STATE OF NEW YORK ________________________________________________________________________ 8209 IN SENATE January 12, 2024 ___________ Introduced by Sen. COONEY -- read twice and ordered printed, and when printed to be committed to the Committee on Internet and Technology AN ACT to amend the state technology law, in relation to enacting the New York artificial intelligence bill of rights The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Short title. This act shall be known and may be cited as 2 the "New York artificial intelligence bill of rights". 3 § 2. Legislative intent. This legislature hereby finds that this 4 generation of humans is the first in history to have the ability to 5 create technologies that can make decisions which previously could have 6 only been made by humans. States and countries across the world are 7 grappling with critical questions of how we can use these technologies 8 to solve our problems, how we can avoid or manage the new problems that 9 these technologies may create, and how we can control these powerful 10 technologies. 11 Therefore, the legislature declares that any New York resident 12 affected by any system making decisions without human intervention be 13 entitled to certain rights and protections to ensure that the system 14 impacting their lives do so lawfully, properly, and with meaningful 15 oversight. 16 Among these rights and protections are (i) the right to safe and 17 effective systems; (ii) protections against algorithmic discrimination; 18 (iii) protections against abusive data practices; (iv) the right to have 19 agency over one's data; (v) the right to know when an automated system 20 is being used; (vi) the right to understand how and why an automated 21 system contributed to outcomes that impact one; (vii) the right to opt 22 out of an automated system; and (viii) the right to work with a human in 23 the place of an automated system. 24 The legislature also finds that automated systems will continue to be 25 developed and evolve both within the state and outside the state. It is 26 therefore critical that New York does not overburden the development of 27 innovative systems that better the state and its residents, nor drive 28 the development of such systems to foreign states or countries with less EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD13117-01-3S. 8209 2 1 appropriate regulation, nor threaten the security of our state, country, 2 and its people. 3 To these ends, the legislature declares that the white paper published 4 by the White House Office of Science and Technology titled "Blueprint 5 for an AI Bill of Rights" in October of 2022 is commensurate with the 6 goals of this state in relation to artificial intelligence. 7 § 3. The state technology law is amended by adding a new article IV to 8 read as follows: 9 ARTICLE IV 10 ARTIFICIAL INTELLIGENCE BILL OF RIGHTS 11 Section 401. Definitions. 12 402. Application. 13 403. Construction. 14 404. Safe and effective systems. 15 405. Algorithmic discrimination practices. 16 406. Data privacy. 17 407. Notice and explanation. 18 408. Human alternatives, consideration, and fallback. 19 409. Penalties; no private cause of action. 20 § 401. Definitions. As used in this article, the following terms shall 21 have the following meanings: 22 1. "Civil rights, civil liberties, and privacy" or "rights, opportu- 23 nity, and access" means such rights and protections provided for in the 24 United States Constitution, federal law, the laws and constitution of 25 the state of New York, and privacy and other freedoms that exist in both 26 the public and private sector contexts, which shall include, but shall 27 not be limited to: 28 (a) freedom of speech; 29 (b) voting rights; 30 (c) protections from discrimination; 31 (d) protections from excessive or unjust punishment; and 32 (e) protections from unlawful surveillance. 33 2. "Equal opportunity" means equal access to education, housing, cred- 34 it, employment, and other programs. 35 3. "Access to critical resources or services" means such resources and 36 services that are fundamental for the well-being, security, and equita- 37 ble participation of New York residents in society, which shall include, 38 but shall not be limited to: 39 (a) healthcare; 40 (b) financial services; 41 (c) safety; 42 (d) social services; 43 (e) non-deceptive information about goods and services; and 44 (f) government benefits. 45 4. "Algorithmic discrimination" means circumstances where an automated 46 system contributes to an unjustified different treatment or impact which 47 disfavors people based on their age, color, creed, disability, domestic 48 violence victim status, gender identity or expression, familial status, 49 marital status, military status, national origin, predisposing genetic 50 characteristics, pregnancy-related condition, prior arrest or conviction 51 record, race, sex, sexual orientation, or veteran status or any other 52 classification protected by law. 53 5. "Automated system" means any system, software, or process that 54 affects New York residents and that uses computation as a whole or part 55 of a system to determine outcomes, make or aid decisions, inform policyS. 8209 3 1 implementation, collect data or observations, or otherwise interact with 2 New York residents or communities. Automated systems shall include, but 3 not be limited to, systems derived from machine learning, statistics, or 4 other data processing or artificial intelligence techniques, and shall 5 exclude passive computing infrastructure. 6 6. "Passive computing infrastructure" shall include any intermediary 7 technology that does not influence or determine the outcome of deci- 8 sions, make or aid in decisions, inform policy implementation, or 9 collect data or observations, including web hosting, domain registra- 10 tion, networking, caching, data storage, or cybersecurity. 11 7. "Communities" means neighborhoods, social network connections, 12 families, people connected by affinity, identity, or shared traits and 13 formal organizational ties. This includes Tribes, Clans, Bands, Ranche- 14 rias, Villages, and other Indigenous communities. 