On March 12, 2020, Washington’s state legislature passed SB 6280, a bill that will regulate state and local government agencies’ use of facial recognition services (“FRS’s”).  The bill aims to create a legal framework by which agencies may use FRS’s to the benefit of society (for example, by assisting agencies in locating missing or deceased persons), but prohibits uses that “threaten our democratic freedoms and put our civil liberties at risk.”

The bill imposes several limits on state agencies’ use of FRS’s:

1. Pre-Launch Requirements: Prior to deploying an FRS, a state agency would be required to file a notice of intent with its respective legislative authority.  In addition, it would be required to produce a public “accountability report,” which must include, among other things, information about the types of data the technology uses and how that data is generated, the purpose of the proposed FRS (including what decisions it will make or support), the use and data management policy that will govern the FRS, and a description of the potential impact on civil rights and liberties.  The report would be subject to a public review and comment period before the FRS is deployed, and agencies would be required to update the report either every two years or whenever the FRS is put to a different use.
2. Additional Requirements for Legal/Significant Effects: The bill imposes some additional requirements for using FRS’s in ways that produces legal or “similarly significant” effects—specifically, decisions that result in the provision or denial of “financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities such as food and water, or that impact civil rights.”  Prior to deploying an FRS for such uses, an agency must test the FRS in operational conditions and take reasonable steps to ensure best-quality results by following all guidance provided by the FRS developer.  In addition, all decisions made by the FRS in these circumstances must be subject to meaningful human review.
3. Accountability, Testing, and Training: FRS providers must be required by state agencies to make available an application programming interface (API) or other technical capability that will permit independent, third-party testing for accuracy or unfair performance differences across certain subpopulations.  If the testing detects such materially unfair performance differences, the provider must be required to develop and implement a mitigation strategy within 90 days.  Notably, the bill makes clear that these provisions are not intended to require providers to disclose proprietary information or expose their technology to cyberattacks—but providers are responsible for minimizing these risks.  The bill also requires agencies to conduct periodic training for all individuals responsible for operating the FRS, including with respect to the tool’s capabilities and limitations and procedures for interpreting and acting on the FRS’s decisions.
4. Criminal Justice Reporting: When an FRS has been used on a criminal defendant, state agencies will be required to disclose this fact to the defendant in a timely manner prior to trial.  Agencies also will be required to maintain sufficient records of their use of FRS’s in order to facilitate public reporting and research.  Judges who have been involved in issuing, extending, or rejecting warrants for FRS’s also will be required to produce annual reports.
5. Surveillance Limitations and Prohibitions: Agencies that wish to use an FRS for ongoing surveillance, real-time or near-real-time identification, or persistent tracking (e., tracking an individual’s movements without identifying that individual) may only do so (i) with a warrant; (ii) if there are exigent circumstances; or (iii) with a court order for the sole purpose of locating or identifying a missing or deceased person. The bill also lists various prohibited uses and applications of FRS’s:

• • Agencies may not apply an FRS to an individual based on that individual’s “religious, political, or social view or activities,” based on participation in lawful events, or based on certain actual or perceived characteristics;
  • FRS’s may not be used to create a record that describes an individual’s exercise of their First Amendment rights;
  • FRS results may not be used as the sole basis to establish probable cause in a criminal investigation; and
  • Agencies may not use an FRS to identify an individual based on a manually produced image (such as a sketch), and they may not substantively manipulate an image for use by an FRS in ways that are not consistent with the FRS provider’s intent.

6. Task Force: Finally, the bill also establishes a task force to study and provide recommendations regarding issues such as the potential harms posed by the use of FRS’s and the quality, accuracy and efficacy of FRS’s.

The bill was sent to Governor Jay Inslee, and now awaits his signature.  Several other states, including Arizona, Illinois, Massachusetts, New Hampshire, and Vermont, also are considering legislation that would curtail the use of facial recognition by government entities.  These pieces of legislation range from imposing certain regulatory requirements on agencies’ FRS use (like the Washington bill) to complete moratoriums.