2023 New York Laws › STT - State Technology › Article 1 - Office of Information Technology Services › 106-B - Use of Biometric Identifying Technology in Schools.

§  106-b.  Use  of  biometric identifying technology in schools. 1. As
  used in this section:
a. "biometric identifying technology" shall mean  any  tool  using  an
  automated or semi-automated process that assists in verifying a person's
  identity based on a person's biometric information.
b.   "biometric  information"  shall  mean  any  measurable  physical,
  physiological or behavioral characteristics that are attributable  to  a
  person, including but not limited to facial characteristics, fingerprint
  characteristics,   hand   characteristics,  eye  characteristics,  vocal
  characteristics, and any other  characteristics  that  can  be  used  to
  identify  a  person  including,  but  are  not limited to: fingerprints;
  handprints; retina and iris patterns; DNA  sequence;  voice;  gait;  and
  facial geometry.
c.  "facial  recognition"  shall  mean  any tool using an automated or
  semi-automated process that assists in uniquely identifying or verifying
  a person by comparing and analyzing patterns based on the person's face.
2. a. Except as authorized in paragraph b of this subdivision,  public
  and  nonpublic  elementary  and  secondary  schools,  including  charter
  schools, shall be prohibited  from  purchasing  or  utilizing  biometric
  identifying technology for any purpose, including school security, until
  July  first,  two  thousand  twenty-two  or  until  the  commissioner of
  education  authorizes  such  purchase  or  utilization  as  provided  in
  subdivision three of this section, whichever occurs later.
b.  Schools  may  utilize  biometric  identifying  technology  for the
  following purposes: (i) fingerprint identification of prospective school
  employees where utilized for the purpose of compliance with a  provision
  of the education law or the regulations of the commissioner of education
  or (ii) to exclusively identify employees that have consented in writing
  to  the  use  of such technology or in the case of employees represented
  under article fourteen of the civil  service  law,  where  the  employee
  organization  representing such employee has consented in writing to the
  use of such technology.
3. a. The commissioner of education shall not authorize  the  purchase
  or  utilization  of  biometric identifying technology, including but not
  limited to facial recognition technology,  without  the  director  first
  issuing  a  report  prepared  in  consultation  with the state education
  department, making recommendations as to the circumstances in which  the
  utilization  of  such  technology is appropriate in public and nonpublic
  elementary and secondary schools, including charter  schools,  and  what
  restrictions  and  guidelines  should  be  enacted to protect individual
  privacy, civil rights, and civil liberty interests. Such report shall be
  made public and presented to the governor, the  temporary  president  of
  the  senate,  and  the  speaker  of  the  assembly,  and shall consider,
  evaluate and present recommendations concerning:
i. the privacy implications of  collecting,  storing,  and/or  sharing
  biometric  information  of  students, teachers, school personnel and the
  general public entering a school or school grounds;
ii.  the  potential  impact  of  the  use  of  biometric   identifying
  technology   on  student  civil  liberties  and  student  civil  rights,
  including the risks and implications  of  the  technology  resulting  in
  false  facial  identifications,  and  whether  the risks of false facial
  identifications differs for different subgroups of individuals based  on
  race,  national  origin,  gender,  age  and other factors, and any other
  reasonable accuracy concerns with respect to technology;
iii. whether, and under what circumstances,  such  technology  may  be
  used  for  school  security  and the effectiveness of such technology to
  protect students and school personnel;
iv.  whether,  and  under  what  circumstances  and  in  what  manner,
  information  collected  may be used by schools and shared with students,
  parents  or  guardians,  outside  agencies  including  law   enforcement
  agencies,  individuals,  litigants,  the  courts,  and  any  other third
  parties;
v.  the  length  of  time  biometric  information  may be retained and
  whether, and in what manner, such information  may  be  required  to  be
  permanently destroyed;
vi.  the  risk  of an unauthorized breach of biometric information and
  appropriate consequences therefor;
vii. expected maintenance costs resulting from the storage and use  of
  facial recognition images and other biometric information, including the
  cost  of  appropriately  securing  sensitive  data,  performing required
  updates to protect against an unauthorized breach of data, and potential
  costs associated with an unauthorized breach of data;
viii. analysis of other schools and organizations, if any,  that  have
  implemented   facial   recognition   technology   and   other  biometric
  identifying technology programs;
ix. the  appropriateness  and  potential  implications  of  using  any
  existing  databases, including but not limited to, local law enforcement
  databases, as part of biometric identifying technology;
x. whether, and in what manner such biometric  identifying  technology
  should  be  assessed  and  audited, including but not limited to, vendor
  datasets, adherence to appropriate standards  of  algorithmic  fairness,
  accuracy,  and  other  performance  metrics,  including  with respect to
  subgroups of persons based on race, national origin, gender, and age;
xi. whether, and in what manner, the use of such technology should  be
  disclosed by signs and the like in such schools, as well as communicated
  to parents, guardians, students, and district residents; and
xii.  existing legislation, including but not limited to section two-d
  of the education law, that may be implicated  by  or  in  conflict  with
  biometric technology to ensure the maintenance of records related to the
  use  of such technology, protect the privacy interests of data subjects,
  and avoid any breaches of data.
b. The director, in consultation with the commissioner  of  education,
  shall  consult  with  stakeholders  and  other  interested  parties when
  preparing such report. The state education department, the  division  of
  criminal  justice  services,  law  enforcement authorities and the state
  university of New York and the city university of New York shall, to the
  extent practicable, identify and provide representatives to  the  office
  of  information  technology, at the request of the director, in order to
  participate in the development and drafting of such report.
4. The  director  shall,  via  scheduled  public  hearings  and  other
  outreach  methods,  seek  feedback from teachers, school administrators,
  parents, individuals with expertise in school safety and  security,  and
  individuals  with  expertise  in data privacy issues and student privacy
  issues, and  individuals  with  expertise  in  civil  rights  and  civil
  liberties prior to making such recommendations.