15 8. "Social network" means any connection of persons which exists 16 online or offline. 17 9. "Families" means any relationship, whether by blood, choice, or 18 otherwise, where one or more persons assume a caregiver role, primary or 19 shared, for one or more others, or where individuals mutually support 20 and are committed to each other's well-being. 21 10. "Equity" means the consistent and systematic fair, just, and 22 impartial treatment of all New York residents. Systemic, fair, and just 23 treatment shall take into account the status of New York residents who 24 belong to underserved communities that have been denied such treatment, 25 such as Black, Latino, and Indigenous and Native American persons, Asian 26 Americans and Pacific Islanders and other persons of color; members of 27 religious minorities; women, girls, and non-binary people; lesbian, gay, 28 bisexual, transgender, queer, and intersex persons; older adults; 29 persons with disabilities; persons who live in rural areas; and persons 30 otherwise adversely affected by persistent poverty or inequality. 31 11. "Sensitive data" means any data and metadata: 32 (a) that pertains to a New York resident in a sensitive domain; 33 (b) that are generated by technologies in a sensitive domain; 34 (c) that can be used to infer data from a sensitive domain; 35 (d) about a New York resident, such as disability-related data, genom- 36 ic data, biometric data, behavioral data, geolocation data, data related 37 to the criminal justice system, relationship history, or legal status 38 such as custody and divorce information, and home, work, or school envi- 39 ronmental data; 40 (e) that has the reasonable potential to be used in ways that are 41 likely to expose New York residents to meaningful harm, such as a loss 42 of privacy or financial harm due to identity theft; or 43 (f) that is generated by a person under the age of eighteen. 44 12. "Sensitive domain" means a particular area, field, or sphere of 45 activity in which activities being conducted can cause material harms, 46 including significant adverse effects on human rights such as autonomy 47 and dignity, as well as civil liberties and civil rights. 48 13. "Surveillance technology" means products or services marketed for 49 or that can be lawfully used to detect, monitor, intercept, collect, 50 exploit, preserve, protect, transmit, or retain data, identifying infor- 51 mation, or communications concerning New York residents or groups. 52 14. "Underserved communities" means communities that have been system- 53 atically denied a full opportunity to participate in aspects of econom- 54 ic, social, and civic life. 55 § 402. Application. The rights contained within this article shall be 56 construed as applying to New York residents against persons developingS. 8209 4 1 automated systems that have the potential to meaningfully impact New 2 York residents': 3 1. civil rights, civil liberties, and privacy; 4 2. equal opportunities; or 5 3. access to critical resources or services. 6 § 403. Construction. The rights contained within this article shall be 7 construed as harmonious and mutually supportive. 8 § 404. Safe and effective systems. 1. New York residents have the 9 right to be protected from unsafe or ineffective automated systems. 10 These systems must be developed in collaboration with diverse communi- 11 ties, stakeholders, and domain experts to identify and address any 12 potential concerns, risks, or impacts. 13 2. Automated systems shall undergo pre-deployment testing, risk iden- 14 tification and mitigation, and shall also be subjected to ongoing moni- 15 toring that demonstrates they are safe and effective based on their 16 intended use, mitigation of unsafe outcomes including those beyond the 17 intended use, and adherence to domain-specific standards. 18 3. If an automated system fails to meet the requirements of this 19 section, it shall not be deployed or, if already in use, shall be 20 removed. No automated system shall be designed with the intent or a 21 reasonably foreseeable possibility of endangering the safety of any New 22 York resident or New York communities. 23 4. Automated systems shall be designed to proactively protect New York 24 residents from harm stemming from unintended, yet foreseeable, uses or 25 impacts. 26 5. New York residents are entitled to protection from inappropriate or 27 irrelevant data use in the design, development, and deployment of auto- 28 mated systems, and from the compounded harm of its reuse. 29 6. Independent evaluation and reporting that confirms that the system 30 is safe and effective, including reporting of steps taken to mitigate 31 potential harms, shall be performed and the results made public whenever 32 possible. 33 § 405. Algorithmic discrimination practices. 1. No New York resident 34 shall face discrimination by algorithms, and all automated systems shall 35 be used and designed in an equitable manner. 36 2. The designers, developers, and deployers of automated systems shall 37 take proactive and continuous measures to protect New York residents and 38 communities from algorithmic discrimination, ensuring the use and design 39 of these systems in an equitable manner. 40 3. The protective measures required by this section shall include 41 proactive equity assessments as part of the system design, use of repre- 42 sentative data, protection against proxies for demographic features, and 43 assurance of accessibility for New York residents with disabilities in 44 design and development. 45 4. Automated systems shall undergo pre-deployment and ongoing dispari- 46 ty testing and mitigation, under clear organizational oversight. 47 5. Independent evaluations and plain language reporting in the form of 48 an algorithmic impact assessment, including disparity testing results 49 and mitigation information, shall be conducted for all automated 50 systems. 51 6. New York residents shall have the right to view such evaluations 52 and reports. 53 § 406. Data privacy. 