Bill > S01139

This bill requires governmental entities to implement multifactor authentication (MFA) for network access whenever possible, which means using two or more different types of identification credentials such as passwords, security tokens, or biometric information like fingerprints or facial recognition. The bill defines a governmental entity broadly to include state and local departments, authorities, universities, counties, cities, and towns, but excludes the judiciary and legislatures. It mandates that the state technology office establish technical standards for MFA implementation, with the option to reference guidelines from federal agencies like the National Institute of Standards and Technology. The bill also includes privacy protections, prohibiting governmental entities from requiring biometric authentication, selling biometric data, or sharing such data with law enforcement without a warrant. Additionally, the bill requires all public websites maintained by governmental entities to encrypt data exchanges between web servers and browsers, ensuring confidentiality and data integrity. Entities can apply for waivers from these requirements, which would be valid for two years and subject to reapproval. The bill is set to take effect one year after becoming law, allowing time for implementation and rule-making.

Budget and Finance, Business and Industry

https://www.nysenate.gov/legislation/bills/2025/S1139