2
3
4
5
6
7
8 LONG TITLE
9 Committee Note:
10 The Government Operations Interim Committee recommended this bill.
11 Legislative Vote: 11 voting for 0 voting against 5 absent
12 General Description:
13 This bill addresses the state's use of facial recognition technology.
14 Highlighted Provisions:
15 This bill:
16 ▸ defines terms;
17 ▸ places limitation on the circumstances under which government entities may use
18 image databases for facial recognition comparisons;
19 ▸ describes the process of, and requirements for, conducting a facial recognition
20 comparison;
21 ▸ addresses training of Department of Public Safety (the department) and government
22 entity employees;
23 ▸ provides that only the department may use a facial recognition system with respect
24 to image databases shared with or maintained by the department;
25 ▸ provides a notice requirement for government entities that use facial recognition
26 technology with respect to images taken by that government entity; and
27 ▸ describes information that is required to be released, and information that is
28 protected, in relation to a facial recognition comparison.
29 Money Appropriated in this Bill:
30 None
31 Other Special Clauses:
32 None
33 Utah Code Sections Affected:
34 ENACTS:
35 77-23e-101, Utah Code Annotated 1953
36 77-23e-102, Utah Code Annotated 1953
37 77-23e-103, Utah Code Annotated 1953
38 77-23e-104, Utah Code Annotated 1953
39 77-23e-105, Utah Code Annotated 1953
40 77-23e-106, Utah Code Annotated 1953
41
42 Be it enacted by the Legislature of the state of Utah:
43 Section 1. Section 77-23e-101 is enacted to read:
44
45 77-23e-101. Title.
46 This chapter is known as "Government Use of Facial Recognition Technology."
47 Section 2. Section 77-23e-102 is enacted to read:
48 77-23e-102. Definitions.
49 As used in this chapter:
50 (1) "Department" means the Department of Public Safety, created in Section 53-1-103.
51 (2) "Facial biometric data" means data derived from a measurement, pattern, contour,
52 or other characteristic of an individual's face, either directly or from an image.
53 (3) "Facial recognition comparison" means the process of comparing an image or facial
54 biometric data to an image database.
55 (4) (a) "Facial recognition system" means a computer system that, for the purpose of
56 attempting to determine the identity of an unknown individual, uses an algorithm to compare
57 biometric data of the face of the unknown individual to facial biometric data of known
58 individuals.
59 (b) "Facial recognition system" does not include:
60 (i) a system described in Subsection (4)(a) that is available for use, free of charge, by
61 the general public; or
62 (ii) a system a consumer uses for the consumer's private purposes.
63 (5) (a) "Government entity" means:
64 (i) an executive department agency of the state;
65 (ii) the office of:
66 (A) the governor;
67 (B) the lieutenant governor;
68 (C) the state auditor;
69 (D) the attorney general; or
70 (E) the state treasurer;
71 (iii) the Board of Pardons and Parole;
72 (iv) the Board of Examiners;
73 (v) the National Guard;
74 (vi) the Career Service Review Office;
75 (vii) the State Board of Education;
76 (viii) the State Board of Regents;
77 (ix) the State Archives;
78 (x) the Office of the Legislative Auditor General;
79 (xi) the Office of Legislative Fiscal Analyst;
80 (xii) the Office of Legislative Research and General Counsel;
81 (xiii) the Legislature;
82 (xiv) a legislative committee of the Legislature;
83 (xv) a court, the Judicial Council, the Administrative Office of the Courts, and similar
84 administrative units in the judicial branch;
85 (xvi) a state institution of higher education as that term is defined in Section
86 53B-3-102;
87 (xvii) an entity within the system of public education that receives funding from the
88 state; or
89 (xvii) a political subdivision of the state as that term is defined in Section 63G-7-102.
90 (b) "Government entity" includes:
91 (i) every office, agency, board, bureau, committee, department, advisory board, or
92 commission of an entity described in Subsection (5)(a) that is funded or established by the
93 government to carry out the public's business; or
94 (ii) an individual acting as an agent of a government entity or acting on behalf of an
95 entity described in this Subsection (5).
96 (6) (a) "Image database" means a database maintained by a government entity that
97 contains images the government entity captures of an individual while the individual interacts
98 with the government entity.
99 (b) "Image database" does not include publicly available information.
100 (7) "Law enforcement agency" means a public entity that exists primarily to prevent,
101 detect, or prosecute crime or enforce criminal statutes or ordinances.
102 (8) "Trained employee" means an individual who is trained to make a facial
103 recognition comparison and identification and who has completed implicit bias training.
104 Section 3. Section 77-23e-103 is enacted to read:
105 77-23e-103. Government use of facial recognition system with image database --
106 Restrictions -- Process -- Disclosure.
107 (1) Except as provided in this section and in Section 77-23e-104, a government entity
108 may not use a facial recognition system on an image database.
109 (2) (a) (i) Only a law enforcement agency may make a request for a government entity
110 to conduct a facial recognition comparison using a facial recognition system.
111 (ii) Except as provided in Subsection (2)(a)(iii), a law enforcement agency shall submit
112 a request for a facial recognition comparison on an image database in writing to the
113 government entity that manages the image database.
114 (iii) A law enforcement agency shall submit a request for a facial recognition
115 comparison on an image database shared with or maintained by the department in accordance
116 with Section 77-23e-104.
117 (b) A trained employee who is employed by the government entity that maintains or
118 has access to the image database shall complete the request if the request:
119 (i) is for a purpose described in Subsection (2)(c);
120 (ii) includes a case identification number; and
121 (iii) is, if it is a request made for the purpose of investigating a crime, supported by a
122 statement of the specific crime and factual narrative to support that there is a fair probability
123 that the individual who is the subject of the request is connected to the crime.
