STATE OF NEW YORK ________________________________________________________________________ 7543--B Cal. No. 403 2023-2024 Regular Sessions IN SENATE June 5, 2023 ___________ Introduced by Sens. GONZALEZ, BRISPORT, COMRIE, COONEY, GOUNARDES, HARCKHAM, JACKSON, KRUEGER, LIU, MYRIE, PARKER, SALAZAR, SCARCELLA-SPANTON, SEPULVEDA, THOMAS -- read twice and ordered print- ed, and when printed to be committed to the Committee on Rules -- recommitted to the Committee on Internet and Technology in accordance with Senate Rule 6, sec. 8 -- committee discharged, bill amended, ordered reprinted as amended and recommitted to said committee -- reported favorably from said committee, ordered to first and second report, ordered to a third reading, amended and ordered reprinted, retaining its place in the order of third reading AN ACT to amend the state technology law, in relation to automated deci- sion-making by state agencies The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Short title. This act shall be known and may be cited as 2 the "legislative oversight of automated decision-making in government 3 act (LOADinG Act)". 4 § 2. The state technology law is amended by adding a new article 4 to 5 read as follows: 6 ARTICLE IV 7 AUTOMATED DECISION-MAKING IN STATE GOVERNMENT 8 Section 401. Definitions. 9 402. Use of automated decision-making systems by agencies. 10 403. Impact assessments. 11 404. Submission to the governor and legislature. 12 § 401. Definitions. For the purpose of this article: 13 1. "Automated decision-making system" shall mean any software that 14 uses algorithms, computational models, or artificial intelligence tech- 15 niques, or a combination thereof, to automate, support, or replace human 16 decision-making and shall include, without limitation, systems that 17 process data, and apply predefined rules or machine learning algorithms EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD11734-11-4S. 7543--B 2 1 to analyze such data, and generate conclusions, recommendations, 2 outcomes, assumptions, projections, or predictions without meaningful 3 human discretion. "Automated decision-making system" shall not include 4 any software used primarily for basic computerized processes, such as 5 calculators, spellcheck tools, autocorrect functions, spreadsheets, 6 electronic communications, or any tool that relates only to internal 7 management affairs such as ordering office supplies or processing 8 payments, and that do not materially affect the rights, liberties, bene- 9 fits, safety or welfare of any individual within the state. 10 2. "Meaningful human review" means review, oversight and control of 11 the automated decision-making process by one or more individuals who 12 understand the risks, limitations, and functionality of, and are trained 13 to use, the automated decision-making system and who have the authority 14 to intervene or alter the decision under review, including but not 15 limited to the ability to approve, deny, or modify any decision recom- 16 mended or made by the automated system. 17 3. "State agency" shall mean any department, public authority, board, 18 bureau, commission, division, office, council, committee or officer of 19 the state. Such terms shall not include the legislature or judiciary. 20 4. "Public assistance benefit" shall mean any service or program with- 21 in the control of the state, or benefit provided by the state to indi- 22 viduals or households, including but not limited to public assistance, 23 cash assistance, grants, child care assistance, housing assistance, 24 unemployment benefits, transportation benefits, education assistance, 25 domestic violence services, and any other assistance or benefit within 26 the authority of the state to grant to individuals within the state. 27 This shall not include any federal program that is administered by the 28 federal government or the state. 29 § 402. Use of automated decision-making systems by agencies. 1. No 30 state agency, or any entity acting on behalf of such agency, which 31 utilizes or applies any automated decision-making system, directly or 32 indirectly, in performing any function that: (a) is related to the 33 delivery of any public assistance benefit; (b) will have a material 34 impact on the rights, civil liberties, safety or welfare of any individ- 35 ual within the state; or (c) affects any statutorily or constitutionally 36 provided right of an individual, shall utilize such automated decision- 37 making system, unless such automated decision-making system is subject 38 to continued and operational meaningful human review. 39 2. No state agency shall authorize any procurement, purchase or acqui- 40 sition of any service or system utilizing, or relying on, automated 41 decision-making systems in performing any function that is: (a) related 42 to the delivery of any public assistance benefit; (b) will have a mate- 43 rial impact on the rights, civil liberties, safety or welfare of any 44 individual within the state; or (c) affects any statutorily or constitu- 45 tionally provided right of an individual unless such automated deci- 46 sion-making system is subject to continued and operational meaningful 47 human review. 48 3. The use of an automated decision-making system shall not affect (a) 49 the existing rights of employees pursuant to an existing collective 50 bargaining agreement, or (b) the existing representational relationships 51 among employee organizations or the bargaining relationships between the 52 employer and an employee organization. The use of an automated deci- 53 sion-making system shall not result in the: (1) discharge, displacement 54 or loss of position, including partial displacement such as a reduction 55 in the hours of non-overtime work, wages, or employment benefits, or 56 result in the impairment of existing collective bargaining agreements;S. 7543--B 3 1 (2) transfer of existing duties and functions currently performed by 2 employees of the state or any agency or public authority thereof to an 3 automated decision-making system; or (3) transfer of future duties and 4 functions ordinarily performed by employees of the state or any agency 5 or public authority. The use of an automated decision-making system 6 shall not alter the rights or benefits, and privileges, including but 7 not limited to terms and conditions of employment, civil service status, 8 and collective bargaining unit membership status of all existing employ- 9 ees of the state or any agency or public authority thereof shall be 10 preserved and protected. 