States and local government agencies cannot use facial recognition systems without a warrant or court order, according to a Bill passed by the Washington State Legislative Assembly on Mach 12. It also bars authorities from deploying facial recognition systems on individuals on the basis of their religious, political, and social views or activities, among other things. As of now, the Bill — called SB 6280 — is awaiting approval from the state’s governor. However, under undefined “exigent circumstances”, state/local government agencies can use facial recognition systems.
“Unconstrained use of facial recognition services by state and local government agencies poses broad social ramifications that should be considered and addressed,” the Bill states. It came as the New York Police Department introduced a policy on using facial recognition technology in its investigations, and after multiple cities in the US — including San Francisco, Oakland, Cambridge, Berkley, and Somerville — banned the use of facial recognition technologies. In February, US Senators Jeff Merkley and Cory Booker had introduced a Bill to temporarily restrict the use of facial recognition by all government agencies until limits are placed on the use of the technology.
File an ‘Accountability Report’ before deploying facial recognition systems
The Bill directs a state or any local government agency using/procuring a facial recognition service to file a notice of intent with a legislative authority, specifying the purposes for which the technology is to be used. Before developing a facial recognition system, the respective agencies also have to issue an accountability report, which should be prepared only after the agency has held three community consultation meetings, and considered the issues raised in those meetings. It should also be updated every two years and submitted to a legislative authority and should be published 90 days ahead of operationalising the facial recognition system. The accountability report should highlight:
- Data collection, sharing and security practices: The types of data inputs that the technology uses, and how that data is generated, collected, and processed.
- Measures taken to reduce inadvertent collection of additional data, data integrity and retention policies, and how the collected data will be safeguarded
- Rules on data sharing between with another entity to ensure that other entities comply with the sharing agency’s use and data management policy
- How the vendor of the facial recognition technology, and states and other entities will fulfill security breach notifications
- Purpose of use, and impact on civil rights: A description of the purpose and proposed use of the facial recognition service, including what decisions will be used to make or support it, and name of the vendor, among other things
- How the facial recognition service would potentially impact civil rights and liberties, including impacts on privacy and marginalised communities
- Accuracy and biases of the facial recognition system: How and when the technology will be used, and by whom, along with the factors that will be used to determine whether the system would be used continuously
- Information on the facial recognition service’s rate of false matches, potential impacts on protected subpopulations, and how the agency will address error rates
- Vendors have to disclose complaints or reports of bias against their service
No racial, gender discrimination
Before the authorities operationalise a facial recognition system, they should mandate vendors to carry out legitimate, independent, and reasonable tests of their service to check for accuracy and unfair performance differences across distinct subpopulations such as race, skin tone, ethnicity, gender, age, or disability status.
Test facial recognition service’s results in practical environment first
In case authorities use findings based on a facial recognition system in a court of law, they should ensure that the system has previously been tested in a practical environment. The findings of the facial recognition system would be subject to human review so that citizens are not robbed of their civil rights.
- The results of a facial recognition service can not be treated as the sole basis to establish probable cause in a criminal investigation. This echoes the NYPD’s policy on use of facial recognition technology.
- Authorities should disclose their use of a facial recognition service on a criminal defendant to that person in a timely manner before the trial.
- Records pertaining to the use of a facial recognition service by authorities should be sufficient to facilitate public reporting and auditing of compliance with the agency’s facial recognition policies.
Calls for judicial accountability
Judges, who have approved, extended or denied warrants to use facial recognition systems, will have to report it to the administrator for the courts every January with details including: the fact that warrant was applied for, the period of surveillance authorised, and where the surveillance was carried out, among other things.
- States and local government agencies, meanwhile, will have to provide a report summarising non-identifying demographic data of surveilled individuals named in warrant applications to a legislative authority.
Formation of a task force
The William D. Ruckelshaus Center, a joint public policy institute between University of Washington and Washington State University, will form a facial recognition task force, which will have representatives from the Senate, House of Representatives, advocacy organisations, law enforcement agencies, consumer protection organisations and companies that develop facial recognition services. The task force will:
- Provide recommendations addressing the potential abuses and threats posed by the use of a facial recognition service to civil liberties and freedoms, privacy and security, and discrimination against vulnerable communities.
- Study the quality, accuracy, and efficacy of a facial recognition service, to check for accuracy, and efficacy across different subpopulations.
State authorities using a facial recognition service under a federal regulation, or in partnership with a federal agency to fulfil a congressional mandate, or to identify individuals at airports and seaports, are exempt from the provisions of this Bill.