Government Use of Facial Recognition Services by State and Local Agencies

Senate Bill 22-113 was signed by the Governor on June 8, 2022. Part 3 of article 18 of title 24 took effect on August 10, 2022, as chapter 463 of the 2022 session laws. An agency under the part is an agency of the state government or of a local government, or a state institution of higher education. A local government is a statutory or home rule municipality, a county, or a city and county.

The reporting authority is the city council, county commission, or other local government body in which legislative powers are vested for a local government agency, and the office of information technology for a state agency. An agency that uses or intends to develop, procure, or use a facial recognition service must file with its reporting authority a notice of intent and specify a purpose for which the technology is to be used.

After filing the notice, and before developing, procuring, using, or continuing to use a facial recognition service, an agency must produce an accountability report for the service. The accountability report must give the name, vendor and version of the service, a description of its general capabilities and limitations, and the type of data inputs it uses.

The accountability report must include a clear use and data management policy with protocols on how, when and by whom the service will be deployed or used and to whom data will be available. The use and data management policy must cover how long the agency will keep the data and the processes by which data will be deleted.

The accountability report must also describe the agency's testing procedures, the service's rate of false matches and potential impacts on protected subpopulations, its potential impacts on civil rights and liberties, and the agency's procedures for receiving feedback.

Before finalizing an accountability report, an agency must allow a public review and comment period, hold at least three public meetings to obtain feedback from communities, and consider the issues the public raised at those meetings. At least ninety days before an agency puts a facial recognition service into operational use, it must post the final adopted accountability report on its public website and submit it to its reporting authority.

An agency must update its final accountability report and submit the update to its reporting authority at least every two years. An agency seeking to procure a facial recognition service must require each vendor to disclose any complaints or reports of bias regarding the vendor's service.

An agency seeking to use a facial recognition service for a purpose not disclosed in its existing accountability report must seek and consider public comments and community input on the new use and adopt an updated accountability report in response.

The accountability report requirements do not apply to an agency's procurement or use of a facial recognition service that is part of a generally available consumer product, is included only for personal or household use, and is certified publicly by the agency not to be the reason for the procurement or use and not to be used for governmental purposes.

An agency using a facial recognition service to make decisions that produce legal effects concerning individuals or similarly significant effects concerning individuals must ensure that those decisions are subject to meaningful human review.

The decisions that produce legal effects or similarly significant effects concerning individuals are decisions that result in the provision or denial of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health-care services, or access to basic necessities such as food and water, or that impact the civil rights of individuals.

Before deploying a facial recognition service in a context in which it will be used to make those decisions, an agency must test the service in operational conditions. An agency that deploys a facial recognition service must require the provider to make available an application programming interface or other technical capability to enable legitimate, independent, and reasonable tests of the service for accuracy and to identify unfair performance differences across distinct subpopulations.

The testing requirements do not apply if the provider is a participant in the face recognition vendor test ongoing project of the national institute of standards and technology. An agency using a facial recognition service must conduct periodic training of all individuals who operate the service or who process personal data obtained from its use.

The training must cover the capabilities and limitations of the service, procedures to interpret and act on its output, and, to the extent applicable to the deployment context, the meaningful human review requirement. An agency using a facial recognition service must maintain records of its use of the service that are sufficient to facilitate public reporting and auditing of compliance with its use and data management policies.

A law enforcement agency may not use a facial recognition service to engage in ongoing surveillance, conduct real-time or near real-time identification, or start persistent tracking unless it obtains a warrant authorizing the use, the use is necessary to develop leads in an investigation, it has established probable cause for the use, or it obtains a court order authorizing the use for the sole purpose of locating or identifying a missing person or identifying a deceased person.

A law enforcement agency may not apply a facial recognition service to any individual based on the individual's religious, political, or social views or activities, participation in a particular noncriminal organization or lawful event, or actual or perceived race, ethnicity, citizenship, place of origin, immigration status, age, disability, gender, gender expression, gender identity, sexual orientation, or other characteristic protected by law.

A law enforcement agency may not use a facial recognition service to create a record depicting any individual's exercise of rights guaranteed by the first amendment of the United States constitution and by section 10 of article II of the state constitution. A law enforcement agency may not use the results of a facial recognition service as the sole basis to establish probable cause in a criminal investigation.

A law enforcement agency may not substantively manipulate an image for use in a facial recognition service in a manner not consistent with the provider's intended use and training. An agency must disclose its use of a facial recognition service on a criminal defendant to that defendant in a timely manner before trial.

In January of each year, an agency that has applied for a warrant or an extension of a warrant to use a facial recognition service for surveillance must give its reporting authority a report summarizing nonidentifying demographic data of the individuals named in the applications as subjects of surveillance.

The part does not apply to an agency that is required to use a specific facial recognition service under a federal regulation or order or uses one in partnership with a federal agency to fulfill a congressional mandate, fulfill aviation security directives, or comply with federal law, to an agency that uses one in association with a federal agency to verify the identity of individuals presenting themselves for travel at an airport, to an agency that uses one in connection with a physical access control system to grant or deny access to a secure area, to a state agency's use solely for research purposes that does not result in or affect decisions that produce legal effects or similarly significant effects concerning individuals, or to a utility.