2020 New York Laws
EDN - Education
Title 1 - General Provisions
Article 1 - Short Title and Definitions
2-E - Use of Biometric Identifying Technology.

§  2-e.  Use  of  biometric identifying technology. 1. As used in this
  section:
a. "biometric identifying technology" shall mean  any  tool  using  an
  automated or semi-automated process that assists in verifying a person's
  identity based on a person's biometric information.
b.   "biometric  information"  shall  mean  any  measurable  physical,
  physiological or behavioral characteristics that are attributable  to  a
  person, including but not limited to facial characteristics, fingerprint
  characteristics,   hand   characteristics,  eye  characteristics,  vocal
  characteristics, and any other  characteristics  that  can  be  used  to
  identify  a  person  including,  but  are  not limited to: fingerprints;
  handprints; retina and iris patterns; DNA  sequence;  voice;  gait;  and
  facial geometry.
c.  "facial  recognition"  shall  mean  any tool using an automated or
  semi-automated process that assists in uniquely identifying or verifying
  a person by comparing and analyzing patterns based on the person's face.
2. Public and nonpublic elementary and  secondary  schools,  including
  charter  schools,  shall  be  prohibited  from  purchasing  or utilizing
  biometric identifying  technology  for  any  purpose,  including  school
  security,  until  July  first,  two  thousand  twenty-two  or  until the
  commissioner authorizes such purchase  or  utilization  as  provided  in
  subdivision three of this section, whichever occurs later.
3. a. The commissioner shall not authorize the purchase or utilization
  of biometric identifying technology, including but not limited to facial
  recognition  technology,  without  first  issuing  a  report prepared in
  consultation  with  the  department's  chief  privacy  officer,   making
  recommendations as to the circumstances in which the utilization of such
  technology  is  appropriate  in  public  and  nonpublic  elementary  and
  secondary schools, including charter schools, and what restrictions  and
  guidelines  should  be  enacted  to  protect  individual  privacy, civil
  rights, and civil liberty interests. Such report shall  be  made  public
  and  presented  to  the governor, the temporary president of the senate,
  and the speaker of  the  assembly,  and  shall  consider,  evaluate  and
  present recommendations concerning:
i.  the  privacy  implications  of collecting, storing, and/or sharing
  biometric information of students, teachers, school  personnel  and  the
  general public entering a school or school grounds;
ii.   the  potential  impact  of  the  use  of  biometric  identifying
  technology  on  student  civil  liberties  and  student  civil   rights,
  including  the  risks  and  implications  of the technology resulting in
  false facial identifications, and whether  the  risks  of  false  facial
  identifications  differs for different subgroups of individuals based on
  race, national origin, gender, age and  other  factors,  and  any  other
  reasonable accuracy concerns with respect to technology;
iii.  whether,  and  under  what circumstances, such technology may be
  used for school security and the effectiveness  of  such  technology  to
  protect students and school personnel;
iv.  whether,  and  under  what  circumstances  and  in  what  manner,
  information collected may be used by schools and shared  with  students,
  parents   or  guardians,  outside  agencies  including  law  enforcement
  agencies, individuals,  litigants,  the  courts,  and  any  other  third
  parties;
v.  the  length  of  time  biometric  information  may be retained and
  whether, and in what manner, such information  may  be  required  to  be
  permanently destroyed;
vi.  the  risk  of an unauthorized breach of biometric information and
  appropriate consequences therefor;

vii. expected maintenance costs resulting from the storage and use  of
  facial recognition images and other biometric information, including the
  cost  of  appropriately  securing  sensitive  data,  performing required
  updates to protect against an unauthorized breach of data, and potential
  costs associated with an unauthorized breach of data;
viii.  analysis  of other schools and organizations, if any, that have
  implemented  facial   recognition   technology   and   other   biometric
  identifying technology programs;
ix.  the  appropriateness  and  potential  implications  of  using any
  existing databases, including but not limited to, local law  enforcement
  databases, as part of biometric identifying technology;
x.  whether,  and in what manner such biometric identifying technology
  should be assessed and audited, including but  not  limited  to,  vendor
  datasets,  adherence  to  appropriate standards of algorithmic fairness,
  accuracy, and other  performance  metrics,  including  with  respect  to
  subgroups of persons based on race, national origin, gender, and age;
xi.  whether, and in what manner, the use of such technology should be
  disclosed by signs and the like in such schools, as well as communicated
  to parents, guardians, students, and district residents; and
xii. existing legislation, including but not limited to section 2-d of
  this article, that may be implicated by or in  conflict  with  biometric
  technology  to  ensure  the maintenance of records related to the use of
  such technology, protect the privacy interests  of  data  subjects,  and
  avoid any breaches of data.
b.   The  commissioner  shall  consult  with  stakeholders  and  other
  interested parties when preparing such report. The office of information
  technology, the division of criminal justice services,  law  enforcement
  authorities and the state university of New York and the city university
  of  New  York  shall,  to  the  extent practicable, identify and provide
  representatives to the department, at the request of  the  commissioner,
  in order to participate in the development and drafting of such report.
4.  The  commissioner  shall,  via scheduled public hearings and other
  outreach methods, seek feedback from  teachers,  school  administrators,
  parents,  individuals  with expertise in school safety and security, and
  individuals with expertise in data privacy issues  and  student  privacy
  issues,  and  individuals  with  expertise  in  civil  rights  and civil
  liberties prior to making such recommendations.