Engrossed Substitute Senate Bill 6280 - Use of Facial Recognition Services (State of Washington, 66th Legislature)

Summary

Engrossed Substitute Senate Bill 6280 of the State of Washington, 66th Legislature, by Senate Environment, Energy & Technology (originally sponsored by Senators Nguyen, Carlyle, Wellman, Salomon, Lovelett, Das, Randall, Pedersen, Wilson, C., and Hunt), read first time 01/24/20. It is an act relating to the use of facial recognition services by state and local government agencies. Section 1 sets out legislative findings, including that agencies may use facial recognition services in beneficial ways such as locating missing or incapacitated persons, identifying victims of crime, and keeping the public safe. A later section states that a facial recognition service match alone does not constitute reasonable suspicion.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

                     ENGROSSED SUBSTITUTE SENATE BILL 6280


     State of Washington          66th Legislature      2020 Regular Session

     By Senate Environment, Energy & Technology (originally sponsored by
     Senators Nguyen, Carlyle, Wellman, Salomon, Lovelett, Das, Randall,
     Pedersen, Wilson, C., and Hunt)

     READ FIRST TIME 01/24/20.




 1       AN ACT Relating to the use of facial recognition services; adding
 2   a new section to chapter 9.73 RCW; adding a new chapter to Title 43
 3   RCW; creating a new section; and providing an expiration date.


 4   BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:


 5       NEW SECTION. Sec. 1. The legislature finds that:
 6       (1) Unconstrained use of facial recognition services by state and
 7   local government agencies poses broad social ramifications that
 8   should be considered and addressed. Accordingly, legislation is
 9   required to establish safeguards that will allow state and local
10   government agencies to use facial recognition services in a manner
11   that benefits society while prohibiting uses that threaten our
12   democratic freedoms and put our civil liberties at risk.
13       (2) However, state and local government agencies may use facial
14   recognition services in a variety of beneficial ways, such as
15   locating missing or incapacitated persons, identifying victims of
16   crime, and keeping the public safe.


17       NEW SECTION.      Sec. 2.   The definitions in this section apply
18   throughout  this      chapter unless  the   context  clearly  requires
19   otherwise.


                                        p. 1                        ESSB 6280
 1       (1)   "Accountability   report"  means  a  report   developed  in
 2   accordance with section 3 of this act.
 3       (2) "Enroll," "enrolled," or "enrolling" means the process by
 4   which a facial recognition service creates a facial template from one
 5   or more images of an individual and adds the facial template to a
 6   gallery used by the facial recognition service for recognition or
 7   persistent tracking of individuals. It also includes the act of
 8   adding an existing facial template directly into a gallery used by a
 9   facial recognition service.
10       (3)(a) "Facial recognition service" means technology that
11   analyzes facial features and is used by a state or local government
12   agency for the identification, verification, or persistent tracking
13   of individuals in still or video images.
14       (b) "Facial recognition service" does not include: (i) The
15   analysis of facial features to grant or deny access to an electronic
16   device; or (ii) the use of an automated or semiautomated process for
17   the purpose of redacting a recording for release or disclosure
18   outside the law enforcement agency to protect the privacy of a
19   subject depicted in the recording, if the process does not generate
20   or result in the retention of any biometric data or surveillance
21   information.
22       (4) "Facial template" means the machine-interpretable pattern of
23   facial features that is extracted from one or more images of an
24   individual by a facial recognition service.
25       (5) "Identification" means the use of a facial recognition
26   service by a state or local government agency to determine whether an
27   unknown individual matches any individual whose identity is known to
28   the state or local government agency and who has been enrolled by
29   reference to that identity in a gallery used by the facial
30   recognition service.
31       (6) "Meaningful human review" means review or oversight by one or
32   more individuals who are trained in accordance with section 8 of this
33   act and who have the authority to alter the decision under review.
34       (7) "Ongoing surveillance" means tracking the physical movements
35   of a specified individual through one or more public places over
36   time, whether in real time or through application of a facial
37   recognition service to historical records. It does not include a
38   single recognition or attempted recognition of an individual, if no
39   attempt is made to subsequently track that individual's movement over
40   time after they have been recognized.
                                     p. 2                        ESSB 6280
 1       (8) "Persistent tracking" means the use of a facial recognition
 2   service by a state or local government agency to track the movements
 3   of an individual on a persistent basis without identification or
 4   verification of that individual. Such tracking becomes persistent as
 5   soon as:
 6       (a) The facial template that permits the tracking is maintained
 7   for more than forty-eight hours after first enrolling that template;
 8   or
 9       (b) Data created by the facial recognition service is linked to
10   any other data such that the individual who has been tracked is
11   identified or identifiable.
12       (9) "Recognition" means the use of a facial recognition service
13   by a state or local government agency to determine whether an unknown
14   individual matches:
15       (a) Any individual who has been enrolled in a gallery used by the
16   facial recognition service; or
17       (b) A specific individual who has been enrolled in a gallery used
18   by the facial recognition service.
19       (10) "Serious criminal offense" means any offense defined under
20   RCW 9.94A.030 (26), (33), (42), (43), (47), or (56).
21       (11) "Verification" means the use of a facial recognition service
22   by a state or local government agency to determine whether an
23   individual is a specific individual whose identity is known to the
24   state or local government agency and who has been enrolled by
25   reference to that identity in a gallery used by the facial
26   recognition service.


