Title STT, State Technology

§ 101. Definitions. As used in this article the following terms shall\nmean:\n 1. "Council" means the advisory council for technology.\n 2. "Director" means the director of the office.\n 3. "Office" means the office of information technology services.\n 4. "State agency" means a…

§ 102. Office of information technology services; director,\norganization and employees. 1. The office of information technology\nservices is hereby created within the executive department to have and\nexercise the functions, powers and duties provided by the provisions of\nthis…

§ 103. Functions, powers and duties of the office. The office shall\nhave the following functions, powers and duties:\n 1. To act as the official state planning and coordinating office for\nthe advancement of technology to improve government efficiency and\neffectiveness, and pe…

* § 103-a. State information technology innovation center. 1. The\ndirector may establish a state information technology innovation center\nor "iCenter" to develop, pilot, and consider technology solutions to\nassist the state, state agencies, authorities, municipalities and oth…

§ 103-b. Gender-neutral terminology; state agencies. Each state agency\nshall use gender-neutral terminology on their websites for website\ncontent, including but not limited to forms accessible through the\nwebsite, that is created by or on behalf of such agency, or is within\n…

* § 103-c. State agency websites; mobile friendly websites. All state\nagency websites, as defined in section two hundred two of this chapter,\nshall offer a mobile friendly form and shall be made available for all\nmobile devices that support such technology, provided that such…

* § 103-c. Cloud computing. 1. Each state agency shall, whenever\npossible and feasible, consider cloud computing solutions in such\nagency's technology sourcing strategy for future technology initiatives,\ndata storage and management purposes, and upgrades.\n 2. All state agenc…

§ 103-d. Website accessibility; state agencies. Each state agency\nshall, to the extent practicable, conform any of their websites, created\nor modified with changes to form or function after the effective date of\nthis section, by January first, two thousand twenty-seven, to th…

§ 103-e. Artificial intelligence (AI) inventory. 1. The office shall\nmaintain an inventory of state agency artificial intelligence systems.\nThe office shall issue guidance to state agencies identifying the data\nelements to be collected and submitted to the office for such inv…

§ 103-f. Cybersecurity awareness training. 1. (a) Employees of the\nstate who use technology as a part of their official job duties shall\ntake annual cybersecurity awareness training beginning January first,\ntwo thousand twenty-six. Employees of the state shall be required to\…

* § 103-f. Automated decision-making tool inventory. 1. The office\nshall maintain an inventory of state automated decision-making tools.\nThe office shall issue guidance to state agencies identifying the data\nelements to be collected and submitted to the office for such invent…

§ 104. Advisory council for technology. 1. There shall be within the\noffice, an advisory council for technology. The director of the office\nshall serve as chair of the council. The council shall be composed of a\nminimum of nine information resource management directors or the…

§ 105. Functions, powers and duties of the council. The council shall\nhave the following functions, powers and duties:\n 1. To review and comment on all rules and regulations of the office;\n 2. To provide guidance and support to the office in the development of\nany statewide …

§ 106. Responsibility to respond to the freedom of information law for\ncertain data. Where the office receives a request for another agency's\ndata which is in the possession of the office because it administers,\noperates or manages a statewide technology program, the office w…

§ 106-a. Health care proxy information. Any state agency, board,\nbureau, authority, commission, division, or other governmental entity\nperforming a governmental or proprietary function for the state that\nmaintains a public website and has a significant public interaction in\n…

§ 106-b. Use of biometric identifying technology in schools. 1. As\nused in this section:\n a. "biometric identifying technology" shall mean any tool using an\nautomated or semi-automated process that assists in verifying a person's\nidentity based on a person's biometric inform…

§ 107. Severability. The provisions of this article shall be severable\nand if any portion thereof or the applicability thereof to any person or\ncircumstances shall be held to be invalid, the remainder of this article\nand the application thereof shall not be affected thereby.\…

§ 201. Short title. This article shall be known and may be cited as\nthe "internet security and privacy act".\n

§ 202. Definitions. As used in this article, the following terms shall\nhave the following meanings:\n 1. "Collect" shall mean to store information, including via cookie\ntechnology, for purposes of retrieval at a later time to initiate\ncommunication with or make determinations…

§ 203. Model internet privacy policy. 1. The office shall adopt rules\nand regulations in conformity with the provisions of this article, and\nspecify a model internet privacy policy for state agencies that maintain\nstate agency websites. Such model privacy policy shall include…

§ 204. Collection and disclosure of personal information. No state\nagency shall collect personal information concerning a user through a\nstate agency website, or disclose personal information concerning a user\nto any person, firm, partnership, corporation, limited liability c…

§ 205. Access to personal information. Except as otherwise provided by\nlaw, a state agency shall provide users with access to all personal\ninformation pertaining to such user which has been collected through its\nstate agency website. Access to such personal information and th…

