1     
FACIAL RECOGNITION PROVISIONS

2     
2020 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: Curtis S. Bramble

5     
House Sponsor: ____________

6     

7     LONG TITLE
8     General Description:
9          This bill addresses the state's use of facial recognition technology.
10     Highlighted Provisions:
11          This bill:
12          ▸     provides that the Department of Public Safety is the only government entity in the
13     state authorized to use a facial recognition system;
14          ▸     places limitations on the circumstances under which the department may conduct a
15     facial recognition comparison;
16          ▸     describes the process of, and requirements for, conducting a facial recognition
17     comparison;
18          ▸     addresses training of department employees;
19          ▸     describes information that is required to be released, and information that is
20     protected, in relation to a facial recognition comparison; and
21          ▸     requires the department to provide an annual report on facial recognition requests
22     the department receives.
23     Money Appropriated in this Bill:
24          None
25     Other Special Clauses:
26          None
27     Utah Code Sections Affected:

28     ENACTS:
29          77-23e-101, Utah Code Annotated 1953
30          77-23e-102, Utah Code Annotated 1953
31          77-23e-103, Utah Code Annotated 1953
32          77-23e-104, Utah Code Annotated 1953
33     

34     Be it enacted by the Legislature of the state of Utah:
35          Section 1. Section 77-23e-101 is enacted to read:
36     
CHAPTER 23e. GOVERNMENT USE OF FACIAL RECOGNITION

37     
TECHNOLOGY

38          77-23e-101. Title.
39          This chapter is known as "Government Use of Facial Recognition Technology."
40          Section 2. Section 77-23e-102 is enacted to read:
41          77-23e-102. Definitions.
42          As used in this chapter:
43          (1) "Authorized database" means a database maintained by the department that
44     contains only:
45          (a) images of an individual taken when the individual applies for a license certificate or
46     identification card; or
47          (b) images of an individual taken when the individual is taken into custody by a law
48     enforcement agency or the Department of Corrections.
49          (2) "Department" means the Department of Public Safety, created in Section 53-1-103.
50          (3) "Facial biometric data" means data derived from a measurement, pattern, contour,
51     or other characteristic of an individual's face, either directly or from an image.
52          (4) "Facial recognition comparison" means the process of comparing an image or facial
53     biometric data to an authorized database.
54          (5) (a) "Facial recognition system" means a computer system that, for the purpose of
55     attempting to determine the identity of an unknown individual, uses an algorithm to compare
56     biometric data of the face of the unknown individual to biometric data in a database of facial
57     images, or a database of biometric data taken from facial images, of known individuals.
58          (b) "Facial recognition system" does not include a system described in Subsection

59     (5)(a) that is available for use, free of charge, by the general public.
60          (6) (a) "Government entity" means:
61          (i) an executive department of the state;
62          (ii) the office of the governor, lieutenant governor, state auditor, attorney general, or
63     state treasurer;
64          (iii) the Board of Pardons and Parole;
65          (iv) the Board of Examiners;
66          (v) the National Guard;
67          (vi) the Career Service Review Office;
68          (vii) the State Board of Education;
69          (viii) the State Board of Regents;
70          (ix) the State Archives;
71          (x) the Office of the Legislative Auditor General;
72          (xi) the Office of the Legislative Fiscal Analyst;
73          (xii) the Office of Legislative Research and General Counsel;
74          (xiii) the Legislature;
75          (xiv) a legislative committee of the Legislature;
76          (xv) a court, the Judicial Council, the Administrative Office of the Courts, and similar
77     administrative units in the judicial branch;
78          (xvi) a state-funded institution of higher education or public education; or
79          (xvii) a political subdivision of the state.
80          (b) "Government entity" includes:
81          (i) every office, agency, board, bureau, committee, department, advisory board, or
82     commission of an entity described in Subsection (6)(a) that is funded or established by the
83     government to carry out the public's business; or
84          (ii) a person acting as an agent of an entity described in Subsection (6)(a) or (6)(b)(i) or
85     acting on behalf of the entity.
86          (7) "Law enforcement agency" means a public entity that exists to primarily prevent,
87     detect, or prosecute crime or enforce criminal statutes or ordinances.
88          Section 3. Section 77-23e-103 is enacted to read:
89          77-23e-103. Government use of facial recognition system -- Restrictions --

