2
3
4
5
6
7 LONG TITLE
8 General Description:
9 This bill addresses the state's use of facial recognition technology.
10 Highlighted Provisions:
11 This bill:
12 ▸ provides that the Department of Public Safety is the only government entity in the
13 state authorized to use a facial recognition system;
14 ▸ places limitations on the circumstances under which the department may conduct a
15 facial recognition comparison;
16 ▸ describes the process of, and requirements for, conducting a facial recognition
17 comparison;
18 ▸ addresses training of department employees;
19 ▸ describes information that is required to be released, and information that is
20 protected, in relation to a facial recognition comparison; and
21 ▸ requires the department to provide an annual report on facial recognition requests
22 the department receives.
23 Money Appropriated in this Bill:
24 None
25 Other Special Clauses:
26 None
27 Utah Code Sections Affected:
28 ENACTS:
29 77-23e-101, Utah Code Annotated 1953
30 77-23e-102, Utah Code Annotated 1953
31 77-23e-103, Utah Code Annotated 1953
32 77-23e-104, Utah Code Annotated 1953
33
34 Be it enacted by the Legislature of the state of Utah:
35 Section 1. Section 77-23e-101 is enacted to read:
36
37
38 77-23e-101. Title.
39 This chapter is known as "Government Use of Facial Recognition Technology."
40 Section 2. Section 77-23e-102 is enacted to read:
41 77-23e-102. Definitions.
42 As used in this chapter:
43 (1) "Authorized database" means a database maintained by the department that
44 contains only:
45 (a) images of an individual taken when the individual applies for a license certificate or
46 identification card; or
47 (b) images of an individual taken when the individual is taken into custody by a law
48 enforcement agency or the Department of Corrections.
49 (2) "Department" means the Department of Public Safety, created in Section 53-1-103.
50 (3) "Facial biometric data" means data derived from a measurement, pattern, contour,
51 or other characteristic of an individual's face, either directly or from an image.
52 (4) "Facial recognition comparison" means the process of comparing an image or facial
53 biometric data to an authorized database.
54 (5) (a) "Facial recognition system" means a computer system that, for the purpose of
55 attempting to determine the identity of an unknown individual, uses an algorithm to compare
56 biometric data of the face of the unknown individual to biometric data in a database of facial
57 images, or a database of biometric data taken from facial images, of known individuals.
58 (b) "Facial recognition system" does not include a system described in Subsection
59 (5)(a) that is available for use, free of charge, by the general public.
60 (6) (a) "Government entity" means:
61 (i) an executive department of the state;
62 (ii) the office of the governor, lieutenant governor, state auditor, attorney general, or
63 state treasurer;
64 (iii) the Board of Pardons and Parole;
65 (iv) the Board of Examiners;
66 (v) the National Guard;
67 (vi) the Career Service Review Office;
68 (vii) the State Board of Education;
69 (viii) the State Board of Regents;
70 (ix) the State Archives;
71 (x) the Office of the Legislative Auditor General;
72 (xi) the Office of the Legislative Fiscal Analyst;
73 (xii) the Office of Legislative Research and General Counsel;
74 (xiii) the Legislature;
75 (xiv) a legislative committee of the Legislature;
76 (xv) a court, the Judicial Council, the Administrative Office of the Courts, and similar
77 administrative units in the judicial branch;
78 (xvi) a state-funded institution of higher education or public education; or
79 (xvii) a political subdivision of the state.
80 (b) "Government entity" includes:
81 (i) every office, agency, board, bureau, committee, department, advisory board, or
82 commission of an entity described in Subsection (6)(a) that is funded or established by the
83 government to carry out the public's business; or
84 (ii) a person acting as an agent of an entity described in Subsection (6)(a) or (6)(b)(i) or
85 acting on behalf of the entity.
86 (7) "Law enforcement agency" means a public entity that exists to primarily prevent,
87 detect, or prosecute crime or enforce criminal statutes or ordinances.
