Int. No. 616

By Council Members Gutiérrez, Ossé, Williams, Restler, Won, Nurse and Sanchez (by request of the Queens Borough President)

A Local Law in relation to requiring an owner of a building to submit registration statements regarding biometric recognition technology utilized on the premises

Be it enacted by the Council as follows:

Section 1. Section 26-3001 of the administrative code of the city of New York is amended to read as follows:

                     § 26-3001 Definitions. As used in this chapter, the following terms have the following meanings:

Authentication data. The term “authentication data” means the data generated or collected at the point of authentication in connection with granting a user entry to a smart access building, common area or dwelling unit through such building’s smart access system, except that it does not include data generated through or collected by a video or camera system that is used to monitor entrances but not grant entry.

Biometric identifier information. The term “biometric identifier information” means a physiological, biological or behavioral characteristic that is used to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan; (ii) a fingerprint; (iii) a voiceprint; (iv) a scan or record of a palm, hand or face geometry; (v) gait or movement patterns; or (vi) any other similar identifying characteristic that can be used alone or in combination with each other, or with other information, to establish individual identity.

Biometric recognition technology. The term “biometric recognition technology” means either or both of the following: (i) a process or system that captures biometric identifier information of an individual or individuals; (ii) a process or system that can assist in verifying or identifying an individual or individuals based on biometric identifier information.

Dwelling unit. The term “dwelling unit” has the same meaning as in section 27-2004 of the housing maintenance code.

Minor. The term “minor” means a person under the age of 18 years, except a person over the age of 15 years who is married, a parent, serving in the military, or has been found financially independent by a court order.

Multiple dwelling. The term “multiple dwelling” has the same meaning as in section 27-2004 of the housing maintenance code.

Owner. The term “owner” has the same meaning as in section 27-2004 of the housing maintenance code.

Reference data. The term “reference data” means the information against which authentication data is verified at the point of authentication by a smart access system in order to grant a user entry to a smart access building, dwelling unit of such building or a common area of such building.

Smart access building. The term “smart access building” means a class A multiple dwelling, as such term is defined in section 27-2004 of the housing maintenance code, that utilizes a smart access system.

Smart access system. The term “smart access system” means any system that uses electronic or computerized technology, a radio frequency identification card, a mobile phone application, biometric identifier information, or any other digital technology in order to grant entry to a class A multiple dwelling, common areas in such multiple dwelling or to an individual dwelling unit in such multiple dwelling.

Third party. The term “third party” means an entity that installs, operates or otherwise directly supports a smart access system, and has ongoing access to user data, excluding any entity that solely hosts such data.

User. The term “user” means a tenant of a smart access building, and any person a tenant has requested, in writing or through a mobile application, be granted access to such tenant’s dwelling unit and such building’s smart access system.

§ 2. Chapter 30 of title 26 of the administrative code of the city of New York is amended by adding a new section 26-3008 to read as follows:

                     § 26-3008 The owner’s obligation to register. a. By January 1, 2024, and annually thereafter, every owner of a smart access building or every owner that implements biometric recognition technology in a commercial or residential property shall submit, to the department, a registration statement. Such registration statement shall include the following information:

(a) the street address of the property, including borough, block and lot number;

(b) whether the property is commercial or residential;

(c) date when each biometric recognition technology was first utilized;

(d) number of units in the building;

(e) number of tenants in the building;

(f) type of each biometric recognition technology used;

(g) the name of the vendor providing each biometric recognition technology;

(h) the purpose for each use of the technology;

(i) list of all public locations where imaging is performed; and

(j) data retention policy for each biometric recognition technology.

b. Penalty. Any owner who fails to register pursuant to subdivision a of this section is liable for a civil penalty of not more than $500 per property unit for the first violation, and not more than $1,000 for each subsequent violation. Such penalties shall be imposed by the department provided that after a notice of failure to register has been issued to a property owner, such owner may cure any resulting first violation by registering within 2 months of the receipt of such notice. Failure to register two months after the first violation shall be considered a subsequent violation.

c. Database. The department shall establish and maintain a publicly searchable database of properties that utilize biometric recognition technology. Updates to such database shall be made no less than 30 days following the annual registration deadline pursuant to subdivision a. Such database shall be made available on the website of the department, shall have the ability to produce reports by query, and shall include, but need not be limited to, the following information for each property:

(1) the location of the property, including the physical address, borough, block and lot number;

(2) the date when each biometric recognition technology was first utilized; and

(3) the type of each biometric recognition technology.

d. Report. No later than one year after the effective date of the local law adding this section, and annually thereafter, the commissioner shall submit to the mayor, and the speaker of the council, a report of the following information, based upon registrations filed during the previous year:

(a) the street address of the property, including borough, block and lot number;

(b) whether the property is commercial or residential;

(c) the date when each biometric recognition technology was first utilized;

(d) number of units in the building;

(e) number of tenants in the building;

(f) the type of each biometric recognition technology used; and

(g) the name of the vendor providing each biometric recognition technology.

e. Notice. Every owner of a smart access building and every owner that implements biometric recognition technology in a commercial or residential property shall annually disclose to every tenant, or prospective tenant, the use of such technology and post the notice in the common areas visible by both tenants and visitors.

§ 3. This local law takes effect 120 days after it becomes law.

Session 12

IB

LS 2470/8804

6/28/2022

Session 11

IB

LS 10489

Int 1672-2019

06/18/19