STATE OF NEW YORK
        ________________________________________________________________________

                                         6787--B

                               2019-2020 Regular Sessions

                   IN ASSEMBLY

                                     March 20, 2019
                                       ___________

        Introduced  by  M.  of A. WALLACE, EPSTEIN, MOSLEY, M. G. MILLER, SIMON,
          GOTTFRIED, L. ROSENTHAL -- Multi-Sponsored by -- M. of A.  BRAUNSTEIN,
          DE LA ROSA  -- read once and referred to the Committee on Education --
          committee discharged, bill amended, ordered reprinted as  amended  and
          recommitted  to  said  committee -- again reported from said committee
          with amendments, ordered reprinted as amended and recommitted to  said
          committee

        AN  ACT  to amend the education law, in relation to the use of biometric
          identifying technology

          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:

     1    Section 1. The education law is amended by adding a new section 2-e to
     2  read as follows:
     3    §  2-e.  Use  of  biometric identifying technology. 1. As used in this
     4  section:
     5    a. "biometric identifying technology" shall mean  any  computer  soft-
     6  ware, algorithm, product, or application that collects or electronically
     7  analyzes  biometric information for the purposes of identifying an indi-
     8  vidual.
     9    b. "biometric information"  shall  mean  any  measurable  physical  or
    10  behavioral  characteristics  that  are  attributable  to  an  individual
    11  person, including but not limited to facial characteristics, fingerprint
    12  characteristics, hand characteristics, eye characteristics, vocal  char-
    13  acteristics,  and any other physical characteristics that can be used to
    14  identify a person including, but are not limited to: fingerprints; hand-
    15  prints; retina and iris patterns; DNA sequence; voice; gait; and  facial
    16  geometry.
    17    c.  "facial  recognition" shall mean a biometric application or biome-
    18  tric identifying technology capable of uniquely identifying or verifying
    19  a person by comparing and  analyzing  patterns  based  on  the  person's
    20  facial contours.

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD10753-05-9

        A. 6787--B                          2

     1    2.  a. On or before the first of December two thousand twenty-one, the
     2  commissioner, in consultation with the department's chief privacy  offi-
     3  cer,  shall  study  and  make recommendations to the governor, temporary
     4  president of the senate and speaker of the assembly on whether biometric
     5  identifying technology, including but not limited to facial recognition,
     6  is  appropriate for use in public and nonpublic elementary and secondary
     7  schools, including charter schools, and if  so,  what  restrictions  and
     8  guidelines  should  be  enacted to protect individual privacy interests.
     9  The commissioner shall consider,  evaluate  and  report  recommendations
    10  concerning:
    11    i. the privacy implications of collecting, storing, and sharing biome-
    12  tric data of students, teachers, school personnel and the general public
    13  entering a school or school grounds;
    14    ii.  the probability of the technology resulting in false facial iden-
    15  tifications and whether the probability of false facial  identifications
    16  differs  for  different  classifications  of  individuals based on race,
    17  national origin, gender, age and other factors;
    18    iii. whether, and under what circumstances,  such  technology  may  be
    19  used  for  school  security  and the effectiveness of such technology to
    20  protect students and school personnel;
    21    iv. whether, and under what circumstances and in what manner, informa-
    22  tion collected may be used by schools and shared with students,  parents
    23  or guardians, outside agencies including law enforcement agencies, indi-
    24  viduals, litigants, and the courts;
    25    v. the length of time biometric information may be retained and wheth-
    26  er,  and  in  what manner, such information may be required to be perma-
    27  nently destroyed;
    28    vi. the risk of an unauthorized breach of  databanked  biometric  data
    29  and appropriate consequences therefor;
    30    vii.  expected maintenance costs resulting from the storage and use of
    31  facial recognition images and other biometric information, including the
    32  cost of  appropriately  securing  sensitive  data,  performing  required
    33  updates to protect against an unauthorized breach of data, and potential
    34  costs associated with an unauthorized breach of data;
    35    viii.  analysis  of other schools and organizations, if any, that have
    36  implemented facial recognition and other biometric information  software
    37  programs;
    38    ix.  whether, and in what manner, the use of such technology should be
    39  disclosed by signs and the like in such schools, as well as communicated
    40  to parents, students and district residents; and
    41    x. legislation that may already exist, be needed or need to be amended
    42  to ensure, among other things, that records of the use of such technolo-
    43  gy are kept, privacy interests of data subjects are protected, and  that
    44  data breaches are avoided.
    45    b.  The  commissioner shall consult with stakeholders and other inter-
    46  ested parties when preparing such  report.  The  office  of  information
    47  technology,  the  division of criminal justice services, law enforcement
    48  authorities and the state university of New York and the city university
    49  of New York shall, to  the  extent  practicable,  identify  and  provide
    50  representatives  to  the department, at the request of the commissioner,
    51  in order to participate in the development and drafting of such report.
    52    3. The commissioner shall, via scheduled  public  hearings  and  other
    53  outreach  methods,  seek  feedback from teachers, school administrators,
    54  parents, individuals with expertise in school safety and  security,  and
    55  individuals  with  expertise  in data privacy issues and student privacy
    56  issues prior to making such recommendations.

        A. 6787--B                          3

     1    4.  Public and nonpublic elementary and secondary  schools,  including
     2  charter schools, shall be prohibited from purchasing and utilizing biom-
     3  etric identifying technology for any purpose, including school security,
     4  until July 1, 2022.
     5    § 2. This act shall take effect immediately.