Washington Passes Groundbreaking Facial Recognition Law;  Other States May Follow Suit

On March 31, 2020, the state of Washington passed a detailed law regulating the use of facial recognition software by state and local government agencies, Senate Bill 6280 (the “Act”).  The Act is intended to promote the use of facial recognition services in a manner that benefits society, while prohibiting use that threatens civil liberties. 

Under the Act, Washington state and local government agencies may use facial recognition services to locate or identify missing persons and identify deceased persons.  This includes locating missing or murdered indigenous women, subjects of Amber alerts, and other possible crime victims.  The Act imposes certain obligations upon software companies while regulating government agencies utilizing facial recognition software.  Among such agency regulations are the following:

• Absent emergencies, law enforcement agencies must obtain a warrant before using facial recognition software in investigations;
• State and local agencies using facial recognition software must regularly report on their use of the software and conduct testing to ensure its fairness and accuracy; and
• State or local government agencies using, or intending to use, facial recognition services must submit a Notice of Intent to the state specifying the purpose for which the technology is to be used;

Prior to using facial recognition software, a state or local government agency must produce an Accountability Report, which must include statements of the following:

• The name of the facial recognition service, vendor, and version, along with a description of its capabilities and limitations. The description of services must also include reasonably foreseeable capabilities outside the scope of the proposed use of the agency;
• The type of data input that the technology uses, including a description of how the data is generated, collected, and processed; and
• A description of the purpose and proposed use of the facial recognition service, including its intended benefits and researching supporting same.

The Act also requires the Accountability Report to include a “use and data management policy.” The policy must include a clear description of the service’s data privacy protocol, including the following: 

• A description as to when and how the services will be used and by whom;
• Information about where, when, and how the technology will be used, including whether the service will be operated continuously or only under certain circumstances;
• Measures taken to minimize the collection of data beyond the amount necessary to effectuate the purpose of the service;
• Data integrity processes, which includes how the agency will maintain the data, ensure secure storage, and process the deletion of data. The agency must ensure compliance with state and national data breach laws; and
• Agency training and testing procedures, which includes measures to ensure program users are knowledgeable about the governing laws. This ensures compliance with the use and data management policy.

The Act contemplates potential technological biases and errors, mandating human review for certain uses.  If a state or local government agency uses facial recognition software to make decisions that have legal effects on individuals, the agency must ensure that the decisions are subject to meaningful human review.  This includes decisions regarding the denial and financing of bank lending services, housing, insurance, education enrollment, healthcare, criminal justice, employment opportunities, or access to basic necessitates such as food or water. 

The Act also promotes transparency in government.  Prior to finalizing the Accountability Report, the agency must allow for public review and comment, including at least three community consultation meetings to address any concerns.  The Act also requires the legislature to create a facial recognition task force to ensure compliance with the Act and address potential abuses and/or threats to civil liberties.

The full text of the Act may be found here.

Washington is home to two of the largest companies in the nation developing facial recognition software, Amazon and Microsoft.  It is the first state to establish state-wide facial recognition software regulations.  Its new facial recognition law has been applauded by the tech industry for providing comprehensive regulations.  However, the bill received some criticism from civil liberties leaders concerned about the potential for facial recognition software amplifying human biases and disproportionately misidentifying minorities.  While the language of the Act does contemplate such biases and errors, some civil liberties groups, including the ACLU of Washington, do not believe it is enough.

Facial recognition service providers in Washington and across the country may soon find themselves subject to the Act, or similar legislation, as other states will likely follow Washington’s lead.  Certain states, including Michigan, have had similar bills introduced in the legislature in recent months.  The regulation of facial recognition software is one to watch in the upcoming year.  Compliance with governing laws are imperative for government agencies and the software providers furnishing programs.  Butzel Long will continue to monitor similar legislation across the nation and report to our clients on any developments.  Of course, if you have any questions, feel free to contact us.

Javon R. David
248.258.1415
davidj@butzel.com