New York City's Tenant Data Privacy Act: Key Fobs, Biometric Entry and What Building Owners May Keep

Smart Access Systems in Multiple Dwellings

The New York City Council enacted Int. No. 1760-A on May 30, 2021 as Local Law 63 of 2021. Section 1 of the local law adds a new chapter 30, "Tenant Data Privacy," to title 26 of the Administrative Code, numbered sections 26-3001 through 26-3007. The section numbers and quotations below are taken from that enacted text in the Council's legislative record. The American Legal Publishing site that hosts the codified Administrative Code refused automated retrieval during research, so the codified pages themselves were not read.

Coverage turns on two definitions in section 26-3001. A "smart access system" is any system using electronic or computerized technology, a radio frequency identification card, a mobile phone application, biometric identifier information or any other digital technology to grant entry to a class A multiple dwelling, its common areas or an individual unit. A "smart access building" is a class A multiple dwelling, as defined in the housing maintenance code, that uses one. A conventional metal key is not a smart access system; a fob, keycard, phone app or fingerprint reader is.

The law regulates two kinds of actor. The owner, as the housing maintenance code defines the term, is one. A "third party" is the other: an entity that installs, operates or otherwise directly supports the system and has ongoing access to user data, excluding an entity that only hosts the data. The people protected are "users," meaning tenants and anyone a tenant has asked, in writing or through an app, to be granted access to the unit and the system.

The chapter separates two kinds of data, and the retention rules depend on which is which. Reference data is the stored information that a credential is checked against: the enrolled fingerprint template, the registered fob number, the account password. Authentication data is what is generated at the moment of entry when a credential is presented. The definition of authentication data excludes data from a video or camera system used to monitor entrances but not to grant entry.

Written Consent and the Data That May Be Collected

Section 26-3002(a) opens with a consent rule: an owner or third party may not collect reference data from a user unless the user "has expressly consented, in writing or through a mobile application," to the use of the building's system. It then limits collection to "the minimum amount of authentication data and reference data necessary" and bars collecting additional biometric identifier information from any user. The system may only collect, generate or use:

• the user's name;
• the unit number and the other doors or common areas the user can open with the system;
• the user's preferred method of contact;
• the user's biometric identifier information, if the system uses biometrics;
• the card number or other identifier of the physical hardware used for entry, such as an RFID card or a Bluetooth protocol;
• passwords, passcodes, user names and contact information used to grant entry or to reach online tools that manage user accounts for the building;
• lease information, including move-in and, if available, move-out dates; and
• the time and method of access, "solely for security purposes."

Biometric identifier information is defined in section 26-3001 to include a retina or iris scan, a fingerprint, a voiceprint, a scan or record of palm, hand or face geometry, gait or movement patterns, or any other similar identifying characteristic. Two prohibitions in section 26-3003(a) narrow whose data may be enrolled at all: paragraph 3 bars capturing a minor's reference data without written authorization from a parent or guardian, and paragraph 6 bars collecting reference data from a non-tenant who has not expressly consented, while allowing collection for an owner's employees and agents.

The same section reaches beyond the door. Under section 26-3002(f), information an owner of a multiple dwelling collects about a tenant's use of gas, electricity or any other utility is limited to total monthly usage unless law requires more, and collecting information about a tenant's internet use is unlawful, except that an owner who provides internet service directly may collect it in aggregated and anonymized form or as needed for billing.

Retention and Destruction Limits

The chapter sets 90-day clocks that run from different events.

• Authentication data: destroyed no later than 90 days after it was collected or generated, unless kept in anonymized form (section 26-3002(b)).
• Reference data of a tenant who has permanently vacated: removed from the system, or anonymized where removal would make the system inoperable, within 90 days of vacating (26-3002(c)), and destroyed within the same period where collected solely for operating the system (26-3002(d)).
• Reference data of a guest who is not a tenant: removed or anonymized within 90 days after access expires or the tenant withdraws the request that the guest be enrolled.
• Reference data of a user who withdraws authorization: removed or anonymized within 90 days of the withdrawal.
• Data collected in violation of paragraphs 3 through 6 of section 26-3003(a): destroyed immediately (26-3002(d)).

Four exceptions in section 26-3002(e) relieve an owner or third party of a destruction duty for data necessary to detect security incidents or protect against malicious, deceptive, fraudulent or illegal activity and prosecute those responsible; data necessary to debug and repair errors; data that is protected speech under the federal or state constitution; and data necessary to comply with another law or legal obligation. Subdivision (g) lets an owner keep, outside the system, a record linking a card or fob identifier to a unit solely to activate or deactivate it, and subdivision (h) lets reference data be kept longer than 90 days at the user's written or in-app request.

