Signed by Governor Jay Inslee

Full Bill Text

Vote Smart's Synopsis:

Vote to adopt a conference report that establishes regulations for facial-recognition technology.

Highlights:

• Requires a state or local government agency using or intending to develop, procure, or use a facial recognition service, to file a notice of intent with a legislative authority, and specify the purpose for which the technology is to be used (Sec. 3).

• Defines “facial recognition service” as a technology that analyzes facial features and is used by a state or local government agency for the identification, verification, or persistent tracking of individuals in still or video images (Sec. 2).

• Requires that prior to developing, procuring, or using a facial recognition service, a state or local government agency must produce an accountability report for that service, and each report must include the following statements (Sec. 3):

• The name of the facial recognition service, vendor, and version, and a description of its general capabilities and limitations; 

• The type of data inputs that the technology uses, how that data is generated, collected and processed, and the type of data the system is reasonably likely to generate; 

• A description of the purpose and proposed use of the facial recognition service, including what decision will be used to make or support it, whether it is a final or support decision system, and its intended benefits; 

• A clear use and data management policy, including protocols for the following:

• How and when the facial recognition service will be used and by whom, including the factors that will be used to determine where, when, and how the technology is deployed and other relevant information such as whether the technology will be operated continuously or used only under specific circumstances; 

• Any measures that are taken to minimize the inadvertent collection of additional data beyond the amount necessary for the specific purpose for which the facial recognition service will be used; 

• Data integrity and retention policies applicable to the data collected using the facial recognition service, including how the agency will maintain and update records used in connection with the service, how long the agency will keep the data, and the processes by which data will be deleted; 

• Additional rules that will govern the use of the facial recognition service and what process will be required prior to each use of the facial recognition service; 

• Data security measures applicable to the facial recognition service, including how data collected using the facial recognition service will be securely stored and accessed, and if an agency intends to share access to the facial recognition service or the data from that facial recognition service with any other entity; 

• How the facial recognition service provider intends to fulfill security breach notification requirements and how the agency intends to fulfill security breach notification requirements; and 

• The agency’s training procedures, including those implemented in accordance with section 7 of this act, and how the agency will ensure that all personnel who operate the facial recognition service or access its data are knowledgeable about and able to ensure compliance with the use and data management policy. 

• The agency’s testing procedures, including its processes for periodically undertaking operational tests of the facial recognition service in accordance with section 5 of this act; 

• Information on the facial recognition service’s rate of false matches, potential impacts on protected sub-populations, and how the agency will address error rates  greater than one percent; 

• A description of any potential impacts of the facial recognition service on civil rights and liberties, including potential impacts to privacy and potential disparate impacts on marginalized communities, and the specific steps the agency will take to mitigate the potential impacts and prevent unauthorized usage; and

• The agency’s procedures for receiving feedback as well as procedures for responding to feedback. 

• Requires a state or local government agency using a facial recognition service to make decisions that produce legal effects concerning individuals or similarly significant effects concerning individuals to ensure that those decisions are subject to meaningful human review (Sec. 4).

• Specifies that the decisions that produce legal effects concerning individuals or similarly significant effects concerning individuals, refer to decisions that result in the provision or denial of financial and lending services, housing, insurance, education enrollment, criminal justice, or access to basic necessities such as food and water, or that impact civil rights of individuals (Sec. 4). 

• Requires a state or local government, prior to deploying a facial recognition service in the context in which it will be used, to make decisions that produce legal effects on individuals or similarly significant effects on individuals to test the facial recognition service in operational conditions (Sec. 5).

• Requires a state or local government agency that deploys a facial recognition service to require a facial recognition service provider to make an application available to enable legitimate, independent, and reasonable tests of those facial recognition services for accuracy and unfair performance difference across distinct sub-populations (Sec. 6).

• Specifies that such sub-population is defined by visually detectable characteristics such as race, skin tone, ethnicity, gender, age, or disability status, or other protected characteristics that are objectively determinable or self-identifiable by the individuals portrayed in the testing dataset (Sec. 6).

• Requires a state or local government agency using a facial recognition service to conduct periodic training of all individuals who operate a facial recognition service or who process personal data obtained from the use of a facial recognition service, which must include coverage of (Sec. 7):

• The capabilities and limitations of the facial recognition service; 

• Procedures to interpret and act on the output of the facial recognition service; and 

• To the extent applicable to the deployment context, the meaningful human review requirement for decisions that produce legal effects concerning individuals or similarly significant effects concerning individuals. 

