Bill Text: NY A06788 | 2019-2020 | General Assembly | Amended


Bill Title: Prohibits class A multiple dwellings from requiring the use of a smart access system for means of entry for building entrances, common areas, elevators, garage gates, or apartment entry doors; restricts information that may be gathered on lessees, tenants, owners or guests.

Spectrum: Partisan Bill (Democrat 18-0)

Status: (Introduced) 2019-06-17 - reported referred to rules [A06788 Detail]

Download: New_York-2019-A06788-Amended.html



                STATE OF NEW YORK
        ________________________________________________________________________

                                         6788--B

                               2019-2020 Regular Sessions

                   IN ASSEMBLY

                                     March 20, 2019
                                       ___________

        Introduced  by  M.  of A. L. ROSENTHAL, DINOWITZ, SIMON, EPSTEIN, GLICK,
          JAFFEE, GALEF, RIVERA, COLTON, CRESPO, McMAHON, GOTTFRIED, M. G. MILL-
          ER, ABINANTI, FRONTUS, WRIGHT, BLAKE -- read once and referred to  the
          Committee  on  Housing  -- committee discharged, bill amended, ordered
          reprinted as amended and recommitted to said committee -- reported and
          referred to the Committee  on  Codes  --  committee  discharged,  bill
          amended,  ordered reprinted as amended and recommitted to said commit-
          tee

        AN ACT to amend the multiple dwelling law, in relation to limitations on
          smart access systems for entry and restricts information that  may  be
          gathered from such systems

          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:

     1    Section 1. The multiple dwelling  law  is  amended  by  adding  a  new
     2  section 50-b to read as follows:
     3    § 50-b. Entrances;  keys  and electronic or computerized entry system.
     4  1. Consistent with the provisions of this title, for every entrance from
     5  the street, passageway, court, yard, cellar, or similar  entrance  to  a
     6  class A multiple dwelling, a tenant, at their request, shall be provided
     7  with a key at no charge that does not rely on an electronic or computer-
     8  ized entry system to facilitate entrance to such multiple dwelling.
     9    2.  Data  collection.  a.  Electronic  and/or computerized data. If an
    10  electronic and/or computerized entry system is utilized to gain entrance
    11  to a class A multiple dwelling, the only  information  gathered  by  any
    12  electronic  and/or  computerized  entry  system  shall be limited to the
    13  lessee or tenant's name and apartment number, and the  preferred  method
    14  of  contact  for  such lessee or tenant. For electronic and computerized
    15  entry systems that rely on the collection of biometric  data  and  which
    16  have  already  been installed at the time this section shall have become
    17  law, a biometric identifier may be collected pursuant to this section in
    18  order to register a lessee or tenant for an electronic and/or  computer-

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD10358-10-9

        A. 6788--B                          2

     1  ized  entry system.  No new electronic and/or computerized entry systems
     2  that rely on the collection of biometric  data  shall  be  installed  in
     3  class  A  multiple dwellings for three years after the effective date of
     4  this section.
     5    (i)  The  owner  of the multiple dwelling may collect only the minimum
     6  data required by the technology used in the electronic and/or  computer-
     7  ized entry system to effectuate such entrance and protect the privacy of
     8  such tenants.
     9    (ii) A copy of such data may be retained for reference at the point of
    10  authentication  by the electronic and/or computerized entry system. Such
    11  reference data may be retained only for tenants or those  authorized  by
    12  the tenant.
    13    (iii) The owner of the multiple dwelling shall destroy the electronic,
    14  physical, and/or computerized data collected, except for reference data,
    15  within  a reasonable time, but not later than thirty days after the date
    16  collected.
    17    (iv) Reference data for a tenant or those authorized by a tenant shall
    18  be destroyed within thirty days of (1) the tenant  permanently  vacating
    19  the  dwelling,  or (2) a request by the tenant to withdraw authorization
    20  for those previously authorized by the tenant.
    21    b. Biometric identifier. (i) For the purposes of this section, "biome-
    22  tric identifier" means a retina or iris scan,  fingerprint,  voiceprint,
    23  or record of hand, face geometry or other similar feature.
    24    (ii) An entity may not capture a biometric identifier of an individual
    25  to  gain  entrance to a class A multiple dwelling unless the person is a
    26  tenant or person authorized by the tenant, and  informs  the  individual
    27  before  capturing  the  biometric identifier; and receives their express
    28  consent to capture the biometric identifier.
    29    (iii) Any entity that possesses a biometric identifier of an  individ-
    30  ual that is captured to gain entrance to a class A multiple dwelling:
    31    (1) May not sell, lease or otherwise disclose the biometric identifier
    32  to  another  person  unless  pursuant  to a grand jury subpoena or court
    33  ordered warrant, subpoena, or other authorized court ordered process.
    34    (2) Shall store, transmit and protect from  disclosure  the  biometric
    35  identifier  using reasonable care and in a manner that is the same as or
    36  more protective than the manner in which the  person  stores,  transmits
    37  and protects confidential information the person possesses; and
    38    (3)  Shall  destroy the biometric identifier within a reasonable time,
    39  but not later than forty-eight hours after the  date  collected,  except
    40  for reference data.  If any prohibited information is collected, such as
    41  the  likeness  of  a  minor  or  a  non-tenant, the information shall be
    42  destroyed immediately.
    43    c. Policy. The owner of the multiple dwelling, or the managing  agent,
    44  must  develop  written procedures which describe the process used to add
    45  persons authorized by the tenant to electronic and/or computerized entry
    46  systems on a temporary or permanent basis, such as  visitors,  children,
    47  their employees, and caregivers to such building.
    48    (i) The procedures must clearly establish the owner's retention sched-
    49  ule and guidelines for permanently destroying the data collected.
    50    (ii)  The  procedures  cannot  limit time or place of entrance by such
    51  people authorized by the tenant.
    52    3. Prohibitions. a. No form of location tracking,  including  but  not
    53  limited  to  satellite location based services, shall be included in any
    54  equipment, key, or software provided to tenants or guests as part of  an
    55  electronic and/or computerized entry system.

