Law / United States / 
Utah
Government Use of Facial Recognition Technology
In force since .
A biometric privacy rule binding government bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Biometric, Prohibition, Disclosure, Reporting
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Filed with regulator, Produced on request
As of .
What it requires
- This chapter binds a Utah government entity, a term that includes an individual acting as an agent of, or on behalf of, a government entity.
- Do not use a facial recognition system on an image database, or for a civil immigration violation, except as the chapter allows.
- Run a facial recognition comparison only on a request from a law enforcement agency that includes a case identification number and, for a crime investigation, a statement of the specific crime and a factual narrative, and only to investigate a felony, a violent crime or a threat to human life, or to identify an individual who is deceased, incapacitated or at risk.
- Have a trained employee make each comparison with a secure system that compares only facial biometric data, make an independent visual comparison of any possible match, obtain a second opinion, and report only a result all trained employees agree is a probable match, through an encrypted method.
- Notify an individual whose image you capture when the individual interacts with you that the image may be used in conjunction with facial recognition technology.
- At least 30 days before a government entity other than the Department of Public Safety begins using a facial recognition system on its image database, publish notice and a description of the database on its website, allow written public comment for 15 days, consider timely comments and post notice of the final decision.
- Do not use or share data relating to a facial recognition comparison for any purpose other than a purpose the chapter describes.
- On request, release statistical information about facial recognition comparisons, and between August 1 and October 15 each year report to the Government Operations Interim Committee the types of crime requested, the number of requests for each type, the number of probable matches provided and the image source of each match.
- When a law enforcement agency submits a case to a prosecutor, disclose in writing whether a facial recognition system was used in the investigation and how the comparison was used.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Public
What the log must hold
Access record, Data lineage
Logging duty
A government entity that runs facial recognition comparisons must release statistics on request and report each year the types of crime requested, the requests for each type, the probable matches provided and the image source of each match. The chapter names no log but the counts cannot be reported without a record of each request and result.
- Kind
- Implicit
- As of
- Provision
- Utah Code 77-23e-106(2)(a) and (3)(a)
- Trigger
- personal_data_processing
What this law does
The Governor signed Senate Bill 34 of the 2021 General Session on , and the chapter took effect on as chapter 200 of the Laws of Utah 2021. Except as the chapter allows, a government entity may not use a facial recognition system on an image database. A government entity may not use a facial recognition system for a civil immigration violation.
Only a law enforcement agency may make a request for a government entity to conduct a facial recognition comparison using a facial recognition system. A trained employee completes a request only if it includes a case identification number and, for an investigation of a crime, is supported by a statement of the specific crime and a factual narrative.
A trained employee may comply only with requests made to investigate a felony, a violent crime or a threat to human life, or to identify an individual who is deceased, incapacitated or at risk and unable to provide his or her identity. To make a comparison, a trained employee must use a secure system that compares only facial biometric data and make an independent visual comparison of any possible match.
The employee must then seek a second opinion and report a result to the requesting law enforcement agency through an encrypted method, returning only a result that all trained employees agree is a probable match. The chapter defines the department as the Department of Public Safety. The department is the only government entity in the state authorized to use a facial recognition system to conduct a facial recognition comparison on an image database that it maintains or that is shared with it.
When capturing an image of an individual who interacts with it, a government entity must notify the individual that the image may be used in conjunction with facial recognition technology.
At least 30 days before a government entity other than the department begins using a facial recognition system on its image database, it must publish notice and a description of the database on its website, allow written public comment for 15 days, consider timely comments and post notice of its final decision. Data relating to a facial recognition comparison may not be used or shared for any purpose other than a purpose described in the chapter.
Upon request, a government entity must release statistical information regarding facial recognition comparisons. Between August 1 and October 15 each year, a government entity that uses a facial recognition system to conduct a comparison must report to the Government Operations Interim Committee the types of crime for which the department received a request, the number of requests for each type, the number of probable matches provided and the image source of each match.
When submitting a case to a prosecutor, a law enforcement agency must disclose in writing whether a facial recognition system was used in the investigation and, if so, how the comparison was used. A government entity includes an individual acting as an agent of a government entity or acting on behalf of one.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.