Bill Summary – FastDemocracy

68th Legislature                                                                                                    SB 397.1
                                                 SENATE BILL NO. 397
   INTRODUCED BY K. BOGNER, K. ZOLNIKOV, K. SULLIVAN, J. ESP, S. HINEBAUCH, S. FITZPATRICK, M.
                         NOLAND, D. LENZ, S. MORIGEAU, J. ELLSWORTH, D. ZOLNIKOV
  4
   A BILL FOR AN ACT ENTITLED: “AN ACT ESTABLISHING THE FACIAL RECOGNITION FOR
   GOVERNMENT USE ACT; PROVIDING A PURPOSE; PROHIBITING THE USE OF CONTINUOUS FACIAL
   SURVEILLANCE; PROHIBITING THE USE OF FACIAL RECOGNITION TECHNOLOGY; PROVIDING
   EXEMPTIONS FOR LAW ENFORCEMENT; PROVIDING EXEMPTIONS UNDER CERTAIN CONDITIONS;
   PROVIDING FOR NOTICE REQUIREMENTS; PROVIDING FOR RETENTION AND DESTRUCTION
   REQUIREMENTS; PROVIDING FOR REPORTING REQUIREMENTS; PROVIDING FOR PENALTIES;
   PROVIDING DEFINITIONS; PROVIDING FOR A TRANSITION; AND PROVIDING AN IMMEDIATE
   EFFECTIVE DATE AND A RETROACTIVE APPLICABILITY DATE.”
 13
   BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:
 15
              NEW SECTION. Section 1.      Short title. [Sections 1 through 12] may be cited as the "Facial
   Recognition for Government Use Act".
 18
              NEW SECTION. Section 2.      Purpose. (1) Except as provided in subsection (2), the purpose of
   [sections 1 through 12] is to prohibit the use of facial recognition technology for continuous facial surveillance or
   facial identification by state and local government agencies and law enforcement agencies.
              (2)   It is the intent of the legislature to provide state and local government agencies the guidelines
   to use, or contract with third parties to use on their behalf, facial verification and to provide law enforcement
   agencies the ability to use facial recognition technology for investigations of serious crimes.
 25
              NEW SECTION. Section 3.      Definitions. As used in [sections 1 through 12], unless the context
   clearly indicates otherwise, the following definitions apply:
              (1)   "Affirmative authorization" means an action that demonstrates the intentional decision by an
                                                                -1-                      Authorized Print Version – SB 397
68th Legislature                                                                                                    SB 397.1
   individual to opt into the retention of the individual's facial biometric data by a third-party vendor.
              (2)    "Another jurisdiction" means the federal government, the United States military, the District of
   Columbia, the Commonwealth of Puerto Rico, the Commonwealth of the Northern Mariana Islands, the United
   States Virgin Islands, Guam, American Samoa, a federally recognized Indian tribe, or a state other than
   Montana.
              (3)    "Continuous facial surveillance" means the generalized monitoring of public places or third-
   party image sets using facial recognition technology for facial identification to match faces with a prepopulated
   list of face images. The term includes but is not limited to scanning stored video footage to identify faces in the
   stored data, real-time scanning of video surveillance to identify faces passing by the cameras, and passively
   monitoring video footage using facial recognition technology for general surveillance purposes without a
   particularized suspicion of a specific target.
              (4)    "Department" means the department of justice.
              (5)    "Digital driver's license" means a secure version of an individual's physical driver's license or
   identification card that is stored on the individual's mobile device.
              (6)    "Facial biometric data" means data derived from a measurement, pattern, contour, or other
   characteristic of an individual's face, either directly or from an image.
              (7)    (a) "Facial identification" means a computer system that, for the purpose of attempting to
   determine the identity of an unknown individual, uses an algorithm to compare the facial biometric data of an
   unknown individual derived from a photograph, video, or image to a database of photographs or images and
   associated facial biometric data in order to identify potential matches.
              (b)    The term does not include:
              (i)    a system used specifically to protect against unauthorized access to a particular location or an
   electronic device; or
              (ii)   a system a consumer uses for the consumer's private purposes.
              (8)    "Facial recognition service" or "facial recognition technology" means the use of facial
   identification or facial verification.
              (9)    "Facial verification" means the automated process of comparing an image or facial biometric
   data of a known individual to an image database, or to government documentation containing an image of the
                                                                 -2-                       Authorized Print Version – SB 397
68th Legislature                                                                                                     SB 397.1
   known individual, to identify a potential match in pursuit of the individual’s identity.
