On March 31, 2020, Jay Inslee, the governor of Washington, signed into law "An Act Relating to the Use of Facial Recognition Services." The new law, which takes effect July 1, 2021, regulates the use of facial recognition technology by state and local government agencies, without banning the technology outright. In light of the law's measured approach and the backing it received from Microsoft, it is being hailed as a model for other states and the federal government. This client alert highlights areas of the new law of particular interest to providers of facial recognition services.
The Purpose of the New Law
The law establishes safeguards designed to allow state and local government agencies to use facial recognition services in a manner that benefits society, while protecting freedoms and civil liberties. The law notes that state and local government agencies may use facial recognition services to locate or identify missing or deceased persons, including children, indigenous women, and senior citizens.
Notice of Intent / Accountability Report
The law establishes a multi-step process for state or local government agencies wishing to use a facial recognition service. As the first step in the process, the agency must file a notice of intent specifying the intended purpose of the facial recognition service. Following that, the agency must prepare an accountability report, setting out required information, including:
" The name of the facial recognition service, vendor, and version; and a description of the service's general capabilities and limitations.
" A description of the purpose and proposed use of the facial recognition service and its intended benefits.
" The type(s) of data inputs that the technology uses; how the data is generated, collected, and processed; and the type(s) of data the system is reasonably likely to generate.
" Information on the facial recognition service's rate of false matches and potential impact on protected subpopulations; and how the agency will address error rates greater than one percent.
" A description of any potential impacts on civil rights and liberties, and the specific steps the agency will take to mitigate these potential impacts.
The agency must make the accountability report available to the public for review and comment, hold at least three community consultation meetings, and consider any issues raised by the public. Once the accountability report is final, the agency must make it public at least ninety days before using the facial recognition service, post it on its website, and submit it to a supervisory authority. The agency must also require the service provider to disclose any complaints or reports of bias regarding the service.
Independent Testing–Application Programming Interface
The new law requires service providers to provide an application programming interface or other technology designed to allow independent testing of the facial recognition service for accuracy and unfair performance. If the results of the independent testing identify material unfair performance differences across subpopulations, the provider will be required to develop and implement a plan to mitigate the identified performance differences within ninety days.
Meaningful Human Review of Significant Decisions
When using a facial recognition service to make certain significant decisions, a state or local government agency will be required to ensure a meaningful human review. This applies to decisions that affect financial and lending services, housing, insurance, education, criminal justice, employment opportunities, health care services, necessities, or civil rights.
Judicial Protections for Certain Activities
The new law specifically addresses the use of facial recognition services for ongoing surveillance, real-time or near real-time identification, and persistent tracking. A state or local government authority cannot engage in any of these activities unless (a) it obtains a warrant, (b) exigent circumstances exist, or (c) it obtains a court order.
Protection of Civil Rights
The law prohibits a state or local government agency from applying facial recognition services to any individual based on religious, political or social views or activities; participation in a particular non-criminal organization or lawful event; or actual or perceived race, ethnicity, citizenship, place of origin, immigration status, age, disability, gender, gender identity, sexual orientation or other characteristic protected by law. The law also prohibits an agency from using facial recognition services to create a record describing an individual's exercise of rights guaranteed by the First Amendment to the United States Constitution or the right to freedom of speech under the Constitution of the State of Washington.
Conclusion
The new Washington law is a groundbreaking attempt to regulate facial recognition technology in the public sector. While the law applies to state and local government agencies, the burden of complying with it will also fall on providers of facial recognition services to those agencies. Among other things, providers of facial recognition services will have to disclose information about their technology, submit to independent testing, and demonstrate that their technology produces fair results.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
