Requires any entity in New York that uses AI or another automated process as the sole basis of a decision that denies access to financial services, insurance, housing, public accommodation, healthcare, or basic necessities to: (a) Clearly and conspicuously disclose that the decision was made solely on the basis of an automated process; and (b) Enable any affected individual to appeal the decision, including by giving them the right to have a human review it. Requires the above entities, and additionally those that use an automated decision systems to determine access to employment and education, to annually solicit an outside auditor to conduct, and make publicly available, an impact assessment of the system that: (a) Evaluates the system's objectives, design, and training data, as well as how the system was tested for accuracy and discrimination; and (b) Assesses whether the system produces discriminatory results on the basis of race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial status, biometric information, lawful source of income, or disability.
Paper
Full text
New York Data Privacy Act, Section 7
ETO AGORA · U.S. state and local documents · 2023
Summary
Requires any entity in New York that uses AI or another automated process as the sole basis of a decision that denies access to financial services, insurance, housing, public accommodation, healthcare, or basic necessities to:
(a) Clearly and conspicuously disclose that the decision was made solely on the basis of an automated process; and
(b) Enable any affected individual to appeal the decision, including by giving them the right to have a human review it.
Requires the above entities, and additionally those that use an automated decision systems to determine access to employment and education, to annually solicit an outside auditor to conduct, and make publicly available, an impact assessment of the system that:
(a) Evaluates the system's objectives, design, and training data, as well as how the system was tested for accuracy and discrimination; and
(b) Assesses whether the system produces discriminatory results on the basis of race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial status, biometric information, lawful source of income, or disability.
Requires disclosure of automated decision-making and provides consumers avenues to appeal and contest decisions.
- AUTOMATED DECISION-MAKING. (A) WHENEVER A CONTROLLER MAKES AN AUTO- MATED DECISION INVOLVING SOLELY AUTOMATED PROCESSING THAT MATERIALLY CONTRIBUTES TO A DENIAL OF FINANCIAL OR LENDING SERVICES, HOUSING, PUBLIC ACCOMMODATION, INSURANCE, HEALTH CARE SERVICES, OR ACCESS TO BASIC NECESSITIES, SUCH AS FOOD AND WATER, THE CONTROLLER MUST: (I) DISCLOSE IN A CLEAR, CONSPICUOUS, AND CONSUMER-FRIENDLY MANNER THAT THE DECISION WAS MADE BY A SOLELY AUTOMATED PROCESS; (II) PROVIDE AN AVENUE FOR THE AFFECTED CONSUMER TO APPEAL THE DECI- SION, WHICH MUST AT MINIMUM ALLOW THE AFFECTED CONSUMER TO (A) FORMALLY CONTEST THE DECISION, (B) PROVIDE INFORMATION TO SUPPORT THEIR POSITION, AND (C) OBTAIN MEANINGFUL HUMAN REVIEW OF THE DECISION; AND (III) EXPLAIN THE PROCESS TO APPEAL THE DECISION.
Requires the controller to respond to appeals within 45 days, extendable once by 45 days.
(B) A CONTROLLER MUST RESPOND TO A CONSUMER'S APPEAL WITHIN FORTY-FIVE DAYS OF RECEIPT OF THE APPEAL. THAT PERIOD MAY BE EXTENDED ONCE BY FORTY-FIVE ADDITIONAL DAYS WHERE REASONABLY NECESSARY, TAKING INTO ACCOUNT THE COMPLEXITY AND NUMBER OF APPEALS. THE CONTROLLER MUST INFORM THE CONSUMER OF ANY SUCH EXTENSION WITHIN FORTY-FIVE DAYS OF RECEIPT OF THE APPEAL, TOGETHER WITH THE REASONS FOR THE DELAY.
Requires annual impact assessments for automated decision-making in sensitive sectors, using independent auditors and public disclosure.
(C) (I) A CONTROLLER OR PROCESSOR ENGAGED IN AUTOMATED DECISION-MAKING AFFECTING FINANCIAL OR LENDING SERVICES, HOUSING, PUBLIC ACCOMMODATION, INSURANCE, EDUCATION ENROLLMENT, EMPLOYMENT, HEALTH CARE SERVICES, OR ACCESS TO BASIC NECESSITIES, SUCH AS FOOD AND WATER, OR ENGAGED IN ASSISTING OTHERS IN AUTOMATED DECISION-MAKING IN THOSE FIELDS, MUST ANNUALLY CONDUCT AN IMPACT ASSESSMENT OF SUCH AUTOMATED DECISION-MAKING THAT: (A) DESCRIBES AND EVALUATES THE OBJECTIVES AND DEVELOPMENT OF THE AUTOMATED DECISION-MAKING PROCESSES INCLUDING THE DESIGN AND TRAINING DATA USED TO DEVELOP THE AUTOMATED DECISION-MAKING PROCESS, HOW THE AUTOMATED DECISION-MAKING PROCESS WAS TESTED FOR ACCURACY, FAIRNESS, BIAS AND DISCRIMINATION; AND (B) ASSESSES WHETHER THE AUTOMATED DECISION-MAKING SYSTEM PRODUCES DISCRIMINATORY RESULTS ON THE BASIS OF A CONSUMER'S OR CLASS OF CONSUM- ERS' ACTUAL OR PERCEIVED RACE, COLOR, ETHNICITY, RELIGION, NATIONAL ORIGIN, SEX, GENDER, GENDER IDENTITY, SEXUAL ORIENTATION, FAMILIAL STATUS, BIOMETRIC INFORMATION, LAWFUL SOURCE OF INCOME, OR DISABILITY. (II) A CONTROLLER OR PROCESSOR MUST UTILIZE AN EXTERNAL, INDEPENDENT AUDITOR OR RESEARCHER TO CONDUCT SUCH ASSESSMENTS. (III) A CONTROLLER OR PROCESSOR MUST MAKE PUBLICLY AVAILABLE IN A MANNER ACCESSIBLE ONLINE ALL IMPACT ASSESSMENTS PREPARED PURSUANT TO THIS SECTION, RETAIN ALL SUCH IMPACT ASSESSMENTS FOR AT LEAST SIX YEARS, AND MAKE ANY SUCH RETAINED IMPACT ASSESSMENTS AVAILABLE TO ANY STATE, FEDERAL, OR LOCAL GOVERNMENT AUTHORITY UPON REQUEST. (IV) FOR PURPOSES OF THIS PARAGRAPH, THE LIMITATIONS TO JURISDICTIONAL SCOPE SET FORTH IN PARAGRAPHS (B) AND (C) OF SUBDIVISION TWO OF SECTION ELEVEN HUNDRED ONE OF THIS ARTICLE SHALL NOT APPLY.