              (10)   "Law enforcement agency" means:
              (a)    an agency or officer of the state of Montana or of a political subdivision that is empowered by
   the laws of this state to conduct investigations or to make arrests; and
              (b)    an attorney, including the attorney general, who is authorized by the laws of this state to
   prosecute or to participate in the prosecution of a person who is arrested or who may be subject to a civil action
   related to or concerning an arrest.
              (11)   "Motor vehicle division" means the division within the department of justice authorized to issue
   driver's licenses.
              (12)   "Personal information" has the same meaning as in 30-14-1704.
              (13)   "Public building" means any building that the state or any political subdivision of the state
   maintains for the use of the public.
              (14)   "Public employee" means a person employed by a state or local government agency, including
   but not limited to a peace officer.
              (15)   "Public official" means a person elected or appointed to a public office that is part of a state or
   local government agency.
              (16)   "Public roads and highways of this state" has the same meaning as in 15-70-401.
              (17)   "Serious crime" means:
              (a)    a crime under the laws of this state that is a violation of 45-5-102, 45-5-103, 45-5-104, 45-5-
   106, 45-5-202, 45-5-210, 45-5-212, 45-5-213, 45-5-220, 45-5-302, 45-5-303, 45-5-401, 45-5-503, 45-5-508, 45-
   5-625, 45-5-627, 45-5-628, 45-5-702, 45-5-704, or 45-5-705; or
              (b)    a crime under the laws of another jurisdiction that is substantially similar to a crime under
   subsection (17)(a).
              (18)   "State or local government agency" means a state, county, or municipal government, a
   department, agency, or subdivision of a state, county, or municipal government, or any other entity identified in
   law as a public instrumentality. The term does not include a school district or law enforcement agency.
              (19)   "Vendor" has the same meaning as in 18-4-123.
 28
                                                                  -3-                      Authorized Print Version – SB 397
68th Legislature                                                                                                      SB 397.1
              NEW SECTION. Section 4.         Prohibition of continuous facial surveillance. (1) A state or local
   government agency, law enforcement agency, public employee, or public official may not obtain, retain,
   possess, access, request, contract for, or use continuous facial surveillance.
              (2)      The use of facial recognition technology for facial verification, including any resulting data, may
   not be used to aid or assist in any type of continuous facial surveillance.
  6
              NEW SECTION. Section 5.         Prohibition of facial recognition technology. (1) Except as provided in
   [sections 6 and 8], a state or local government agency, law enforcement agency, public employee, or public
   official may not:
              (a)      obtain, retain, possess, access, request, or use facial recognition technology or information
   derived from a search using facial recognition technology;
              (b)      enter into an agreement with a third-party vendor for any purpose listed in subsection (1)(a); or
              (c)      install or equip a continuous facial surveillance monitoring camera on public buildings or on
   public roads and highways of this state, except as provided in 46-5-117.
              (2)      The motor vehicle division may not establish a digital driver's license program that utilizes facial
   recognition technology without the consent of the legislature.
 17
              NEW SECTION. Section 6.         Use of facial recognition technology by law enforcement -- when
   permitted -- restrictions on use -- warrant required. (1) The department of justice is the only state or local
   government agency authorized to use facial recognition technology for criminal investigations. A request from a
   law enforcement agency for a search using facial recognition technology must be made to the criminal
   intelligence information section established in 44-5-501.
              (2)      A law enforcement agency may request a search using facial recognition technology and may
   obtain, retain, possess, access, or use the results of a search using facial recognition technology, as provided
   in subsection (3), for the purpose of:
              (a)      investigating a serious crime when there is probable cause to believe that an unidentified
   individual in an image has committed, is a victim of, or is a witness to a serious crime;
              (b)      assisting in the location or identification of a missing or endangered person; or
                                                                   -4-                      Authorized Print Version – SB 397
68th Legislature                                                                                                      SB 397.1
              (c)   assisting in the identification of a person who is deceased or believed to be deceased.
              (3)   Except as provided in subsection (5), a law enforcement agency shall obtain a warrant prior to
   requesting a search using facial recognition technology under subsection (2).
              (4)   A law enforcement agency shall obtain a court order authorizing the use of facial recognition
   technology for the sole purpose of locating or identifying a missing person or identifying a deceased person
   under subsections (2)(b) and (2)(c). A court may issue an ex parte order under this subsection if a law
   enforcement agency certifies and the court finds that the information to be obtained is likely relevant to locating
   or identifying a missing person or identifying a deceased person.
