Title STT, State Technology

§ 101. Definitions. As used in this article the following terms shall mean: 1. "Council" means the advisory council for technology. 2. "Director" means the director of the office. 3. "Office" means the office of information technology services. 4. "State agency" means any depart…

§ 102. Office of information technology services; director, organization and employees. 1. The office of information technology services is hereby created within the executive department to have and exercise the functions, powers and duties provided by the provisions of this art…

§ 103. Functions, powers and duties of the office. The office shall have the following functions, powers and duties: 1. To act as the official state planning and coordinating office for the advancement of technology to improve government efficiency and effectiveness, and perform…

* § 103-a. State information technology innovation center. 1. The director may establish a state information technology innovation center or "iCenter" to develop, pilot, and consider technology solutions to assist the state, state agencies, authorities, municipalities and other …

§ 103-b. Gender-neutral terminology; state agencies. Each state agency shall use gender-neutral terminology on their websites for website content, including but not limited to forms accessible through the website, that is created by or on behalf of such agency, or is within thei…

* § 103-c. State agency websites; mobile friendly websites. All state agency websites, as defined in section two hundred two of this chapter, shall offer a mobile friendly form and shall be made available for all mobile devices that support such technology, provided that such re…

* § 103-c. Cloud computing. 1. Each state agency shall, whenever possible and feasible, consider cloud computing solutions in such agency's technology sourcing strategy for future technology initiatives, data storage and management purposes, and upgrades. 2. All state agencies s…

§ 103-d. Website accessibility; state agencies. Each state agency shall, to the extent practicable, conform any of their websites, created or modified with changes to form or function after the effective date of this section, by January first, two thousand twenty-seven, to the m…

§ 103-e. Artificial intelligence (AI) inventory. 1. The office shall maintain an inventory of state agency artificial intelligence systems. The office shall issue guidance to state agencies identifying the data elements to be collected and submitted to the office for such invent…

§ 103-f. Cybersecurity awareness training. 1. (a) Employees of the state who use technology as a part of their official job duties shall take annual cybersecurity awareness training beginning January first, two thousand twenty-six. Employees of the state shall be required to com…

* § 103-f. Automated decision-making tool inventory. 1. The office shall maintain an inventory of state automated decision-making tools. The office shall issue guidance to state agencies identifying the data elements to be collected and submitted to the office for such inventory…

§ 104. Advisory council for technology. 1. There shall be within the office, an advisory council for technology. The director of the office shall serve as chair of the council. The council shall be composed of a minimum of nine information resource management directors or their …

§ 105. Functions, powers and duties of the council. The council shall have the following functions, powers and duties: 1. To review and comment on all rules and regulations of the office; 2. To provide guidance and support to the office in the development of any statewide plan f…

§ 106. Responsibility to respond to the freedom of information law for certain data. Where the office receives a request for another agency's data which is in the possession of the office because it administers, operates or manages a statewide technology program, the office will…

§ 106-a. Health care proxy information. Any state agency, board, bureau, authority, commission, division, or other governmental entity performing a governmental or proprietary function for the state that maintains a public website and has a significant public interaction in the …

§ 106-b. Use of biometric identifying technology in schools. 1. As used in this section: a. "biometric identifying technology" shall mean any tool using an automated or semi-automated process that assists in verifying a person's identity based on a person's biometric information…

§ 107. Severability. The provisions of this article shall be severable and if any portion thereof or the applicability thereof to any person or circumstances shall be held to be invalid, the remainder of this article and the application thereof shall not be affected thereby.

§ 201. Short title. This article shall be known and may be cited as the "internet security and privacy act".

§ 202. Definitions. As used in this article, the following terms shall have the following meanings: 1. "Collect" shall mean to store information, including via cookie technology, for purposes of retrieval at a later time to initiate communication with or make determinations abou…

§ 203. Model internet privacy policy. 1. The office shall adopt rules and regulations in conformity with the provisions of this article, and specify a model internet privacy policy for state agencies that maintain state agency websites. Such model privacy policy shall include, b…

§ 204. Collection and disclosure of personal information. No state agency shall collect personal information concerning a user through a state agency website, or disclose personal information concerning a user to any person, firm, partnership, corporation, limited liability comp…

§ 205. Access to personal information. Except as otherwise provided by law, a state agency shall provide users with access to all personal information pertaining to such user which has been collected through its state agency website. Access to such personal information and the o…