27       NEW SECTION.   Sec. 3.   (1) A state or local government agency
28   using or intending to develop, procure, or use a facial recognition
29   service must produce an accountability report for that service. The
30   report must be clearly communicated to the public at least ninety
31   days prior to the agency putting the facial recognition service into
32   operational use, posted on the agency's public web site, and
33   submitted to the consolidated technology services agency established
34   in RCW 43.105.006. The consolidated technology services agency must
35   post each submitted accountability report on its public web site.
36       (2) Each accountability report must include, at minimum, clear
37   and understandable statements of the following:
38       (a)(i) The name of the facial recognition service, vendor, and
39   version; and (ii) a description of its general capabilities and
                                     p. 3                        ESSB 6280
 1   limitations, including reasonably foreseeable capabilities outside
 2   the scope of the proposed use of the agency;
 3       (b)(i) The type or types of data inputs that the technology uses;
 4   (ii) how that data is generated, collected, and processed; and (iii)
 5   the type or types of data the system is reasonably likely to
 6   generate;
 7       (c)(i) A description of the purpose and proposed use of the
 8   facial recognition service, including what decision or decisions will
 9   be used to make or support it; (ii) whether it is a final or support
10   decision system; and (iii) its intended benefits, including any data
11   or research demonstrating those benefits;
12       (d) A clear use and data management policy, including protocols
13   for the following:
14       (i) How and when the facial recognition service will be deployed
15   or used and by whom including, but not limited to, the factors that
16   will be used to determine where, when, and how the technology is
17   deployed, and other relevant information, such as whether the
18   technology will be operated continuously or used only under specific
19   circumstances. If the facial recognition service will be operated or
20   used by another entity on the agency's behalf, the facial recognition
21   service accountability report must explicitly include a description
22   of the other entity's access and any applicable protocols;
23       (ii) Any measures taken to minimize inadvertent collection of
24   additional data beyond the amount necessary for the specific purpose
25   or purposes for which the facial recognition service will be used;
26       (iii) Data integrity and retention policies applicable to the
27   data collected using the facial recognition service, including how
28   the agency will maintain and update records used in connection with
29   the service, how long the agency will keep the data, and the
30   processes by which data will be deleted;
31       (iv) Any additional rules that will govern use of the facial
32   recognition service and what processes will be required prior to each
33   use of the facial recognition service;
34       (v) Data security measures applicable to the facial recognition
35   service including how data collected using the facial recognition
36   service will be securely stored and accessed, if and why an agency
37   intends to share access to the facial recognition service or the data
38   from that facial recognition service with any other entity, and the
39   rules and procedures by which an agency sharing data with any other
40   entity will ensure that such entities comply with the sharing
                                     p. 4                        ESSB 6280
 1   agency's use and data management policy as part of the data sharing
 2   agreement;
 3       (vi) How the facial recognition service provider intends to
 4   fulfill security breach notification requirements pursuant to chapter
 5   19.255 RCW and how the agency intends to fulfill security breach
 6   notification requirements pursuant to RCW 42.56.590; and
 7       (vii)   The   agency's  training   procedures,   including  those
 8   implemented in accordance with section 8 of this act, and how the
 9   agency will ensure that all personnel who operate the facial
10   recognition service or access its data are knowledgeable about and
11   able to ensure compliance with the use and data management policy
12   prior to use of the facial recognition service;
13       (e) The agency's testing procedures, including its processes for
14   periodically undertaking operational tests of the facial recognition
15   service in accordance with section 6 of this act;
16       (f) Information on the facial recognition service's rate of false
17   matches, potential impacts on protected subpopulations, and how the
18   agency will address error rates, determined independently, greater
19   than one percent;
20       (g) A description of any potential impacts of the facial
21   recognition service on civil rights and liberties, including
22   potential impacts to privacy and potential disparate impacts on
23   marginalized communities, and the specific steps the agency will take
24   to mitigate the potential impacts and prevent unauthorized use of the
25   facial recognition service; and
26       (h) The agency's procedures for receiving feedback, including the
27   channels for receiving feedback from individuals affected by the use
28   of the facial recognition service and from the community at large, as
29   well as the procedures for responding to feedback.
30       (3) Prior to finalizing and implementing the accountability
31   report, the agency must consider issues raised by the public through:
32       (a) A public review and comment period; and
33       (b) Community consultation meetings during the public review
34   period.
35       (4) The accountability report must be updated every two years and
36   each update must be subject to the public comment and community
37   consultation processes described in this section.
38       (5) An agency seeking to use a facial recognition service for a
39   purpose not disclosed in the agency's existing accountability report
40   must first seek public comment and community consultation on the
                                     p. 5                        ESSB 6280
 1   proposed new use and adopt an updated accountability report pursuant
 2   to the requirements contained in this section.
 3       (6) The accountability report required for the facial recognition
 4   matching system authorized in RCW 46.20.037 is due July 1, 2021.