124 (c) An individual described in Subsection (2)(b) shall only comply with requests made
125 for a purpose of:
126 (i) investigating a felony, a violent crime, or a threat to human life; or
127 (ii) identifying an individual who is:
128 (A) deceased;
129 (B) incapacitated; or
130 (C) at risk and otherwise unable to provide the law enforcement agency with his or her
131 identity.
132 (d) The law enforcement agency shall only use the facial recognition comparison:
133 (i) in accordance with the requirements of law; and
134 (ii) in relation to a purpose described in Subsection (2)(c).
135 (3) A government entity may not use a facial recognition system for a civil immigration
136 violation.
137 (4) To make a facial recognition comparison, a trained employee described in
138 Subsection (2)(b) shall:
139 (a) use a facial recognition system that, in accordance with industry standards:
140 (i) makes the comparison using an algorithm that compares only facial biometric data;
141 (ii) is secure; and
142 (iii) is produced by a company that is currently in business;
143 (b) if the facial recognition system indicates a possible match, make an independent
144 visual comparison to determine whether the facial recognition system's possible match is a
145 probable match;
146 (c) if the trained employee determines that there is a possible match that is a probable
147 match, seek a second opinion from another trained employee or the trained employee's
148 supervisor; and
149 (d) (i) if the other trained employee or the trained employee's supervisor agrees that the
150 match is a probable match:
151 (A) report the result to the requesting law enforcement agency through an encrypted
152 method; and
153 (B) return to the requesting law enforcement agency only a result that all trained
154 employees agree is a probable match; or
155 (ii) if the other trained employee or the trained employee's supervisor disagrees that
156 there is a probable match, report the fact that the search returned no results to the requesting
157 law enforcement agency.
158 (5) When submitting a case to a prosecutor, a law enforcement agency of the state or of
159 a political subdivision shall disclose to the prosecutor, in writing:
160 (a) whether a facial recognition system was used in investigating the case; and, (b)if a
161 facial recognition system was used:
162 (A) the information the law enforcement received in accordance with Subsection
163 (4)(d)(ii); and
164 (B) a description of how the facial recognition comparison was used in the
165 investigation.
166 Section 4. Section 77-23e-104 is enacted to read:
167 77-23e-104. Department use of facial recognition system with specific images --
168 Restrictions.
169 (1) The department is the only government entity in the state authorized to use a facial
170 recognition system to conduct a facial recognition comparison on an image database that is
171 maintained by or shared with the department.
172 (2) The department may only use a facial recognition system:
173 (a) for a purpose authorized in Subsection 77-23e-103(2)(c); or
174 (b) notwithstanding Subsection 77-23e-103(2)(b), to:
175 (i) compare an image taken of an applicant for a license certificate or an identification
176 card to determine whether the applicant has submitted a fraudulent or an inaccurate application;
177 or
178 (ii) provide images for a photo lineup for a purpose authorized in Subsection
179 77-23e-103(2)(c).
180 (3) Notwithstanding Subsection 77-23e-104(2)(a)(ii), a law enforcement agency shall
181 submit a request to the department to use a facial recognition system on an image database
182 maintained by the department through the Utah Criminal Justice Information System.
183 Section 5. Section 77-23e-105 is enacted to read:
184 77-23e-105. Notice requirement.
185 (1) When capturing an image of an individual when the individual interacts with the
186 government entity, the government entity shall notify the individual that the individual's image
187 may be used in conjunction with facial recognition technology.
188 (2) At least 30 days before the day on which a government entity other than the
189 department begins using a facial recognition system to conduct a facial recognition comparison
190 on the government entity's image database, the government entity shall:
191 (a) publish on the government entity's website:
192 (i) notice of the proposed use of facial recognition system;
193 (ii) a description of the image database on which the government entity plans to use the
194 facial recognition system; and
195 (iii) information about how to provide public comment;
196 (b) allow the public to submit written comments to the government entity within 15
197 days after date of publication;
198 (c) consider timely submitted public comments and the criteria established in this
199 Chapter in determining whether to proceed with the intended use of the facial recognition
200 system; and
201 (d) post notice of the final decision on the government entity's website.
202 (3) The process described in Subsection (2) does not create a right of appeal.
203 Section 6. Section 77-23e-106 is enacted to read:
204 77-23e-106. Data protection and disclosure.
205 (1) Notwithstanding Title 63G, Chapter 2, Government Records Access and
206 Management Act, data relating to a facial recognition comparison may not be used or shared
207 for any purpose other than a purpose described in this chapter.
208 (2) (a) Upon request, a government entity shall release statistical information regarding
209 facial recognition comparisons, including:
210 (i) the different types of crime for which the government entity received a request;
211 (ii) how many requests the government entity received for each type of crime; and
212 (iii) the number of probable matches the government entity provided in response to
213 each request.
214 (b) In responding to a request for a release of statistical information under Subsection
215 (2)(a), a government entity may not disclose details regarding a pending investigation.
216 (3) (a) On or after August 1 but before October 15 of each year, a government entity
217 that uses a facial recognition system to conduct a facial recognition comparison shall provide to
218 the Government Operations Interim Committee a report that discloses:
219 (i) the different types of crime for which the department received a request;
220 (ii) how many requests the department received for each type of crime;
221 (iii) the number of probable matches the department provided in response to each
222 request; and
223 (iv) the image source from which the department made each match.
224 (b) In responding to a request for a release of statistical information under Subsection
225 (2)(a), a government entity may not disclose details regarding a pending investigation.