§ 206. Exceptions. Notwithstanding section two hundred four of this article, a state agency may collect or disclose personal information if the collection or disclosure is: 1. necessary to perform the statutory duties of the state agency that collected or is collecting the perso…

§ 207. Construction. Nothing in this article shall abridge public access to information available or permitted by any other provision or rule of law, including without limitation article six of the public officers law. Nothing in this article shall authorize the collection or di…

§ 208. Notification; person without valid authorization has acquired private information. 1. As used in this section, the following terms shall have the following meanings: (a) "Private information" shall mean either: (i) personal information consisting of any information in com…

§ 209. Notification of a breach of the security of the system or a breach of network security; shared data. 1. The office shall, within twenty-four hours of either being notified of or receiving evidence of a breach of the security of the system, or a breach of network security,…

§ 210. Cybersecurity protection. 1. Definitions. For purposes of this section, the following terms shall have the following meanings: (a) "Breach of the security of the system" shall have the same meaning as such term is defined in section two hundred eight of this article. (b) …

§ 301. Short title. This article shall be known and may be cited as the "electronic signatures and records act".

§ 302. Definitions. For the purpose of this article: 1. "Electronic" shall mean of or relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities. 2. "Electronic record" shall mean information, evidencing any act, tran…

§ 303. Electronic facilitator. 1. The office of information technology services shall be the electronic facilitator and administer this article. In addition to the authority, duties and responsibilities set forth in article one of this chapter, the electronic facilitator shall h…

§ 304. Use of electronic signatures. 1. The electronic facilitator shall establish rules and regulations governing the use of electronic signatures and authentication. The electronic facilitator shall not establish rules or regulations that seek to apportion fault or impose or l…

§ 305. Use of electronic records. 1. In accordance with rules and regulations promulgated by the electronic facilitator, government entities are authorized and empowered to produce, receive, accept, acquire, record, file, transmit, forward, and store information by use of electr…

§ 306. Admissibility into evidence. In any legal proceeding where the provisions of the civil practice law and rules are applicable, an electronic record or electronic signature may be admitted into evidence pursuant to the provisions of article forty-five of the civil practice …

§ 307. Exceptions. This article shall not apply: * 1. To any document providing for the disposition of an individual's person or property upon death or incompetence, or appointing a fiduciary of an individual's person or property, including, without limitation, wills, trusts, de…

§ 308. Personal privacy protection. 1. Any information reported to the electronic facilitator by a government entity in connection with the authorization of an electronic signature shall continue to be withheld from public disclosure if such information was withheld from public …

§ 309. Use of electronic records and signatures to be voluntary. Nothing in this article shall require any entity or person to use an electronic record or an electronic signature unless otherwise provided by law.

§ 401. Definitions. For the purpose of this article: 1. "Automated employment decision-making tool" shall mean any software that uses algorithms, computational models, or artificial intelligence techniques, or a combination thereof, to materially automate or replace human decisi…

§ 402. * Disclosure of automated employment decision-making tools used by state agencies. * NB Effective until July 1, 2028 * Disclosure of automated employment decision-making tools. * NB Effective July 1, 2028 Any state agency that utilizes an automated employment decision-mak…

* § 402-a. Disclosure of automated employment decision-making tools used by covered entities. To the extent feasible, any covered entity that utilizes an automated employment decision-making tool, shall publish a list of such automated employment decision-making tools on such co…

* § 501. Definitions. For the purpose of this article: 1. "Automated decision-making tool" shall mean any software that uses algorithms, computational models, or artificial intelligence techniques, or a combination thereof, to automate, support, or replace human decision-making.…

* § 502. Disclosure of automated decision-making tools by government agencies. Any government agency that utilizes an automated decision-making tool, as defined in section five hundred one of this article, shall publish a list of such automated decision-making tools on such gove…

* § 503. Impact assessments. 1. Government agencies seeking to utilize or apply an automated decision-making tool permitted under section five hundred two of this article with continued and operational meaningful human review shall conduct or have conducted an impact assessment …

* § 504. Submission to the governor and legislature. 1. Each impact assessment conducted pursuant to this article shall be submitted to the governor, the temporary president of the senate, and the speaker of the assembly at least thirty days prior to the implementation of the au…