* Editor's note: there are two sections designated as § 26-3001.
As used in this chapter, the following terms have the following meanings:
Authentication data. The term "authentication data" means the data generated or collected at the point of authentication in connection with granting a user entry to a smart access building, common area or dwelling unit through such building's smart access system, except that it does not include data generated through or collected by a video or camera system that is used to monitor entrances but not grant entry.
Biometric identifier information. The term "biometric identifier information" means a physiological, biological or behavioral characteristic that is used to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan; (ii) a fingerprint; (iii) a voiceprint; (iv) a scan or record of a palm, hand or face geometry; (v) gait or movement patterns; or (vi) any other similar identifying characteristic.
Dwelling unit. The term "dwelling unit" has the same meaning as in section 27-2004 of the housing maintenance code.
Minor. The term "minor" means a person under the age of 18 years, except a person over the age of 15 years who is married, a parent, serving in the military, or has been found financially independent by a court order.
Multiple dwelling. The term "multiple dwelling" has the same meaning as in section 27-2004 of the housing maintenance code.
Owner. The term "owner" has the same meaning as in section 27-2004 of the housing maintenance code.
Reference data. The term "reference data" means the information against which authentication data is verified at the point of authentication by a smart access system in order to grant a user entry to a smart access building, dwelling unit of such building or a common area of such building.
Smart access building. The term "smart access building" means a class A multiple dwelling, as such term is defined in section 27-2004 of the housing maintenance code, that utilizes a smart access system.
Smart access system. The term "smart access system" means any system that uses electronic or computerized technology, a radio frequency identification card, a mobile phone application, biometric identifier information, or any other digital technology in order to grant entry to a class A multiple dwelling, common areas in such multiple dwelling or to an individual dwelling unit in such multiple dwelling.
Third party. The term "third party" means an entity that installs, operates or otherwise directly supports a smart access system, and has ongoing access to user data, excluding any entity that solely hosts such data.
User. The term "user" means a tenant of a smart access building, and any person a tenant has requested, in writing or through a mobile application, be granted access to such tenant's dwelling unit and such building's smart access system.
(L.L. 2021/063, 5/30/2021, eff. 7/29/2021)
Editor's note: For related unconsolidated provisions, see Appendix A at L.L. 2021/063.
* Editor's note: there are two sections designated as § 26-3002.
a. An owner of a smart access building or third party may not collect reference data from a user for use in a smart access system except where such user has expressly consented, in writing or through a mobile application, to the use of such smart access building's smart access system. Such owner or third party may collect only the minimum amount of authentication data and reference data necessary to enable the use of such smart access system in such building, and may not collect additional biometric identifier information from any users. Such smart access system may only collect, generate or utilize the following information:
1. the user's name;
2. the dwelling unit number and other doors or common areas to which the user has access using such smart access system in such building;
3. the user's preferred method of contact;
4. the user's biometric identifier information if such smart access system utilizes biometric identifier information;
5. the identification card number or any identifier associated with the physical hardware used to facilitate building entry, including radio frequency identification card, bluetooth or other similar technical protocols;
6. passwords, passcodes, user names and contact information used singly or in conjunction with other reference data to grant a user entry to a smart access building, dwelling unit of such building or common area of such building through such building's smart access system, or to access any online tools used to manage user accounts related to such building;
7. lease information, including move-in and, if available, move-out dates; and
8. the time and method of access, solely for security purposes.
b. An owner of a smart access building and any third party shall destroy any authentication data collected from or generated by such smart access system in their possession no later than 90 days after such data has been collected or generated, except for authentication data that is retained in an anonymized format.
c. Reference data for any tenant who has permanently vacated a smart access building shall be removed, or anonymized where removal of such data would render the smart access system inoperable, from the smart access system no later than 90 days after such tenant has permanently vacated such building. Reference data for any user that has been granted access to such tenant's dwelling unit and is not a tenant of such smart access building shall be removed, or anonymized where removal of such data would render the smart access system inoperable, from the smart access system no later than 90 days after access expires. Reference data for any user who has withdrawn authorization from an owner or third party who had previously been given access to such reference data pursuant to subdivision a shall be removed, or anonymized where removal of such data would render the smart access system inoperable, from the smart access system no later than 90 days after such authorization has been withdrawn. The same time frame shall apply when a tenant withdraws a request that a guest be granted access to such tenant's dwelling unit via the smart access system, if such guest is not also a tenant of such smart access building.
d. Reference data collected solely for the operation of such smart access system for a tenant who has permanently vacated a smart access building shall be destroyed no later than 90 days after a tenant has permanently vacated a smart access building or has withdrawn authorization from the owner of such smart access building or a third party. Reference data collected solely for use of such smart access system for any user that has been granted access to such tenant's dwelling unit and is not a tenant of such smart access building shall be destroyed within the same timeframe, following such user's withdrawal of authorization, such tenant's withdrawal of the request that such user be granted access to such tenant's dwelling unit via the smart access system or such tenant's permanent vacation. Any data collected in violation of the prohibitions set forth in paragraphs 3, 4, 5 and 6 of subdivision a of section 26-3003 shall be destroyed immediately.
e. An owner of a smart access building and any third party that has an obligation to destroy data pursuant to this section shall not be required to destroy any data that:
1. is necessary to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity;
2. is necessary to debug to identify and repair errors that impair existing intended functionality;
3. is protected speech under the United States or New York state constitution; or
4. is necessary to comply with another law or legal obligation.
f. Any information that an owner of a multiple dwelling collects about a tenant's use of gas, electricity or any other utility shall be limited to such tenant's total monthly usage, unless otherwise required by law. It shall be unlawful for an owner of a multiple dwelling to collect any information about a tenant's use of internet service, except that in a multiple dwelling in which internet service is provided directly from an owner to tenants, the landlord may collect such information if such information is aggregated and anonymized, or necessary for billing purposes.
g. Notwithstanding the provisions of subdivision a, an owner may retain, separate from the smart access system, a record of the unique identification number or other unique identifier associated with the physical hardware used to facilitate building entry, including key cards or other similar technical protocols, and the dwelling unit number associated with such unique identifier, solely for the purpose of deactivating or activating the key card or other hardware associated with such unique identifier.
h. Notwithstanding any other provision of this section, reference data may be retained and utilized by a smart access system pursuant to a user request, in writing or through a mobile application, that such user's reference data be retained for longer than 90 days.
(L.L. 2021/063, 5/30/2021, eff. 7/29/2021)
Editor's note: For related unconsolidated provisions, see Appendix A at L.L. 2021/063.
Loading...