§ 206. Exceptions. Notwithstanding section two hundred four of this\narticle, a state agency may collect or disclose personal information if\nthe collection or disclosure is:\n 1. necessary to perform the statutory duties of the state agency that\ncollected or is collecting the …

§ 207. Construction. Nothing in this article shall abridge public\naccess to information available or permitted by any other provision or\nrule of law, including without limitation article six of the public\nofficers law. Nothing in this article shall authorize the collection or…

§ 208. Notification; person without valid authorization has acquired\nprivate information. 1. As used in this section, the following terms\nshall have the following meanings:\n (a) "Private information" shall mean either: (i) personal information\nconsisting of any information i…

§ 209. Notification of a breach of the security of the system or a\nbreach of network security; shared data. 1. The office shall, within\ntwenty-four hours of either being notified of or receiving evidence of a\nbreach of the security of the system, or a breach of network securi…

§ 210. Cybersecurity protection. 1. Definitions. For purposes of this\nsection, the following terms shall have the following meanings:\n (a) "Breach of the security of the system" shall have the same meaning\nas such term is defined in section two hundred eight of this article.\…

§ 301. Short title. This article shall be known and may be cited as\nthe "electronic signatures and records act".\n

§ 302. Definitions. For the purpose of this article:\n 1. "Electronic" shall mean of or relating to technology having\nelectrical, digital, magnetic, wireless, optical, electromagnetic, or\nsimilar capabilities.\n 2. "Electronic record" shall mean information, evidencing any act…

§ 303. Electronic facilitator. 1. The office of information technology\nservices shall be the electronic facilitator and administer this\narticle. In addition to the authority, duties and responsibilities set\nforth in article one of this chapter, the electronic facilitator shal…

§ 304. Use of electronic signatures. 1. The electronic facilitator\nshall establish rules and regulations governing the use of electronic\nsignatures and authentication. The electronic facilitator shall not\nestablish rules or regulations that seek to apportion fault or impose o…

§ 305. Use of electronic records. 1. In accordance with rules and\nregulations promulgated by the electronic facilitator, government\nentities are authorized and empowered to produce, receive, accept,\nacquire, record, file, transmit, forward, and store information by use\nof el…

§ 306. Admissibility into evidence. In any legal proceeding where the\nprovisions of the civil practice law and rules are applicable, an\nelectronic record or electronic signature may be admitted into evidence\npursuant to the provisions of article forty-five of the civil practi…

§ 307. Exceptions. This article shall not apply:\n * 1. To any document providing for the disposition of an individual's\nperson or property upon death or incompetence, or appointing a fiduciary\nof an individual's person or property, including, without limitation,\nwills, trust…

§ 308. Personal privacy protection. 1. Any information reported to the\nelectronic facilitator by a government entity in connection with the\nauthorization of an electronic signature shall continue to be withheld\nfrom public disclosure if such information was withheld from publ…

§ 309. Use of electronic records and signatures to be voluntary.\nNothing in this article shall require any entity or person to use an\nelectronic record or an electronic signature unless otherwise provided\nby law.\n

§ 401. Definitions. For the purpose of this article:\n 1. "Automated employment decision-making tool" shall mean any software\nthat uses algorithms, computational models, or artificial intelligence\ntechniques, or a combination thereof, to materially automate or replace\nhuman d…

§ 402. * Disclosure of automated employment decision-making tools used\nby state agencies.\n * NB Effective until July 1, 2028\n * Disclosure of automated employment decision-making tools.\n * NB Effective July 1, 2028\nAny state agency that utilizes an automated employment deci…

* § 402-a. Disclosure of automated employment decision-making tools\nused by covered entities. To the extent feasible, any covered entity\nthat utilizes an automated employment decision-making tool, shall\npublish a list of such automated employment decision-making tools on\nsuc…

* § 501. Definitions. For the purpose of this article:\n 1. "Automated decision-making tool" shall mean any software that uses\nalgorithms, computational models, or artificial intelligence techniques,\nor a combination thereof, to automate, support, or replace human\ndecision-ma…

* § 502. Disclosure of automated decision-making tools by government\nagencies. Any government agency that utilizes an automated\ndecision-making tool, as defined in section five hundred one of this\narticle, shall publish a list of such automated decision-making tools on\nsuch …

* § 503. Impact assessments. 1. Government agencies seeking to utilize\nor apply an automated decision-making tool permitted under section five\nhundred two of this article with continued and operational meaningful\nhuman review shall conduct or have conducted an impact assessme…

* § 504. Submission to the governor and legislature. 1. Each impact\nassessment conducted pursuant to this article shall be submitted to the\ngovernor, the temporary president of the senate, and the speaker of the\nassembly at least thirty days prior to the implementation of the…