Prohibited Uses and Sale

Section 26-3003(a)(1) makes it unlawful for an owner or third party that collects reference or authentication data to "sell, lease or otherwise disclose such data to another person," with five exceptions: legal process or an active law enforcement investigation; a third party operating or facilitating the system, where the user gave express authorization after receiving in writing the third party's name, its intended use and its privacy policy; an energy efficiency contractor, for utility data only; a guest, as authorized by a tenant; and as otherwise required by law. The remaining paragraphs of subdivision (a) bar using satellite navigation or similar technology in the system to track a user outside the building, tracking tenants' and guests' relationship status, tracking frequency and time of use to harass or evict a tenant, and sharing a minor's data without a parent's written authorization.

Subdivision (b) adds limits that apply to the owner and its agents specifically. Data from the system may be used only to grant access to and monitor entrances, exits and common areas such as laundry and mail rooms, and to grant access to units that use the system. The owner may not use the system to limit a user's time of entry unless a tenant asks, may not require a tenant to use the system to enter the tenant's own unit, and may not use information collected through it "to harass or evict a tenant."

Two further sections set baseline duties. Section 26-3004 requires the owner to give tenants a written, plain-language policy describing the data elements collected, the entities the data is shared with and their privacy policies, the safeguards, the retention schedule, the protocol for unauthorized access including notifying users, the destruction and anonymization guidelines, and the process for adding and removing temporary users, and to make available the privacy policy of the system's developer or operator. Section 26-3005 requires "stringent security measures and safeguards" including, at a minimum, data encryption, the ability to change a password where one is used, and regularly updated firmware.

The Remedy the Law Provides

The chapter's only enforcement section is narrow, and it is worth reading on its own terms. Section 26-3006(a) provides that "a lawful occupant of a dwelling unit, or a group of such occupants, in a smart access building may bring an action alleging an unlawful sale of data in violation of paragraph one of subdivision a of section 26-3003." If the court finds a violation "for the unlawful sale of data," it awards each occupant, per unlawful sale of that occupant's data, either compensatory damages and, in the court's discretion, punitive damages, or, at the occupant's election, damages from $200 to $1,000, together with reasonable attorneys' fees and court costs.

Several limits follow from that text. The action is for an unlawful sale, so the statute's own words do not extend it to a missed retention deadline, a missing privacy policy or an inadequate security measure, even though the chapter prohibits all three. Section 26-3006(b) states that the action does not relieve an occupant of the obligation to pay rent. Section 26-3006(c) states that the section does not limit or abrogate claims under common law or other law. The chapter names no agency enforcer: section 26-3007 assigns the Department of Housing Preservation and Development an education role, and HPD's page on the law describes it as providing "a private right of action for unlawful sale of data collected through the smart access system."

Section 2 of the local law set the timing. The law took effect 60 days after it became law, but no owner of an existing smart access building was liable for a violation of chapter 30 until January 1, 2023, to allow time to replace or upgrade systems. A search of the Council's legislative record for later changes found one proposal to amend section 26-3001 and add a registration requirement for buildings using biometric recognition, Int. No. 616-2022, whose status is "Filed (End of Session)" without enactment.

How It Sits Beside the City's Commercial Biometric Law

New York City has a second biometric statute, enacted earlier the same year, and the two do not overlap by their terms. Local Law 3 of 2021 (Int. No. 1170-A, enacted January 10, 2021) added chapter 12, sections 22-1201 through 22-1205, to title 22 of the Administrative Code. It applies to a "commercial establishment," defined as a place of entertainment, a retail store, or a food and drink establishment. A residential building is not on that list.

The commercial law works through notice rather than a data inventory. Section 22-1202(a) requires an establishment that collects, retains, converts, stores or shares customers' biometric identifier information to post a clear and conspicuous sign near all customer entrances, in a form set by the Department of Consumer and Worker Protection by rule. Section 22-1202(b) makes it unlawful "to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of" biometric identifier information. Section 22-1204 exempts government agencies, and exempts financial institutions and certain non-analyzed photographs and video from the sign requirement.

Its remedy is broader than the tenant law's. Section 22-1203 lets a person aggrieved by a violation of the chapter sue on his or her own behalf. For the signage rule, the person first gives 30 days' written notice, and a cure accompanied by a written statement that no further violations will occur bars the action. No notice is required for a claim under the sale prohibition. A prevailing party recovers $500 per signage violation, $500 per negligent violation and $5,000 per intentional or reckless violation of the sale prohibition, plus attorneys' fees, expert fees and costs and other relief including an injunction. Side by side, the commercial law requires disclosure and lets customers sue over signage and sale, while the tenant law limits collection, retention and use but lets occupants sue only over sale. Both are city laws; a state-level comparison sits in the biometric privacy laws by state guide.

Frequently Asked Questions