Washington Enacts the First Public Sector Facial Recognition Law

The government at the federal and local levels collects and processes a vast amount of biometric information on the U.S. citizens and foreign nationals.  The most widespread and controversial government use of biometrics has been the facial recognition technologies.

According to the study by the Georgetown University Center of Privacy and Technology, law enforcement face recognition networks in the United States include 117 million Americans.   At least 1 out of 4 state or local police departments has an option to run face recognition searches through their or another agency’s system.  And as many as 30 states allow law enforcement to run or request searches against their database of driver’s license and ID photos.

The market for “facial biometrics” among government buyers is also booming.  Companies that market facial recognition software to law enforcement include such household names as Amazon and Google, as well as newcomers like Clearview AI, a New York start up that created a database of more than 3 billion images that have been scraped from the Internet.

Although the benefits of facial recognition technology for law enforcement are obvious – it can help stop terrorists at the border, identify criminals, prevent identity theft, and even locate missing persons – civil rights and privacy advocates have raised concerns about the accuracy of these technologies, as well as their impact on individual privacy and civil liberties.  One of the major issue with the current facial recognition technology is that it has been shown to be less accurate on people of color, women, and other minority groups.

The cities of San Francisco, Oakland, and Sommerville (Massachusetts) recently decided to outright ban the use of facial recognition software by law enforcement.  At least three states  –  California, Oregon, and New Hampshire – have banned the use of facial recognition in body cameras worn by policy officers.

In early March of this year, the state of Washington became the first in the United States to pass a bill regulating public sector facial recognition.  Governor Inslee signed it into law on March 31, 2020.

The bill was originally packaged together with the Washington’s proposed Privacy Act which, in turn, also provided for regulation of facial recognition in private sector.  The Privacy Act failed to pass this year,  and the private sector regulation in Washington will have to wait for another day.

The Public Sector Facial Recognition law will take effect July 1, 2021.  It applies to all state and local government agencies except for the department of licensing.

Prior to developing, procuring, or using a facial recognition service, the government agencies would be required to file with a legislative authority a notice of intent to obtain and implement the service and specify a purpose for which the technology is to be used.

After filing the notice of intent, the agency must proceed to developing the accountability report which will include:

• The name of the service and vendor, with a description of its general capabilities and limitations.

• The types of data inputs that the technology uses, how that data is processed, and the types of data the system is reasonably likely to generate.

• A description of the purpose and proposed uses of the system;

• Use and data management policy, including how and when the technology will be deployed and by whom; data minimization measures; data integrity and retention policies; data security measures; agency’s training procedure; testing procedures; information on the facial recognition service’s rate of false positives and potential impacts on the protected subpopulations; and descriptions of potential impacts on civil liberties.

The Washington law requires that agencies implement a “meaningful human review” when the facial recognition service produces “legal . . . or similarly significant effects concerning individuals.”  “Meaningful human review” means review and oversight by trained individuals who have the authority to alter the decision under review.

The law requires government agencies to require providers to make available their application programming interface to enable tests of the service for bias across minority subpopulations.  Government agencies deploying facial recognition services will be required to conduct periodic training to operators of the service and individuals who process personal data obtained from the services.

Government agencies will be prohibited from using the technology to “engage in ongoing surveillance, conduct real-time or near real-time identification, or start persistent tracking” without a warrant or exigent circumstances.  Furthermore, evidence obtained through facial recognition may not be the sole basis to establish probable cause in criminal investigations.

Notably, one of the key provisions of the bill was vetoed by the Washington Governor for budgetary reasons.  The original bill proposed establishing a high-level task force composed of legislators, advocacy and consumer organizations, law enforcement, and industry that would have provided recommendations addressing potential abuses and threats posed by the use of facial recognition technology to civil liberties and freedoms, privacy and security, and discrimination against vulnerable communities, and would have conducted studies on the quality, accuracy, and effectiveness of the facial recognition services.

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653