§ 106-B — Use of biometric identifying technology in schools

§ 106-b. Use of biometric identifying technology in schools. 1. As\nused in this section:\n a. "biometric identifying technology" shall mean any tool using an\nautomated or semi-automated process that assists in verifying a person's\nidentity based on a person's biometric information.\n b. "biometric information" shall mean any measurable physical,\nphysiological or behavioral characteristics that are attributable to a\nperson, including but not limited to facial characteristics, fingerprint\ncharacteristics, hand characteristics, eye characteristics, vocal\ncharacteristics, and any other characteristics that can be used to\nidentify a person including, but are not limited to: fingerprints;\nhandprints; retina and iris patterns; DNA sequence; voice; gait; and\nfacial geometry.\n c. "facial recognition" shall mean any tool using an automated or\nsemi-automated process that assists in uniquely identifying or verifying\na person by comparing and analyzing patterns based on the person's face.\n 2. a. Except as authorized in paragraph b of this subdivision, public\nand nonpublic elementary and secondary schools, including charter\nschools, shall be prohibited from purchasing or utilizing biometric\nidentifying technology for any purpose, including school security, until\nJuly first, two thousand twenty-two or until the commissioner of\neducation authorizes such purchase or utilization as provided in\nsubdivision three of this section, whichever occurs later.\n b. Schools may utilize biometric identifying technology for the\nfollowing purposes: (i) fingerprint identification of prospective school\nemployees where utilized for the purpose of compliance with a provision\nof the education law or the regulations of the commissioner of education\nor (ii) to exclusively identify employees that have consented in writing\nto the use of such technology or in the case of employees represented\nunder article fourteen of the civil service law, where the employee\norganization representing such employee has consented in writing to the\nuse of such technology.\n 3. a. The commissioner of education shall not authorize the purchase\nor utilization of biometric identifying technology, including but not\nlimited to facial recognition technology, without the director first\nissuing a report prepared in consultation with the state education\ndepartment, making recommendations as to the circumstances in which the\nutilization of such technology is appropriate in public and nonpublic\nelementary and secondary schools, including charter schools, and what\nrestrictions and guidelines should be enacted to protect individual\nprivacy, civil rights, and civil liberty interests. Such report shall be\nmade public and presented to the governor, the temporary president of\nthe senate, and the speaker of the assembly, and shall consider,\nevaluate and present recommendations concerning:\n i. the privacy implications of collecting, storing, and/or sharing\nbiometric information of students, teachers, school personnel and the\ngeneral public entering a school or school grounds;\n ii. the potential impact of the use of biometric identifying\ntechnology on student civil liberties and student civil rights,\nincluding the risks and implications of the technology resulting in\nfalse facial identifications, and whether the risks of false facial\nidentifications differs for different subgroups of individuals based on\nrace, national origin, gender, age and other factors, and any other\nreasonable accuracy concerns with respect to technology;\n iii. whether, and under what circumstances, such technology may be\nused for school security and the effectiveness of such technology to\nprotect students and school personnel;\n iv. whether, and under what circumstances and in what manner,\ninformation collected may be used by schools and shared with students,\nparents or guardians, outside agencies including law enforcement\nagencies, individuals, litigants, the courts, and any other third\nparties;\n v. the length of time biometric information may be retained and\nwhether, and in what manner, such information may be required to be\npermanently destroyed;\n vi. the risk of an unauthorized breach of biometric information and\nappropriate consequences therefor;\n vii. expected maintenance costs resulting from the storage and use of\nfacial recognition images and other biometric information, including the\ncost of appropriately securing sensitive data, performing required\nupdates to protect against an unauthorized breach of data, and potential\ncosts associated with an unauthorized breach of data;\n viii. analysis of other schools and organizations, if any, that have\nimplemented facial recognition technology and other biometric\nidentifying technology programs;\n ix. the appropriateness and potential implications of using any\nexisting databases, including but not limited to, local law enforcement\ndatabases, as part of biometric identifying technology;\n x. whether, and in what manner such biometric identifying technology\nshould be assessed and audited, including but not limited to, vendor\ndatasets, adherence to appropriate standards of algorithmic fairness,\naccuracy, and other performance metrics, including with respect to\nsubgroups of persons based on race, national origin, gender, and age;\n xi. whether, and in what manner, the use of such technology should be\ndisclosed by signs and the like in such schools, as well as communicated\nto parents, guardians, students, and district residents; and\n xii. existing legislation, including but not limited to section two-d\nof the education law, that may be implicated by or in conflict with\nbiometric technology to ensure the maintenance of records related to the\nuse of such technology, protect the privacy interests of data subjects,\nand avoid any breaches of data.\n b. The director, in consultation with the commissioner of education,\nshall consult with stakeholders and other interested parties when\npreparing such report. The state education department, the division of\ncriminal justice services, law enforcement authorities and the state\nuniversity of New York and the city university of New York shall, to the\nextent practicable, identify and provide representatives to the office\nof information technology, at the request of the director, in order to\nparticipate in the development and drafting of such report.\n 4. The director shall, via scheduled public hearings and other\noutreach methods, seek feedback from teachers, school administrators,\nparents, individuals with expertise in school safety and security, and\nindividuals with expertise in data privacy issues and student privacy\nissues, and individuals with expertise in civil rights and civil\nliberties prior to making such recommendations.\n