1. New York residents shall be protected from 54 abusive data practices via built-in protections and shall maintain agen- 55 cy over the use of their personal data.S. 8209 5 1 2. Privacy violations shall be mitigated through design choices that 2 include privacy protections by default, ensuring that data collection 3 conforms to reasonable expectations and that only strictly necessary 4 data for the specific context is collected. 5 3. Designers, developers, and deployers of automated systems must seek 6 and respect the decisions of New York residents regarding the 7 collection, use, access, transfer, and deletion of their data in all 8 appropriate ways and to the fullest extent possible. Where not possible, 9 alternative privacy by design safeguards must be implemented. 10 4. Automated systems shall not employ user experience or design deci- 11 sions that obscure user choice or burden users with default settings 12 that are privacy-invasive. 13 5. Consent shall be used to justify the collection of data only in 14 instances where it can be appropriately and meaningfully given. Any 15 consent requests shall be brief, understandable in plain language, and 16 provide New York residents with agency over data collection and its 17 specific context of use. 18 6. Any existing practice of complex notice-and-choice for broad data 19 use shall be transformed, emphasizing clarity and user comprehension. 20 7. Enhanced protections and restrictions shall be established for data 21 and inferences related to sensitive domains. In sensitive domains, indi- 22 vidual data and related inferences may only be used for necessary func- 23 tions, safeguarded by ethical review and use prohibitions. 24 8. New York residents and New York communities shall be free from 25 unchecked surveillance; surveillance technologies shall be subject to 26 heightened oversight, including at least pre-deployment assessment of 27 their potential harms and scope limits to protect privacy and civil 28 liberties. 29 9. Continuous surveillance and monitoring shall not be used in educa- 30 tion, work, housing, or any other contexts where the use of such 31 surveillance technologies is likely to limit rights, opportunities, or 32 access. 33 10. Whenever possible, New York residents shall have access to report- 34 ing that confirms respect for their data decisions and provides an 35 assessment of the potential impact of surveillance technologies on their 36 rights, opportunities, or access. 37 § 407. Notice and explanation. 1. New York residents shall be informed 38 when an automated system is in use and New York residents shall be 39 informed how and why the system contributes to outcomes that impact 40 them. 41 2. Designers, developers, and deployers of automated systems shall 42 provide accessible plain language documentation, including clear 43 descriptions of the overall system functioning, the role of automation, 44 notice of system use, identification of the individual or organization 45 responsible for the system, and clear, timely, and accessible explana- 46 tions of outcomes. 47 3. The provided notice shall be kept up-to-date, and New York resi- 48 dents impacted by the system shall be notified of any significant chang- 49 es to use cases or key functionalities. 50 4. New York residents shall have the right to understand how and why 51 an outcome impacting them was determined by an automated system, even 52 when the automated system is not the sole determinant of the outcome. 53 5. Automated systems shall provide explanations that are technically 54 valid, meaningful to the individual and any other persons who need to 55 understand the system and proportionate to the level of risk based on 56 the context.S. 8209 6 1 6. Summary reporting, including plain language information about these 2 automated systems and assessments of the clarity and quality of notice 3 and explanations, shall be made public whenever possible. 4 § 408. Human alternatives, consideration, and fallback. 1. New York 5 residents shall have the right to opt out of automated systems, where 6 appropriate, in favor of a human alternative. The appropriateness of 7 such an option shall be determined based on reasonable expectations in a 8 given context, with a focus on ensuring broad accessibility and protect- 9 ing the public from particularly harmful impacts. In some instances, a 10 human or other alternative may be mandated by law. 11 2. New York residents shall have access to a timely human consider- 12 ation and remedy through a fallback and escalation process if an auto- 13 mated system fails, produces an error, or if they wish to appeal or 14 contest its impacts on them. 15 3. The human consideration and fallback process shall be accessible, 16 equitable, effective, maintained, accompanied by appropriate operator 17 training, and should not impose an unreasonable burden on the public. 18 4. Automated systems intended for use within sensitive domains, 19 including but not limited to criminal justice, employment, education, 20 and health, shall additionally be tailored to their purpose, provide 21 meaningful access for oversight, include training for New York residents 22 interacting with the system, and incorporate human consideration for 23 adverse or high-risk decisions. 24 5. Summary reporting, which includes a description of such human 25 governance processes and an assessment of their timeliness, accessibil- 26 ity, outcomes, and effectiveness, shall be made publicly available when- 27 ever possible. 28 § 409. Penalties; no private cause of action. 1. Where an operator of 29 an automated system violates or causes a violation of any of the rights 30 stated within this article, such operator shall be liable to the people 31 of this state for a penalty not less than three times such damages 32 caused. 33 2. The penalty provided for in subdivision one of this section may be 34 recovered by an action brought by the attorney general in any court of 35 competent jurisdiction. 36 3. Nothing set forth in this article shall be construed as creating, 37 establishing, or authorizing a private cause of action by an aggrieved 38 person against an operator of an automated system who has violated, or 39 is alleged to have violated, any provision of this article. 40 § 4. This act shall take effect on the ninetieth day after it shall 41 have become a law.