Law / United States / Oregon / Portland
Prohibit the Use of Face Recognition Technologies by Private Entities in Places of Public Accommodation
Portland City Code ch. 34.10 (secs. 34.10.010 to 34.10.060)
In force since .
A biometric privacy rule binding private bodies.
- Audit expectation
- none
What it requires
- Inside Portland, a product built for or offered to a place of public accommodation must not use face recognition technology to identify, verify, detect, or characterize an individual's facial features, unless the use falls within the ordinance's exceptions for legal compliance, an individual unlocking their own device, or automatic face detection inside a social media application.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
Section 34.10.050.A lets a person injured by a material violation recover actual damages or $1,000 per day for each day of violation, whichever is greater. The $1,000 is counted per day of violation, not per person. Attorney fees are available only on the written demand section 34.10.050.B describes.
- As of
- Currency
- USD
- Per person minimum
- 1,000
Who enforces it
Enforcement body
Persons injured by a material violation, by a civil action in any court of competent jurisdiction under section 34.10.050.A. The chapter names no city agency to enforce it.
Settledness
- As of
- Open questions
- Does a one-to-one comparison that verifies a patron's face against a single stored image, rather than a search of an image repository, count as 'Face Recognition Technologies' under Portland City Code 34.10.020(B), when 34.10.020(A) defines Face Recognition as a one-to-many search?
- Does a process that only detects or characterizes a face, for example by estimating age or mood without identifying anyone, come within 'detecting, or characterizing facial features of an individual' in Portland City Code 34.10.020(B)?
What it reaches
How the hook was established
express
What it reaches
capability
What makes it apply
Place of effect
Obligation class
Biometric, Prohibition
Applicability criteria
Private Entity and Places of Public Accommodation are defined in section 34.10.020; a Private Entity does not include a Government Agency, and section 34.10.040 lists exceptions.
- As of
- Combinator
- All of
- Criteria
- a Private Entity shall not use Face Recognition Technologies in Places of Public Accommodation within the boundaries of the City of Portland
What it makes you log
Logging duty
Chapter 34.10 prohibits a private entity from using face recognition technologies in places of public accommodation within the city, lists exceptions and gives an injured person a damages action. It requires no log or record, sets no retention period and names no reader of a record; the exception for use needed to comply with federal, state or local law (34.10.040(A)) is not a record duty. The reach is the place of use: a place of public accommodation within the boundaries of the City of Portland.
- Kind
- None
- As of
What this law does
A private entity may not use face recognition technology in a place of public accommodation within Portland, subject to exceptions for legal compliance, an individual's own device unlock, and automatic face detection in social media applications. A person injured by a material violation may recover actual damages or a statutory $1,000 per day of violation, whichever is greater, plus attorney fees and costs.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .