCY,
POLICE OFFICER OR PEACE OFFICER SHALL IMMEDIATELY STOP USING SUCH TECH-
NOLOGY OR DATA.
(C) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A POLICE
AGENCY, POLICE OFFICER OR PEACE OFFICER FROM:
(I) OBTAINING OR POSSESSING ANY DEVICE EQUIPPED WITH BIOMETRIC RECOG-
NITION TECHNOLOGY, PROVIDED SUCH DEVICE IS BEING HELD AS EVIDENCE AND
THE POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER DOES NOT ACCESS OR
USE THE BIOMETRIC RECOGNITION TECHNOLOGY OF SUCH DEVICE; OR
(II) ACQUIRING, ACCESSING, OR USING ANY BIOMETRIC RECOGNITION TECHNOL-
OGY ON A DEVICE OWNED BY THE POLICE AGENCY, POLICE OFFICER OR PEACE
OFFICER FOR THE SOLE PURPOSE OF USER AUTHENTICATION OF POLICE AGENCY
EMPLOYEES, POLICE OFFICERS OR PEACE OFFICERS PROVIDED THAT THE POLICE
AGENCY DOES NOT ACCESS OR USE SUCH BIOMETRIC RECOGNITION TECHNOLOGY FOR
ANY OTHER PURPOSE OTHER THAN USER AUTHENTICATION AND PROVIDED THAT NO
BIOMETRIC DATA OF INDIVIDUALS NOT EMPLOYED BY THE POLICE AGENCY ARE
INTENTIONALLY ENTERED, RETAINED, OR PROCESSED BY SUCH TECHNOLOGY; OR
(III) ACCESSING OR USING A TECHNOLOGY OR SERVICE NOT OWNED BY THE
POLICE AGENCY, POLICE OFFICER OR PEACE OFFICER BUT WHICH IS OPERATED BY
A THIRD PARTY, PROVIDED THAT THE POLICE AGENCY, POLICE OFFICER OR PEACE
OFFICER DOES NOT PROCESS, USE, REQUEST, OR RETAIN ANY INFORMATION
CREATED BY THE BIOMETRIC RECOGNITION TECHNOLOGY AND THAT NO DATA OF
INDIVIDUALS NOT EMPLOYED BY THE POLICE AGENCY ARE INTENTIONALLY ENTERED,
OR PROCESSED BY SUCH TECHNOLOGY; OR
(IV) ACQUIRING, ACCESSING, OR USING AN AUTOMATED OR SEMI-AUTOMATED
PROCESS FOR THE PURPOSE OF REDACTING A RECORDING FOR RELEASE OR DISCLO-
SURE OUTSIDE THE POLICE AGENCY TO PROTECT THE PRIVACY OF A SUBJECT
DEPICTED IN THE RECORDING, PROVIDED THAT THE PROCESS DOES NOT GENERATE
OR RESULT IN THE RETENTION OF ANY BIOMETRIC DATA.
(D) NOTHING IN THIS SUBDIVISION SHALL BE CONSTRUED TO PREVENT A POLICE
AGENCY, POLICE OFFICER OR PEACE OFFICER FROM:
(I) COLLECTING A GENETIC OR FINGERPRINT SAMPLE OR SAMPLES THAT ARE
ABANDONED AT THE SCENE OF AN ALLEGED CRIMINAL OFFENSE AND IS NOT
COLLECTED FROM THE PERSON OF A CRIMINAL SUSPECT; OR
(II) COLLECTING GENETIC SAMPLES FROM AN INDIVIDUAL WHO IS ALLEGED TO
BE THE VICTIM OF A CRIME AND WHO CONSENTS TO SUCH COLLECTION.