11 § 403. Impact assessments. 1. State agencies seeking to utilize or 12 apply an automated decision-making system permitted under section four 13 hundred two of this article with continued and operational meaningful 14 human review shall conduct or have conducted an impact assessment 15 substantially completed and bearing the signature of one or more indi- 16 viduals responsible for meaningful human review for the lawful applica- 17 tion and use of such automated decision-making system. Following the 18 first impact assessment, an impact assessment shall be conducted in 19 accordance with this section at least once every two years. An impact 20 assessment shall be conducted prior to any material change to the auto- 21 mated decision-making system that may change the outcome or effect of 22 such system. Such impact assessments shall include: 23 (a) a description of the objectives of the automated decision-making 24 system; 25 (b) an evaluation of the ability of the automated decision-making 26 system to achieve its stated objectives; 27 (c) a description and evaluation of the objectives and development of 28 the automated decision-making including: 29 (i) a summary of the underlying algorithms, computational modes, and 30 artificial intelligence tools that are used within the automated deci- 31 sion-making system; and 32 (ii) the design and training data used to develop the automated deci- 33 sion-making system process; 34 (d) testing for: 35 (i) accuracy, fairness, bias and discrimination, and an assessment of 36 whether the use of the automated decision-making system produces discri- 37 minatory results on the basis of a consumer's or a class of consumers' 38 actual or perceived race, color, ethnicity, religion, national origin, 39 sex, gender, gender identity, sexual orientation, familial status, biom- 40 etric information, lawful source of income, or disability and outlines 41 mitigations for any identified performance differences in outcomes 42 across relevant groups impacted by such use; 43 (ii) any cybersecurity vulnerabilities and privacy risks resulting 44 from the deployment and use of the automated decision-making system, and 45 the development or existence of safeguards to mitigate the risks; 46 (iii) any public health or safety risks resulting from the deployment 47 and use of the automated decision-making system; 48 (iv) any reasonably foreseeable misuse of the automated decision-mak- 49 ing system and the development or existence of safeguards against such 50 misuse; 51 (e) the extent to which the deployment and use of the automated deci- 52 sion-making system requires input of sensitive and personal data, how 53 that data is used and stored, and any control users may have over their 54 data; and 55 (f) the notification mechanism or procedure, if any, by which individ- 56 uals impacted by the utilization of the automated decision-making systemS. 7543--B 4 1 may be notified of the use of such automated decision-making system and 2 of the individual's personal data, and informed of their rights and 3 options relating to such use. 4 2. Notwithstanding the provisions of this article or any other law, if 5 an impact assessment finds that the automated decision-making system 6 produces discriminatory or biased outcomes, the state agency shall cease 7 any utilization, application, or function of such automated decision- 8 making system, and of any information produced using such system. 9 § 404. Submission to the governor and legislature. 1. Each impact 10 assessment conducted pursuant to this article shall be submitted to the 11 governor, the temporary president of the senate, and the speaker of the 12 assembly at least thirty days prior to the implementation of the auto- 13 mated decision-making system that is the subject of such assessment. 14 2. (a) The impact assessment of an automated decision-making system 15 shall be published on the website of the relevant state agency. 16 (b) If the state agency makes a determination that the disclosure of 17 any information required in the impact assessment would result in a 18 substantial negative impact on health or safety of the public, infringe 19 upon the privacy rights of individuals, or significantly impair the 20 state agency's ability to protect its information technology or opera- 21 tional assets, such state agency may redact such information, provided 22 that an explanatory statement on the process by which the state agency 23 made such determination is published along with the redacted impact 24 assessment. 25 (c) If the impact assessment covers any automated decision-making 26 system that includes technology that is used to prevent, detect, protect 27 against or respond to security incidents, identity theft, fraud, 28 harassment, malicious or deceptive activities or other illegal activity, 29 preserve the integrity or security of systems, or to investigate, 30 report or prosecute those responsible for any such malicious or decep- 31 tive action, such state agency may redact such information for the 32 purposes of this subdivision, provided that an explanatory statement on 33 the process by which the state agency made such determination is 34 published along with the redacted impact assessment. 35 § 3. Disclosure of existing automated decision-making systems. Any 36 state agency, that directly or indirectly, utilizes an automated deci- 37 sion-making system, as defined in section 401 of the state technology 38 law, shall submit to the legislature a disclosure on the use of such 39 system, no later than one year after the effective date of this section. 40 Such disclosure shall include: 41 (a) a description of the automated decision-making system utilized by 42 such agency; 43 (b) a list of any software vendors related to such automated deci- 44 sion-making system; 45 (c) the date that the use of such system began; 46 (d) a summary of the purpose and use of such system, including a 47 description of human decision-making and discretion supported or 48 replaced by the automated decision-making system; 49 (e) whether any impact assessments for the automated decision-making 50 system were conducted and the dates and summaries of the results of such 51 assessments where applicable; and 52 (f) any other information deemed relevant by the agency. 53 § 4. This act shall take effect immediately, provided that section two 54 of this act shall take effect one year after it shall have become a law.