Baltimore has joined Portland, OR, and New York City in passing its own local ordinance regulating the use of certain biometric technology. Baltimore's new ordinance was signed into law August 9th and will be effective as of September 8, 2021. The ordinance includes provisions restricting the City of Baltimore itself from buying any "face surveillance system" or hiring a contractor to deploy such a system on its behalf. Far more noteworthy, though, is the new prohibition on any "person" (individual, entity, or otherwise) "obtain[ing], retain[ing], or us[ing] in Baltimore City ... any face surveillance system; or ... any information obtained from a face surveillance system."
For purposes of the law, "face surveillance" means any "automated or semi-automated process that assists in identifying or verifying an individual based on the physical characteristics of an individual's face." A "face surveillance system" is any hardware or software that performs face surveillance - excluding any biometric security system designed specifically to restrict access to a particular location or electronic device.
Violation of the law is a criminal offense, punishable by a fine of up to $1,000 and imprisonment of not more than 12 months (or both). Each day in violation constitutes a separate offense.
Well-intentioned as this law may have been, the scope of the prohibited conduct and the potential for draconian penalties are - at the risk of being melodramatic - shocking. Ostensibly, come September 9th, an individual in Baltimore would commit a crime by use of something as seemingly benign as the feature included in some digital cameras that allows the owner to register the faces of known subjects (e.g., your children) in order for the camera to prioritize focusing on those subjects when taking pictures. One would imagine that prosecutorial discretion will save every tech-savvy Baltimore parent from a stint in jail - but even passing a law this broad in the first place is cause for concern.
If you reside in Baltimore or your business has on-the-ground operations in Baltimore, consider whether you are using anything that could be considered a "face surveillance system" under this new law. Similarly, if your business sells to users in Baltimore any internet-connected product that might be deemed a "face surveillance system," consider whether your business may at any point obtain facial-recognition data through a consumer's use of that product. In either case, you may need to take action now to avoid running afoul of Baltimore's new law when it comes into effect next month.
Finally, note that the law does include a sunset period. Unless further action is taking by the City Council, the law will expire automatically on December 31, 2022. Hopefully, if the City Council extends this law past 2022, it will consider the ramifications of the current iteration and narrow the scope accordingly before doing so.
Originally published August 27, 2021
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
