New York · statute · N.Y. State Technology Law · 43 active provisions
CHAPTER 57-A OF THE CONSOLIDATED LAWS STATE TECHNOLOGY LAW Article Section I Office of Information Technology Services (§§ 101-107) II Internet Security and Privacy Act (§§ 201-210) III Electronic Signatures and Records Act (§§ 301-309) IV Automated employment decision-making in (§§ 401-402-a) state government
ARTICLE I OFFICE OF INFORMATION TECHNOLOGY SERVICES Section 101. Definitions. 102. Office of information technology services; director, organization and employees. 103. Functions, powers and duties of the office. 103-a. State information technology innovation center. 103-b. Gender-neutral terminology; state agencies. 1…
§ 101. Definitions. As used in this article the following terms shall mean: 1. "Council" means the advisory council for technology. 2. "Director" means the director of the office. 3. "Office" means the office of information technology services. 4. "State agency" means any department, board, bureau, commission, division…
§ 102. Office of information technology services; director, organization and employees. 1. The office of information technology services is hereby created within the executive department to have and exercise the functions, powers and duties provided by the provisions of this article and any other provision of law. 2. T…
§ 103. Functions, powers and duties of the office. The office shall have the following functions, powers and duties: 1. To act as the official state planning and coordinating office for the advancement of technology to improve government efficiency and effectiveness, and perform all necessary and appropriate services r…
* § 103-a. State information technology innovation center. 1. The director may establish a state information technology innovation center or "iCenter" to develop, pilot, and consider technology solutions to assist the state, state agencies, authorities, municipalities and other governmental entities find potential solu…
§ 103-b. Gender-neutral terminology; state agencies. Each state agency shall use gender-neutral terminology on their websites for website content, including but not limited to forms accessible through the website, that is created by or on behalf of such agency, or is within their control to modify, provided that such c…
* § 103-c. State agency websites; mobile friendly websites. All state agency websites, as defined in section two hundred two of this chapter, shall offer a mobile friendly form and shall be made available for all mobile devices that support such technology, provided that such requirement shall only apply to websites cr…
* § 103-c. Cloud computing. 1. Each state agency shall, whenever possible and feasible, consider cloud computing solutions in such agency's technology sourcing strategy for future technology initiatives, data storage and management purposes, and upgrades. 2. All state agencies shall, in consultation with the office, ad…
§ 103-d. Website accessibility; state agencies. Each state agency shall, to the extent practicable, conform any of their websites, created or modified with changes to form or function after the effective date of this section, by January first, two thousand twenty-seven, to the most current version of the Web Content Ac…
§ 103-e. Artificial intelligence (AI) inventory. 1. The office shall maintain an inventory of state agency artificial intelligence systems. The office shall issue guidance to state agencies identifying the data elements to be collected and submitted to the office for such inventory, including but not limited to the pur…
§ 103-f. Cybersecurity awareness training. 1. (a) Employees of the state who use technology as a part of their official job duties shall take annual cybersecurity awareness training beginning January first, two thousand twenty-six. Employees of the state shall be required to complete the training provided by the office…
§ 104. Advisory council for technology. 1. There shall be within the office, an advisory council for technology. The director of the office shall serve as chair of the council. The council shall be composed of a minimum of nine information resource management directors or their equivalent appointed by the governor. The…
§ 105. Functions, powers and duties of the council. The council shall have the following functions, powers and duties: 1. To review and comment on all rules and regulations of the office; 2. To provide guidance and support to the office in the development of any statewide plan for the further development and improvemen…
§ 106. Responsibility to respond to the freedom of information law for certain data. Where the office receives a request for another agency's data which is in the possession of the office because it administers, operates or manages a statewide technology program, the office will transmit, within five days, in writing t…
§ 106-a. Health care proxy information. Any state agency, board, bureau, authority, commission, division, or other governmental entity performing a governmental or proprietary function for the state that maintains a public website and has a significant public interaction in the field of public health shall, in consulta…
§ 106-b. Use of biometric identifying technology in schools. 1. As used in this section: a. "biometric identifying technology" shall mean any tool using an automated or semi-automated process that assists in verifying a person's identity based on a person's biometric information. b. "biometric information" shall mean a…
§ 107. Severability. The provisions of this article shall be severable and if any portion thereof or the applicability thereof to any person or circumstances shall be held to be invalid, the remainder of this article and the application thereof shall not be affected thereby.
ARTICLE II INTERNET SECURITY AND PRIVACY ACT Section 201. Short title. 202. Definitions. 203. Model internet privacy policy. 204. Collection and disclosure of personal information. 205. Access to personal information. 206. Exceptions. 207. Construction. 208. Notification; person without valid authorization has acquired…
§ 201. Short title. This article shall be known and may be cited as the "internet security and privacy act".
§ 202. Definitions. As used in this article, the following terms shall have the following meanings: 1. "Collect" shall mean to store information, including via cookie technology, for purposes of retrieval at a later time to initiate communication with or make determinations about the person who is the subject of such i…
§ 203. Model internet privacy policy. 1. The office shall adopt rules and regulations in conformity with the provisions of this article, and specify a model internet privacy policy for state agencies that maintain state agency websites. Such model privacy policy shall include, but not be limited to, the following eleme…
§ 204. Collection and disclosure of personal information. No state agency shall collect personal information concerning a user through a state agency website, or disclose personal information concerning a user to any person, firm, partnership, corporation, limited liability company or other entity, including internal s…
§ 205. Access to personal information. Except as otherwise provided by law, a state agency shall provide users with access to all personal information pertaining to such user which has been collected through its state agency website. Access to such personal information and the opportunity to request correction or amend…
§ 206. Exceptions. Notwithstanding section two hundred four of this article, a state agency may collect or disclose personal information if the collection or disclosure is: 1. necessary to perform the statutory duties of the state agency that collected or is collecting the personal information, or necessary for that ag…