• Requires a state or local government agency to disclose their use of a facial recognition service on a criminal defendant to that defendant in a timely manner prior to trial (Sec. 8).

• Specifies that this act does not apply to a state or local government agency that (Sec. 9):

• Is mandated to use a specific facial recognition service pursuant to federal regulations or orders, or that is undertaken through a partnership with a federal agency to fulfill a congressional mandate; or

• Uses a facial recognition service in association with a federal agency to verify the identity of individuals presenting themselves for travel at an airport or seaport.

• Requires the William D. Ruckelshaus Center to establish a facial recognition task force to provide recommendations addressing the potential abuses and threats posed by the use of a facial recognition service to civil liberties and freedoms, privacy and security, and discrimination against vulnerable communities, as well as other potential harm, which addresses how to facilitate and encourage the continued development of a facial recognition service so that individuals, businesses, government, and other stakeholders in society continue to utilize its benefits (Sec. 10).

• Prohibits a state or local government agency from using a facial recognition service to engage in ongoing surveillance, conduct real-time or near real-time identification, or start persistent tracking, unless (Sec. 11):

• A warrant is obtained authorizing the use of the service for those purposes; 

• Exigent circumstances exist; or

• A court order is obtained authorizing the use of the service for the sole purpose of locating or identifying a missing person or identifying a deceased person. 

• Prohibits a state or local government agency from using a facial recognition service to create a record describing any individual’s exercise of rights guaranteed by the First Amendment of the United States Constitution (Sec. 11).

• Prohibits a state or local law enforcement agency from using the results of a facial recognition service as the sole basis to establish probable cause in a criminal investigation (Sec. 11).

• Requires the agency, before finalizing the accountability report, to (Sec. 3):

• Allow for a public review and comment period; 

• Hold at least 3 community consultation meetings; and

• Consider the issues raised by the public through the public review and comment period and the community consultation meetings.

• Requires the accountability report to be updated every 2 years, which must include public comment and community consultation processes (Sec. 3).

Vote Smart's Synopsis:

Vote to pass a bill that establishes regulations for facial recognition technology.

Highlights:

• Defines “facial recognition service” as technology that analyzes facial features and is used by a state or local government agency for the identification, verification, or persistent tracking of individuals in still or video images (Sec. 2).

• Requires a state or local government agency using or intending to develop, procure, or use a facial recognition service to produce an accountability report for that service, which must be posted on the public website of the consolidated technology services agency (Sec. 3).

• Requires the agency, before finalizing and implementing the accountability report, to consider issues raised by the public through (Sec. 3):

• A public review and comment period; and

• Community consultation meetings during the public review period.

• Requires the accountability report to be updated every 2 years, which must include public comment and community consultation processes (Sec. 3).

• Specifies that the accountability report required for the facial recognition matching system will be due July 1, 2021 (Sec. 3).

• Requires state and local government agencies using a facial recognition service to prepare and publish an annual report that discloses (Sec. 4):

• The extent of their use of such services;

• An assessment of compliance with the terms of their accountability report;

• Any known or reasonably suspected violations of their accountability report, including categories of complaints alleging violations; and

• Any revisions to the accountability report recommended by the agency during the next policy update.

• Requires all agencies to hold community meetings to review and discuss their annual report within 60 days of its public release (Sec. 4).

• Requires state and local government agencies to test a facial recognition service in operational conditions before using the facial recognition service in its relevant context (Sec. 6).

• Requires a state or local government agency using a facial recognition service to mandate that the facial recognition service provider provide an application programming interface or other technical capability to enable legitimate, independent, and reasonable tests of those facial recognition services for accuracy and unfair performance differences across distinct subpopulations (Sec. 7).

• Requires a state or local government agency using a facial recognition service to conduct periodic training of all individuals who operate a facial recognition service or who process personal data from the facial recognition service (Sec. 8).

• Requires a state or local government agency to disclose their use of a facial recognition service on a criminal defendant to that defendant in a timely manner before trial (Sec. 9).

• Establishes a legislative task force on facial recognition services, which must report its findings and recommendations to the governor and appropriate committees by September 30, 2021 (Sec. 11).

• Prohibits state and local government agencies from using facial recognition services to engage in ongoing surveillance unless the use is in support of law enforcement activities and there is probable cause to believe that an individual has committed, is engaged in, or is about to commit, a felony or there is a need by law enforcement to invoke their community care-taking function (Sec. 12).

Full Bill Text