New Regulations for the Use of Facial Recognition Technology

The state legislature passed ESSB 6280 during the 2020 Regular Session, regulating the use of facial recognition technology by state and local governments in Washington State.

The first state law of its kind nationwide, its purpose is to place safeguards on the “[u]nconstrained use of facial recognition services by state and local government agencies [which] poses broad social ramifications.” The intent of the safeguards is to “allow state and local government agencies to use facial recognition services in a manner that benefits society while prohibiting uses that threaten our democratic freedoms and put our civil liberties at risk.”

The law takes effect on July 1, 2021.

Background

Use of facial recognition technology is controversial. According to a 2019 study from the National Institute for Standards and Technology (a federal agency), facial recognition systems misidentified people of color more often than white people. While the study itself details this misidentification issue at great length, this 2019 Washington Post article summarizes the findings.    

Due to this high error rate as well as other concerns, a handful of cities, including Oakland and San Francisco, have banned the use of facial recognition technology. And, just recently, software and hardware companies, including Amazon, IBM, Google and Microsoft, announced that they will not provide facial recognition technology to police departments, with the goal of pushing the federal government into adopting comprehensive legislation to regulate use of the technology. Whether the federal legislation will mirror Washington State’s or will be even more robust remains to be seen.

Regulating Facial Technology Software Use in Washington

The purpose of this blog post is to highlight the requirements in ESSB 6280. Of course, prior to implementation, state and local agencies will need to determine what impact any federal legislation has on our new state law.  

Due to the bill’s 13-page length, this blog cannot cover all the fine points of the legislation: Rather, it will simply highlight several areas of the law. Those agencies currently using or planning to use facial recognition technology should give the bill a thorough read. (Note that ESSB 6280 doesn’t apply to state or local government agencies that use facial recognition technology in association with a federal agency to verify the identity of individuals traveling from/to an airport or seaport. It also doesn’t apply to state or local government agencies that are mandated to use the technology pursuant to a federal regulation or order or due to a congressional mandate.)

ESSB 6280 focuses on what it calls “facial recognition services,” which it defines as “technology that analyzes facial features and is used by a state or local government agency for the identification, verification, or persistent tracking of individuals in still or video images.” For those public records gurus out there, note that the law does not apply to the technology used to redact video recordings to protect an individual’s right to privacy in response to a Public Records Act (PRA) request (e.g., body camera redaction, as set forth in RCW 42.56.240(14)), so long as the redaction process does not generate or result in the retention of biometric data or surveillance information.

State and local governments intending to use facial recognition services are required to make a careful study of the service before implementing it, and those agencies currently using facial recognition services are required to study the service once their current service contract expires. This study must be detailed in an accountability report, with a public review and comment period plus at least three community consultation meetings prior to finalizing the report. This report is required to include a great deal of information, and below is a list of just some of these items:

• How the service will be used and what decisions will be made to support it;
• How, when, and by whom the service will be deployed or used, measures that will be taken to minimize inadvertent collection of unnecessary data, and how the agency will maintain and delete data collected by the service; 
• How data will be securely stored and accessed, and how, why, and whether an agency will share this data with other entities;
• Information on the service’s rate of false matches, potential impacts on protected subpopulations, and how the agency will address these error rates, and;
• A description of any potential impacts of the facial recognition service on civil rights and liberties, including disparate impacts to marginalized communities.

Other notable parts of the law include a requirement that if the agency uses the service to make decisions that produce legal effects (such as the provision or denial of housing, enrollment in educational institutions, or criminal justice findings) or that impact civil rights, the agency must ensure those decisions are subject to “meaningful human review.”

Final Thoughts

Use of facial recognition technology is a developing issue nationwide and it remains to be seen what, if any, federal legislation will be passed. In the meantime, any Washington State local governments that choose to use (and are able to secure) facial recognition technology will need to ensure compliance with ESSB 6280 by July 1, 2021.