        A. 6788--B                          3

     1    b.  It  shall  be  prohibited  to collect through an electronic and/or
     2  computerized entry system the likeness of a minor occupant,  information
     3  on  the  relationship  status  of  tenants,  lessees  and/or guests, the
     4  frequency of the use of the electronic and/or computerized entry  system
     5  by  a  lessee,  tenant or guest, or the frequency, time and use of guest
     6  access codes.
     7    c. Information that is acquired via the use of  an  electronic  and/or
     8  computerized  entry system shall not be used for any purposes other than
     9  monitoring building entrances and shall not be  used  as  the  basis  or
    10  support  for an action to evict a lessee or tenant, or an administrative
    11  hearing seeking a change in regulatory coverage  for  an  individual  or
    12  unit.  However, a tenant may authorize their information to be used by a
    13  third  party, but such a request must clearly state who will have access
    14  to such information, for what purpose it will be used, and  the  privacy
    15  policies  which  will  protect their information. Under no circumstances
    16  may a lease or a renewal be contingent upon authorizing such use.  Elec-
    17  tronic  and/or  computerized systems may use third-party services to the
    18  extent required to maintain and operate system infrastructure, including
    19  cloud-based hosting and storage. The provider or providers of third-par-
    20  ty infrastructure services must meet or exceed the  privacy  protections
    21  set  forth in this section and will be subject to the same liability for
    22  breach of any of the requirements of this section.
    23    d. Information and data collected shall not be made available  to  any
    24  third  party,  unless  authorized  as described above, including but not
    25  limited to law enforcement, except upon a grand jury subpoena or a court
    26  ordered warrant, subpoena, or other authorized court ordered process.
    27    4. Storage of information. Any information or data collected shall  be
    28  stored in a secure manner to prevent unauthorized access by both employ-
    29  ees  and  contractors  and those unaffiliated with the landlord or their
    30  agents, except as otherwise provided in this section. Future or continu-
    31  ing tenancy shall not be conditioned upon consenting to the  use  of  an
    32  electronic and/or computerized entry system.
    33    5.  Waiver  of  rights; void. Any agreement by a lessee or tenant of a
    34  dwelling waiving or modifying his or her rights as  set  forth  in  this
    35  section shall be void as contrary to public policy.
    36    6. Penalties. A person who violates this section is subject to a civil
    37  penalty  of  not more than five thousand dollars for each violation. The
    38  attorney general may bring an action to recover the  civil  penalty.  An
    39  individual injured by a violation of this section may bring an action to
    40  recover  damages. A court may also award attorneys' fees to a prevailing
    41  plaintiff.
    42    7. Exemption. Nothing herein shall apply to multiple  dwellings  owned
    43  or  managed  by an entity subject to 42 U.S.C. § 1437 et seq., or any of
    44  its subsidiaries.
    45    § 2. Severability. If any provision of this act, or any application of
    46  any provision of this act, is held to be invalid, that shall not  affect
    47  the  validity or effectiveness of any other provision of this act, or of
    48  any other application of any provision of this act, which can  be  given
    49  effect  without  that  provision  or  application;  and to that end, the
    50  provisions and applications of this act are severable.
    51    § 3. This act shall take effect immediately.
feedback