90     Disclosure.
91          (1) Except as provided in this section, a government entity may not use a facial
92     recognition system.
93          (2) (a) The department is the only government entity in the state authorized to use a
94     facial recognition system.
95          (b) The department may not use a facial recognition system for any purpose other than
96     a purpose authorized in this section.
97          (c) All requests for a facial recognition comparison shall be made to, and completed
98     by, individuals employed by the department who:
99          (i) are trained to make a facial recognition comparison and identification; and
100          (ii) have completed implicit bias training.
101          (d) Except as provided in Subsection (3), the department may not comply with a
102     request for a facial recognition comparison unless:
103          (i) the request is made by a law enforcement agency;
104          (ii) the request is:
105          (A) submitted electronically through the Utah Criminal Justice Information System;
106          (B) accompanied by a case identification number; and
107          (C) supported by a statement of the specific crime and factual narrative to support that
108     there is a fair probability that the individual who is the subject of the request is connected to the
109     crime;
110          (iii) the request is made for the purpose of:
111          (A) investigating a felony, violent crime, or threat to life; or
112          (B) identifying a deceased or incapacitated individual or an individual otherwise unable
113     to identify the individual; and
114          (iv) the law enforcement agency agrees to use the comparison:
115          (A) in accordance with the requirements of law; and
116          (B) only in relation to a purpose described in Subsection (2)(d)(ii).
117          (3) The department may compare an image taken of an applicant for a license
118     certificate or an identification card, to determine whether the applicant has submitted a
119     fraudulent or inaccurate application.
120          (4) The department may not use a facial recognition system for a civil immigration

121     violation.
122          (5) To make a facial recognition comparison, an employee described in Subsection
123     (2)(c) shall:
124          (a) run the comparison using a facial recognition system that, in accordance with
125     industry standards:
126          (i) makes the comparison using an algorithm that compares only facial biometric data;
127          (ii) is secure; and
128          (iii) is produced by a company that is currently in business;
129          (b) if the facial recognition system indicates a possible match, make an independent
130     visual comparison to determine whether there is a likely match;
131          (c) if the employee determines that there is a likely match, seek a second opinion from
132     another trained employee or the employee's supervisor; and
133          (d) if the other trained employee or the employee's supervisor agrees that there is a
134     likely match:
135          (i) report the results to the requesting law enforcement agency via an encrypted
136     method; and
137          (ii) return to the requesting law enforcement agency only a single result that is the
138     likely match.
139          (6) A law enforcement agency of the state or of a political subdivision shall, when
140     submitting a case to a prosecutor, disclose to the prosecutor, in writing:
141          (a) whether a facial recognition comparison was made in investigating the case; and
142          (b) a description of how the facial recognition comparison was used in the
143     investigation.
144          Section 4. Section 77-23e-104 is enacted to read:
145          77-23e-104. Data protection and disclosure.
146          (1) Notwithstanding Title 63G, Chapter 2, Government Records Access and
147     Management Act, data relating to a facial recognition comparison may not be used or shared
148     for any purpose other than a purpose described in Section 77-23e-103.
149          (2) (a) The department shall, upon request, release statistical information regarding
150     facial recognition comparisons, including:
151          (i) the number of each crime type for which a request is received; and

152          (ii) the number of likely matches provided in response to requests received for each
153     crime type.
154          (b) A release of statistical information under Subsection (2)(a) may not disclose details
155     regarding a pending investigation.
156          (3) On or after August 1 but before November 15 of each year, the department shall
157     provide to the Law Enforcement and Criminal Justice Interim Committee of the Legislature a
158     report that:
159          (a) discloses:
160          (i) the number of each crime type for which a request is received; and
161          (ii) the number of likely matches provided in response to requests received for each
162     crime type; and
163          (b) may not contain any identifying information relating to requests described in
164     Subsection (3)(a).