 5       NEW SECTION.   Sec. 4.   (1) State and local government agencies
 6   using a facial recognition service are required to prepare and
 7   publish an annual report that discloses:
 8       (a) The extent of their use of such services;
 9       (b) An assessment of compliance with the terms of their
10   accountability report;
11       (c) Any known or reasonably suspected violations of their
12   accountability report, including categories of complaints alleging
13   violations; and
14       (d) Any revisions to the accountability report recommended by the
15   agency during the next update of the policy.
16       (2) The annual report must be submitted to the office of privacy
17   and data protection.
18       (3) All agencies must hold community meetings to review and
19   discuss their annual report within sixty days of its public release.


20       NEW SECTION. Sec. 5. State and local government agencies using
21   a facial recognition service to make decisions that produce legal
22   effects concerning individuals or similarly significant effects
23   concerning individuals must ensure that those decisions are subject
24   to meaningful human review. Decisions that produce legal effects
25   concerning individuals or similarly significant effects concerning
26   individuals means decisions that result in the provision or denial of
27   financial and lending services, housing, insurance, education
28   enrollment, criminal justice, employment opportunities, health care
29   services, or access to basic necessities such as food and water.


30       NEW SECTION.   Sec. 6.   Prior to deploying a facial recognition
31   service in the context in which it will be used, state and local
32   government agencies using a facial recognition service to make
33   decisions that produce legal effects on individuals or similarly
34   significant effect on individuals must test the facial recognition
35   service in operational conditions. State and local government
36   agencies must take reasonable steps to ensure best quality results by


                                     p. 6                        ESSB 6280
 1   following all reasonable guidance provided by the developer of the
 2   facial recognition service.


 3       NEW SECTION.   Sec. 7.   (1) A state or local government agency
 4   that deploys a facial recognition service must require a facial
 5   recognition service provider to make available an application
 6   programming interface or other technical capability, chosen by the
 7   provider, to enable legitimate, independent, and reasonable tests of
 8   those facial recognition services for accuracy and unfair performance
 9   differences across distinct subpopulations. However, making such an
10   application programming interface or other technical capability
11   available does not require the disclosure of proprietary data, trade
12   secrets, intellectual property, or other information, or if doing so
13   would   increase  the   risk  of   cyberattacks   including,  without
14   limitation, cyberattacks related to unique methods of conducting
15   business, data unique to the product or services, or determining
16   prices or rates to be charged for services. Such subpopulations are
17   defined by visually detectable characteristics such as: (a) Race,
18   skin tone, ethnicity, gender, age, or disability status; or (b) other
19   protected characteristics that are objectively determinable or self-
20   identified by the individuals portrayed in the testing dataset. If
21   the results of the independent testing identify material unfair
22   performance differences across subpopulations, and the methodology,
23   data, and results are disclosed in a manner that allows full
24   reproduction directly to the provider who, acting reasonably,
25   determines that the methodology and results of that testing are
26   valid, then the provider must develop and implement a plan to
27   mitigate the identified performance differences.
28       (2) This section does not apply to the facial recognition
29   matching system authorized in RCW 46.20.037 under contract as of the
30   effective date of this section. Upon renewal or extension of the
31   contract as of the effective date of this section, or upon entering
32   into a new contract for facial recognition services, the department
33   of licensing must ensure that the facial recognition service provider
34   of the system authorized in RCW 46.20.037 fulfills the requirements
35   of this section.


