S-5171.2

SENATE BILL 6280

BySenators Nguyen, Carlyle, Wellman, Salomon, Lovelett, Das, Randall, Pedersen, Wilson, C., and Hunt

AN ACT Relating to the use of facial recognition services; adding a new section to chapter 9.73 RCW; adding a new chapter to Title 43 RCW; creating a new section; and providing an expiration date.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

(1) Unconstrained use of facial recognition services by state and local government agencies poses broad social ramifications that should be considered and addressed. Accordingly, legislation is required to establish safeguards that will allow state and local government agencies to use facial recognition services in a manner that benefits society while prohibiting uses that threaten our democratic freedoms and put our civil liberties at risk.

(2) However, state and local government agencies may use facial recognition services in a variety of beneficial ways, such as locating missing or incapacitated persons, identifying victims of crime, and keeping the public safe.

(1) "Accountability report" means a report developed in accordance with section 3 of this act.

(2) "Enroll," "enrolled," or "enrolling" means the process by which a facial recognition service creates a facial template from one or more images of a consumer and adds the facial template to a gallery used by the facial recognition service for recognition or persistent tracking of consumers. It also includes the act of adding an existing facial template directly into a gallery used by a facial recognition service.

(3) "Facial recognition service" means technology that analyzes facial features and is used for recognition or persistent tracking of consumers in still or video images.

(4) "Facial template" means the machine-interpretable pattern of facial features that is extracted from one or more images of a consumer by a facial recognition service.

(5) "Meaningful human review" means review or oversight by one or more individuals who are trained in accordance with section 8 of this act and who have the authority to alter the decision under review.

(6) "Ongoing surveillance" means tracking the physical movements of a specified individual through one or more public places over time, whether in real time or through application of a facial recognition service to historical records. It does not include a single recognition or attempted recognition of an individual, if no attempt is made to subsequently track that individual's movement over time after they have been recognized.

(7) "Persistent tracking" means the use of a facial recognition service to track the movements of a consumer on a persistent basis without recognition of that consumer. Such tracking becomes persistent as soon as:

(a) The facial template that permits the tracking is maintained for more than forty-eight hours after first enrolling that template; or

(b) Data created by the facial recognition service is linked to any other data such that the consumer who has been tracked is identified or identifiable.

(8) "Recognition" means the use of a facial recognition service to determine whether an unknown consumer matches:

(a) Any consumer who has been enrolled in a gallery used by the facial recognition service; or

(b) A specific consumer who has been enrolled in a gallery used by the facial recognition service.

(9) "Serious criminal offense" means any felony under chapter 9.94A RCW or an offense enumerated by Title 18 U.S.C. Sec. 2516.

(2) Each accountability report must include, at minimum, clear and understandable statements of the following:

(a)(i) The name of the facial recognition service, vendor, and version; and (ii) a description of its general capabilities and limitations, including reasonably foreseeable capabilities outside the scope of the proposed use of the agency;

(b)(i) The type or types of data inputs that the technology uses; (ii) how that data is generated, collected, and processed; and (iii) the type or types of data the system is reasonably likely to generate;

(c)(i) A description of the purpose and proposed use of the facial recognition service, including what decision or decisions will be used to make or support it; (ii) whether it is a final or support decision system; and (iii) its intended benefits, including any data or research demonstrating those benefits;

(d) A clear use and data management policy, including protocols for the following:

(i) How and when the facial recognition service will be deployed or used and by whom including, but not limited to, the factors that will be used to determine where, when, and how the technology is deployed, and other relevant information, such as whether the technology will be operated continuously or used only under specific circumstances. If the facial recognition service will be operated or used by another entity on the agency's behalf, the facial recognition service accountability report must explicitly include a description of the other entity's access and any applicable protocols;

(ii) Any measures taken to minimize inadvertent collection of additional data beyond the amount necessary for the specific purpose or purposes for which the facial recognition service will be used;

(iii) Data integrity and retention policies applicable to the data collected using the facial recognition service, including how the agency will maintain and update records used in connection with the service, how long the agency will keep the data, and the processes by which data will be deleted;

(iv) Any additional rules that will govern use of the facial recognition service and what processes will be required prior to each use of the facial recognition service;

(v) Data security measures applicable to the facial recognition service including how data collected using the facial recognition service will be securely stored and accessed, if and why an agency intends to share access to the facial recognition service or the data from that facial recognition service with any other entity, and the rules and procedures by which an agency sharing data with any other entity will ensure that such entities comply with the sharing agency's use and data management policy as part of the data sharing agreement; and

(vi) The agency's training procedures, including those implemented in accordance with section 8 of this act, and how the agency will ensure that all personnel who operate the facial recognition service or access its data are knowledgeable about and able to ensure compliance with the use and data management policy prior to use of the facial recognition service;

(e) The agency's testing procedures, including its processes for periodically undertaking operational tests of the facial recognition service in accordance with section 6 of this act;

(f) A description of any potential impacts of the facial recognition service on civil rights and liberties, including potential impacts to privacy and potential disparate impacts on marginalized communities, and the specific steps the agency will take to mitigate the potential impacts and prevent unauthorized use of the facial recognition service; and

(g) The agency's procedures for receiving feedback, including the channels for receiving feedback from individuals affected by the use of the facial recognition service and from the community at large, as well as the procedures for responding to feedback.

(3) Prior to finalizing and implementing the accountability report, the agency must consider issues raised by the public through:

(a) A public review and comment period; and

(b) Community consultation meetings during the public review period.

(4) The accountability report must be updated every two years and each update must be subject to the public comment and community consultation processes described in this section.

(5) An agency seeking to use a facial recognition service for a purpose not disclosed in the agency's existing accountability report must first seek public comment and community consultation on the proposed new use and adopt an updated accountability report pursuant to the requirements contained in this section.

(a) The extent of their use of such services;

(b) An assessment of compliance with the terms of their accountability report;

(c) Any known or reasonably suspected violations of their accountability report, including complaints alleging violations; and

(d) Any revisions to the accountability report recommended by the agency during the next update of the policy.

(2) The annual report must be submitted to the office of privacy and data protection.

(3) All agencies must hold community meetings to review and discuss their annual report within sixty days of its public release.

(1) The capabilities and limitations of the facial recognition service;

(2) Procedures to interpret and act on the output of the facial recognition service; and

(3) To the extent applicable to the deployment context, the meaningful human review requirement for decisions that produce legal effects concerning consumers or similarly significant effects concerning consumers.

(2) State and local government agencies using a facial recognition service shall maintain records of their use of the service that are sufficient to facilitate public reporting and auditing of compliance with agencies' facial recognition policies.

(3) In January of each year, any judge who has issued a warrant for ongoing surveillance, or an extension thereof, as described in section 11(1) of this act, that expired during the preceding year, or who has denied approval of such a warrant during that year shall report to the Washington state supreme court:

(a) The fact that a warrant or extension was applied for;

(b) The fact that the warrant or extension was granted as applied for, was modified, or was denied;

(c) The period of ongoing surveillance authorized by the warrant and the number and duration of any extensions of the warrant;

(d) The identity of the applying investigative or law enforcement officer and agency making the application and the person authorizing the application; and

(e) The nature of the public spaces where the surveillance was conducted.

(i) The president of the senate shall appoint on