88 Section 3. Section 77-23e-103 is enacted to read:
89 77-23e-103. Government use of facial recognition system -- Restrictions --
90 Disclosure.
91 (1) Except as provided in this section, a government entity may not use a facial
92 recognition system.
93 (2) (a) The department is the only government entity in the state authorized to use a
94 facial recognition system.
95 (b) The department may not use a facial recognition system for any purpose other than
96 a purpose authorized in this section.
97 (c) All requests for a facial recognition comparison shall be made to, and completed
98 by, individuals employed by the department who:
99 (i) are trained to make a facial recognition comparison and identification; and
100 (ii) have completed implicit bias training.
101 (d) Except as provided in Subsection (3), the department may not comply with a
102 request for a facial recognition comparison unless:
103 (i) the request is made by a law enforcement agency;
104 (ii) the request is:
105 (A) submitted electronically through the Utah Criminal Justice Information System;
106 (B) accompanied by a case identification number; and
107 (C) supported by a statement of the specific crime and factual narrative to support that
108 there is a fair probability that the individual who is the subject of the request is connected to the
109 crime;
110 (iii) the request is made for the purpose of:
111 (A) investigating a felony, violent crime, or threat to life; or
112 (B) identifying a deceased or incapacitated individual or an individual otherwise unable
113 to identify the individual; and
114 (iv) the law enforcement agency agrees to use the comparison:
115 (A) in accordance with the requirements of law; and
116 (B) only in relation to a purpose described in Subsection (2)(d)(ii).
117 (3) The department may compare an image taken of an applicant for a license
118 certificate or an identification card, to determine whether the applicant has submitted a
119 fraudulent or inaccurate application.
120 (4) The department may not use a facial recognition system for a civil immigration
121 violation.
122 (5) To make a facial recognition comparison, an employee described in Subsection
123 (2)(c) shall:
124 (a) run the comparison using a facial recognition system that, in accordance with
125 industry standards:
126 (i) makes the comparison using an algorithm that compares only facial biometric data;
127 (ii) is secure; and
128 (iii) is produced by a company that is currently in business;
129 (b) if the facial recognition system indicates a possible match, make an independent
130 visual comparison to determine whether there is a likely match;
131 (c) if the employee determines that there is a likely match, seek a second opinion from
132 another trained employee or the employee's supervisor; and
133 (d) if the other trained employee or the employee's supervisor agrees that there is a
134 likely match:
135 (i) report the results to the requesting law enforcement agency via an encrypted
136 method; and
137 (ii) return to the requesting law enforcement agency only a single result that is the
138 likely match.
139 (6) A law enforcement agency of the state or of a political subdivision shall, when
140 submitting a case to a prosecutor, disclose to the prosecutor, in writing:
141 (a) whether a facial recognition comparison was made in investigating the case; and
142 (b) a description of how the facial recognition comparison was used in the
143 investigation.
144 Section 4. Section 77-23e-104 is enacted to read:
145 77-23e-104. Data protection and disclosure.
146 (1) Notwithstanding Title 63G, Chapter 2, Government Records Access and
147 Management Act, data relating to a facial recognition comparison may not be used or shared
148 for any purpose other than a purpose described in Section 77-23e-103.
149 (2) (a) The department shall, upon request, release statistical information regarding
150 facial recognition comparisons, including:
151 (i) the number of each crime type for which a request is received; and
152 (ii) the number of likely matches provided in response to requests received for each
153 crime type.
154 (b) A release of statistical information under Subsection (2)(a) may not disclose details
155 regarding a pending investigation.
156 (3) On or after August 1 but before November 15 of each year, the department shall
157 provide to the Law Enforcement and Criminal Justice Interim Committee of the Legislature a
158 report that:
159 (a) discloses:
160 (i) the number of each crime type for which a request is received; and
161 (ii) the number of likely matches provided in response to requests received for each
162 crime type; and
163 (b) may not contain any identifying information relating to requests described in
164 Subsection (3)(a).