36       NEW SECTION. Sec. 8. State and local government agencies using
37   a facial recognition service must conduct periodic training of all
38   individuals who operate a facial recognition service or who process
                                     p. 7                        ESSB 6280
 1   personal data obtained from the use of a facial recognition service.
 2   The training must include, but not be limited to, coverage of:
 3       (1) The capabilities and limitations of the facial recognition
 4   service;
 5       (2) Procedures to interpret and act on the output of the facial
 6   recognition service; and
 7       (3) To the extent applicable to the deployment context, the
 8   meaningful human review requirement for decisions that produce legal
 9   effects concerning individuals or similarly significant effects
10   concerning individuals.

11       NEW SECTION.   Sec. 9.   (1) State and local government agencies
12   must disclose their use of a facial recognition service on a criminal
13   defendant to that defendant in a timely manner prior to trial.
14       (2) State and local government agencies using a facial
15   recognition service shall maintain records of their use of the
16   service that are sufficient to facilitate public reporting and
17   auditing of compliance with agencies' facial recognition policies.
18       (3) In January of each year, any judge who has issued a warrant
19   for ongoing surveillance, or an extension thereof, as described in
20   section 12(1) of this act, that expired during the preceding year, or
21   who has denied approval of such a warrant during that year shall
22   report to the administrator for the courts:
23       (a) The fact that a warrant or extension was applied for;
24       (b) The fact that the warrant or extension was granted as applied
25   for, was modified, or was denied;
26       (c) The period of ongoing surveillance authorized by the warrant
27   and the number and duration of any extensions of the warrant;
28       (d) The identity of the applying investigative or law enforcement
29   officer and agency making the application and the person authorizing
30   the application; and
31       (e) The nature of the public spaces where the surveillance was
32   conducted.


33       NEW SECTION. Sec. 10. This chapter does not apply to a state or
34   local government agency that is mandated to use a specific facial
35   recognition service pursuant to a federal regulation or order.




                                     p. 8                        ESSB 6280
 1       NEW SECTION. Sec. 11. (1)(a) A legislative task force on facial
 2   recognition services is established, with members as provided in this
 3   subsection.
 4       (i) The president of the senate shall appoint one member from
 5   each of the two largest caucuses of the senate;
 6       (ii) The speaker of the house of representatives shall appoint
 7   one member from each of the two largest caucuses of the house of
 8   representatives;
 9       (iii) Eight representatives from advocacy organizations that
10   represent   individuals   or   protected    classes  of   communities
11   historically impacted by surveillance technologies including, but not
12   limited to, African American, Hispanic American, Native American, and
13   Asian American communities, religious minorities, protest and
14   activist groups, and other vulnerable communities;
15       (iv) Two members from law enforcement or other agencies of
16   government;
17       (v) One representative from a retailer or other company who
18   deploys facial recognition services in physical premises open to the
19   public;
20       (vi) Two representatives from consumer protection organizations;
21       (vii) Two representatives from companies that develop and provide
22   facial recognition services; and
23       (viii)   Two  representatives   from   universities   or  research
24   institutions who are experts in either facial recognition services or
25   their sociotechnical implications, or both.
26       (b) The task force shall choose two cochairs from among its
27   legislative membership.
28       (2) The task force shall review the following issues:
29       (a) Provide recommendations addressing the potential abuses and
30   threats posed by the use of a facial recognition service to civil
31   liberties and freedoms, privacy and security, and discrimination
32   against vulnerable communities, as well as other potential harm,
33   while also addressing how to facilitate and encourage the continued
34   development of a facial recognition service so that individuals,
35   businesses, government, and other stakeholders in society continue to
36   utilize its benefits;
37       (b)   Provide   recommendations   regarding   the   adequacy   and
38   effectiveness of applicable Washington state laws; and