3. ON OR BEFORE MAY FIRST, TWO THOUSAND TWENTY-TWO AND ANNUALLY THERE-
AFTER, ANY POLICE AGENCY USING OR ACQUIRING FOR USE BIOMETRIC RECOGNI-
TION TECHNOLOGY OR BIOMETRIC DATA AS EXPLICITLY REQUIRED BY ANY OTHER
PROVISION OF STATE LAW SHALL:
(A) TRANSMIT A REPORT TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE
SENATE, THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE,
AND THE MINORITY LEADER OF THE ASSEMBLY DETAILING EACH BIOMETRIC RECOG-
NITION TECHNOLOGY OR TYPE OF BIOMETRIC DATA IT INTENDS TO ACQUIRE,
ACCESS, USE, COLLECT OR ANALYZE. EACH POLICE AGENCY REQUIRED TO FILE A
REPORT SHALL ALSO PUBLISH SUCH REPORT ON THE POLICE AGENCY'S WEBSITE.
SUCH REPORT SHALL ALSO INCLUDE, BUT NOT BE LIMITED TO, THE FOLLOWING:
(I) THE TYPE OF BIOMETRIC DATA;
(II) THE TYPE AND VENDOR OF BIOMETRIC RECOGNITION TECHNOLOGY;
A. 10036 9
(III) THE STATE LAW THAT, IN THE POLICE AGENCY'S VIEW, EXPLICITLY
REQUIRES SUCH ACQUISITION, ACCESS, USE, COLLECTION, OR ANALYSIS OR BIOM-
ETRIC RECOGNITION TECHNOLOGY OR BIOMETRIC DATA;
(IV) THE TIME PERIOD, IF ANY, THAT THE BIOMETRIC DATA WILL BE RETAINED
AND THE REASONS THE SPECIFIC BIOMETRIC DATA WILL BE RETAINED FOR DURING
THE DESIGNATED TIME PERIOD;
(V) WHETHER ANY BIOMETRIC DATA WILL BE SHARED WITH ANOTHER INDIVIDUAL
OR ENTITY AND IF SO, WITH WHAT INDIVIDUALS OR ENTITIES IT WILL BE
SHARED, AND WHETHER EXPLICIT AUTHORIZATION EXISTS FOR SUCH DATA TO BE
SHARED;
(VI) THE RISK OF AN UNAUTHORIZED ACCESS TO OR BREACH OF RETAINED BIOM-
ETRIC DATA, SAFEGUARDS OR SECURITY MEASURES DESIGNED TO MITIGATE ANY
SUCH RISK, AND APPROPRIATE CONSEQUENCES FOR FAILURE TO ADHERE TO SUCH
SAFEGUARDS OR SECURITY MEASURES IN THE EVENT OF UNAUTHORIZED ACCESS OR A
BREACH; AND
(VII) RELATED TO ANY UNAUTHORIZED BREACHES OF RETAINED BIOMETRIC DATA
SINCE MAY FIRST OF THE PREVIOUS YEAR, A DESCRIPTION OF: (1) ANY SUCH
BREACHES; (2) THE RESULTS OF ANY COMPLETED INVESTIGATIONS OF ANY SUCH
BREACHES; (3) ANY ATTEMPTS TO NOTIFY ANYONE IMPACTED BY ANY SUCH BREACH
OR WHOSE BIOMETRIC DATA MAY HAVE BEEN UNLAWFULLY ACCESSED; AND (4) ANY
ACTIONS THE AGENCY HAS TAKEN TO ADDRESS ANY BREACHES.
(B) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE
OF THIS SECTION TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE,
THE SPEAKER OF THE ASSEMBLY, THE MINORITY LEADER OF THE SENATE, AND THE
MINORITY LEADER OF THE ASSEMBLY AS WELL AS PUBLISHING SUCH ASSESSMENT TO
THE STATE AGENCY, POLICE AGENCY, OR THE STATE POLICE'S OWN WEB PAGE.
(C) TRANSMIT AN EQUITY IMPACT ASSESSMENT AS DEFINED IN SUBDIVISION ONE
OF THIS SECTION TO THE CIVIL RIGHTS BUREAU OF THE OFFICE OF THE ATTORNEY
GENERAL, WHICH SHALL REVIEW SUCH ASSESSMENT AND MAKE RECOMMENDATIONS OR
TAKE OTHER ACTION AS MAY BE APPROPRIATE WITH RESPECT TO ANY DISPARITY OR
INACCURACY IDENTIFIED IN SUCH ASSESSMENT.
§ 4. This act shall take effect immediately.