              (5)   (a) A law enforcement agency may submit a request for a search under subsection (2) using
   facial recognition technology prior to the issuance of a warrant if there is an emergency posing an imminent
   threat to a person. If an emergency exists under this subsection (5)(a), the law enforcement agency shall obtain
   a warrant within 24 hours of the request and submit the warrant to the criminal intelligence information section.
              (b)   The use of facial recognition technology must terminate immediately if the application for a
   warrant under subsection (5)(a) is denied.
              (6)   A law enforcement agency may not use the results of facial recognition technology as the sole
   basis to establish probable cause in a criminal investigation. The results of the use of facial recognition
   technology may be used in conjunction with other information and evidence lawfully obtained by a law
   enforcement officer to establish probable cause in a criminal investigation.
              (7)   A law enforcement agency may not use facial recognition technology to identify an individual
   based on a sketch or other manually produced image.
              (8)   A law enforcement agency may not substantively manipulate an image for use with facial
   recognition technology in a manner not consistent with the facial recognition technology provider's intended use
   and training.
              (9)   When using facial recognition for identification of an individual, the department shall employ
   meaningful human review prior to making an adverse final decision.
 26
              NEW SECTION. Section 7.      Disclosure to criminal defendants. (1) A law enforcement agency or
   the department shall disclose the use of facial recognition technology on a criminal defendant to that defendant
                                                                -5-                     Authorized Print Version – SB 397
68th Legislature                                                                                                      SB 397.1
   in a timely manner prior to trial.
              (2)    Discovery of an application, affidavit, or court order relating to the use of facial recognition and
   any documents related to the use or request for use of facial recognition technology, if any, are subject to the
   provisions in Title 46, chapter 15.
              (3)    Data derived from the use of facial recognition technology in violation of [sections 1 through
   12]:
              (a)    must be considered unlawfully obtained and, except as otherwise provided by law, must be
   deleted on discovery; and
              (b)    is inadmissible in evidence in a proceeding in or before a public official, department, regulatory
   body, or authority.
 11
              NEW SECTION. Section 8.       Use of facial recognition technology by state and local government
   agencies -- when permitted -- restrictions on use -- exemption. (1) A state or local government agency may
   use, or contract with a third-party vendor for the use of, facial verification if the state or local government
   agency first provides a written use and privacy policy regarding facial recognition technology. The written policy
   must include, at a minimum:
              (a)    the specific purpose for facial verification by the state or local government agency;
              (b)    the length of term for which facial biometric data is being collected or stored; and
              (c)    notice that facial biometric data may not be collected on an individual without prior written
   consent by the individual.
              (2)    The state or local government agency must include an option for access to services without the
   use of facial verification.
              (3)    A third-party vendor who is contracted with a state or local government agency shall provide a
   copy of its written policies in accordance with [section 9] for use with the notice requirement outlined in
   subsection (1).
              (4)    A state or local government agency shall report the use of facial recognition technology
   pursuant to subsection (1) to the information technology board created in 2-15-1021.
              (5)    [Sections 1 through 12] do not apply to a state or local government agency that uses facial
                                                                 -6-                       Authorized Print Version – SB 397
68th Legislature                                                                                                     SB 397.1
   verification in association with a federal agency to verify the identity of individuals presenting themselves for
   travel at an airport or other port.
  3
              NEW SECTION. Section 9.       Notice requirement -- policy and retention requirements for third-
   party vendors. (1) On capturing an image of an individual when the individual interacts with a state or local
   government agency, the state or local government agency shall notify the individual that the individual's image
   may be used in conjunction with a facial recognition service.
              (2)   A third-party vendor contracted with a state or local government agency for the provision of a
   facial recognition service may not collect, capture, purchase, receive through trade, or otherwise obtain an
   individual's facial biometric data in the implementation of the service unless it first:
              (a)   informs the individual or the individual's legally authorized representative in writing that facial
   biometric data is being collected or stored;
              (b)   informs the individual or the individual's legally authorized representative in writing of the
   specific purpose and length of term for which facial biometric data is being collected, stored, and used; and
              (c)   receives written consent from the individual or the individual's legally authorized representative
   authorizing the collection, storage, and use of the individual's facial biometric data.
              (3)   A third-party vendor contracted with a state or local government agency for the provision of a
   facial recognition service shall provide the state or local government agency with a written privacy policy. The
   privacy policy must be designed and presented in a way that is easy to read and is understandable to an
   average consumer and must include the date the policy was last updated. A third-party vendo