                                     p. 9                        ESSB 6280
 1       (c) Conduct a study on the quality, accuracy, and efficacy of a
 2   facial recognition service including, but not limited to, its
 3   quality, accuracy, and efficacy across different subpopulations.
 4       (3) Staff support for the task force must be provided by senate
 5   committee services and the house of representatives office of program
 6   research.
 7       (4) Legislative members of the task force are reimbursed for
 8   travel expenses in accordance with RCW 44.04.120. Nonlegislative
 9   members are not entitled to be reimbursed for travel expenses if they
10   are elected officials or are participating on behalf of an employer,
11   governmental entity, or other organization. Any reimbursement for
12   other nonlegislative members is subject to chapter 43.03 RCW.
13       (5) The expenses of the task force must be paid jointly by the
14   senate and the house of representatives. Task force expenditures are
15   subject to approval by the senate facilities and operations committee
16   and the house of representatives executive rules committee, or their
17   successor committees.
18       (6) The task force shall report its findings and recommendations
19   to the governor and the appropriate committees of the legislature by
20   September 30, 2021.
21       (7) This section expires May 1, 2022.


22       NEW SECTION.   Sec. 12.   A new section is added to chapter 9.73
23   RCW to read as follows:
24       (1) State and local government agencies may not use a facial
25   recognition service to engage in ongoing surveillance unless the use
26   is in support of law enforcement activities and there is probable
27   cause to believe that an individual has committed, is engaged in, or
28   is about to commit, a felony or there is a need by law enforcement to
29   invoke their community care-taking function, and either:
30       (a) A court order has been obtained to permit the use of the
31   facial recognition service for ongoing surveillance; or
32       (b) Where the agency reasonably determines that an exigent
33   circumstance exists, and an appropriate court order is obtained as
34   soon as reasonably practicable. In the absence of an authorizing
35   order, such use must immediately terminate at the earliest of the
36   following:
37       (i) The information sought is obtained;
38       (ii) The application for the order is denied; or


                                     p. 10                       ESSB 6280
 1       (iii) When forty-eight hours have lapsed since the beginning of
 2   the emergency surveillance for the purpose of ongoing surveillance.
 3       (2) State and local government agencies must not apply a facial
 4   recognition service to any individual based on their religious,
 5   political, or social views or activities, participation in a
 6   particular noncriminal organization or lawful event, or actual or
 7   perceived race, ethnicity, citizenship, place of origin, age,
 8   disability, gender, gender identity, sexual orientation, or other
 9   characteristic protected by law. This subsection does not condone
10   profiling including, but not limited to, predictive law enforcement
11   tools. The prohibition in this subsection does not prohibit state and
12   local government agencies from applying a facial recognition service
13   to an individual who happens to possess one or more of these
14   characteristics where an officer of that agency holds a reasonable
15   suspicion that that individual has committed, is engaged in, or is
16   about to commit a felony or there is need to invoke their community
17   care-taking function.
18       (3) State and local government agencies may not use a facial
19   recognition service to create a record describing any individual's
20   exercise of rights guaranteed by the First Amendment of the United
21   States Constitution and by Article I, section 5 of the state
22   Constitution, unless:
23       (a) Such use is specifically authorized by applicable law and is
24   pertinent to and within the scope of an authorized law enforcement
25   activity; and
26       (b) There is reasonable suspicion to believe the individual has
27   committed, is engaged in, or is about to commit a felony or there is
28   need to invoke their community care-taking function.
29       (4) Law enforcement agencies that utilize body worn camera
30   recordings shall comply with the provisions of RCW 42.56.240(14).
31       (5) A facial recognition service match alone does not constitute
32   reasonable suspicion.


33       NEW SECTION.    Sec. 13.    Sections 1   through   10   of   this   act
34   constitute a new chapter in Title 43 RCW.

                                  --- END ---




                                     p. 11                            ESSB 6280


File and source

File

2020-02-28_a26767_bill_6280-s-e.pdf

Size

103,375 bytes

SHA-256

c212a1e746a5c45d99aafe7e8755a7f04414e9cdcba54de681b33bc5ce8598ea

Our copy

2020-02-28_a26767_bill_6280-s-e.pdf

Original

No public link identified.