1
2
3
4
5
6
7
8 LONG TITLE
9 General Description:
10 This bill addresses the state's use of facial recognition technology.
11 Highlighted Provisions:
12 This bill:
13 ▸ defines terms;
14 ▸ places limitation on the circumstances under which government entities may use
15 image databases for facial recognition comparisons;
16 ▸ describes the process of, and requirements for, conducting a facial recognition
17 comparison;
18 ▸ addresses training of Department of Public Safety (the department) and government
19 entity employees;
20 ▸ provides that only the department may use a facial recognition system with respect
21 to image databases shared with or maintained by the department;
22 ▸ provides a notice requirement for government entities that use facial recognition
23 technology with respect to images taken by that government entity; and
24 ▸ describes information that is required to be released, and information that is
25 protected, in relation to a facial recognition comparison.
26 Money Appropriated in this Bill:
27 None
28 Other Special Clauses:
29 None
30 Utah Code Sections Affected:
31 ENACTS:
32 77-23e-101, Utah Code Annotated 1953
33 77-23e-102, Utah Code Annotated 1953
34 77-23e-103, Utah Code Annotated 1953
35 77-23e-104, Utah Code Annotated 1953
36 77-23e-105, Utah Code Annotated 1953
37 77-23e-106, Utah Code Annotated 1953
38
39 Be it enacted by the Legislature of the state of Utah:
40 Section 1. Section 77-23e-101 is enacted to read:
41
42 77-23e-101. Title.
43 This chapter is known as "Government Use of Facial Recognition Technology."
44 Section 2. Section 77-23e-102 is enacted to read:
45 77-23e-102. Definitions.
46 As used in this chapter:
47 (1) "Department" means the Department of Public Safety, created in Section 53-1-103.
48 (2) "Facial biometric data" means data derived from a measurement, pattern, contour,
49 or other characteristic of an individual's face, either directly or from an image.
50 (3) "Facial recognition comparison" means the process of comparing an image or facial
51 biometric data to an image database.
52 (4) (a) "Facial recognition system" means a computer system that, for the purpose of
53 attempting to determine the identity of an unknown individual, uses an algorithm to compare
54 biometric data of the face of the unknown individual to facial biometric data of known
55 individuals.
56 (b) "Facial recognition system" does not include:
57 (i) a system described in Subsection (4)(a) that is available for use, free of charge, by
58 the general public; or
59 (ii) a system a consumer uses for the consumer's private purposes.
60 (5) (a) "Government entity" means:
61 (i) an executive department agency of the state;
62 (ii) the office of:
63 (A) the governor;
64 (B) the lieutenant governor;
65 (C) the state auditor;
66 (D) the attorney general; or
67 (E) the state treasurer;
68 (iii) the Board of Pardons and Parole;
69 (iv) the Board of Examiners;
70 (v) the National Guard;
71 (vi) the Career Service Review Office;
72 (vii) the State Board of Education;
73 (viii) the Utah Board of Higher Education;
74 (ix) the State Archives;
75 (x) the Office of the Legislative Auditor General;
76 (xi) the Office of Legislative Fiscal Analyst;
77 (xii) the Office of Legislative Research and General Counsel;
78 (xiii) the Legislature;
79 (xiv) a legislative committee of the Legislature;
80 (xv) a court, the Judicial Council, the Administrative Office of the Courts, and similar
81 administrative units in the judicial branch;
82 (xvi) a state institution of higher education as that term is defined in Section
83 53B-3-102;
84 (xvii) an entity within the system of public education that receives funding from the
85 state; or
86 (xviii) a political subdivision of the state as that term is defined in Section 63G-7-102.
87 (b) "Government entity" includes:
88 (i) every office, agency, board, bureau, committee, department, advisory board, or
89 commission of an entity described in Subsection (5)(a) that is funded or established by the
90 government to carry out the public's business; or
91 (ii) an individual acting as an agent of a government entity or acting on behalf of an
92 entity described in this Subsection (5).
93 (6) (a) "Image database" means a database maintained by a government entity that
94 contains images the government entity captures of an individual while the individual interacts
95 with the government entity.
96 (b) "Image database" does not include publicly available information.
97 (7) "Law enforcement agency" means a public entity that exists primarily to prevent,
98 detect, or prosecute crime or enforce criminal statutes or ordinances.
99 (8) "Trained employee" means an individual who is trained to make a facial
100 recognition comparison and identification and who has completed implicit bias training.
101 Section 3. Section 77-23e-103 is enacted to read:
102 77-23e-103. Government use of facial recognition system with image database --
103 Restrictions -- Process -- Disclosure.
104 (1) Except as provided in this section, in Section 77-23e-104, and in Section
105 77-23e-105, a government entity may not use a facial recognition system on an image database.
106 (2) (a) (i) Only a law enforcement agency may make a request for a government entity
107 to conduct a facial recognition comparison using a facial recognition system.
108 (ii) Except as provided in Subsection (2)(a)(iii), a law enforcement agency shall submit
109 a request for a facial recognition comparison on an image database in writing to the
110 government entity that manages the image database.
111 (iii) A law enforcement agency shall submit a request for a facial recognition
112 comparison on an image database shared with or maintained by the department in accordance
113 with Section 77-23e-104.
114 (b) A trained employee who is employed by the government entity that maintains or
115 has access to the image database shall complete the request if the request:
116 (i) is for a purpose described in Subsection (2)(c);
117 (ii) includes a case identification number; and
118 (iii) is, if it is a request made for the purpose of investigating a crime, supported by a
119 statement of the specific crime and factual narrative to support that there is a fair probability
120 that the individual who is the subject of the request is connected to the crime.
121 (c) An individual described in Subsection (2)(b) shall only comply with requests made
122 for a purpose of:
123 (i) investigating a felony, a violent crime, or a threat to human life; or
124 (ii) identifying an individual who is:
125 (A) deceased;
126 (B) incapacitated; or
127 (C) at risk and otherwise unable to provide the law enforcement agency with his or her
128 identity.
129 (d) The law enforcement agency shall only use the facial recognition comparison:
130 (i) in accordance with the requirements of law; and
131 (ii) in relation to a purpose described in Subsection (2)(c).
132 (3) A government entity may not use a facial recognition system for a civil immigration
133 violation.
134 (4) To make a facial recognition comparison, a trained employee described in
135 Subsection (2)(b) shall:
136 (a) use a facial recognition system that, in accordance with industry standards:
137 (i) makes the comparison using an algorithm that compares only facial biometric data;
138 (ii) is secure; and
139 (iii) is produced by a company that is currently in business;
140 (b) if the facial recognition system indicates a possible match, make an independent
141 visual comparison to determine whether the facial recognition system's possible match is a
142 probable match;
143 (c) if the trained employee determines that there is a possible match that is a probable
144 match, seek a second opinion from another trained employee or the trained employee's
145 supervisor; and
146 (d) (i) if the other trained employee or the trained employee's supervisor agrees that the
147 match is a probable match:
148 (A) report the result to the requesting law enforcement agency through an encrypted
149 method; and
150 (B) return to the requesting law enforcement agency only a result that all trained
151 employees agree is a probable match; or
152 (ii) if the other trained employee or the trained employee's supervisor disagrees that
153 there is a probable match, report the fact that the search returned no results to the requesting
154 law enforcement agency.
155 (5) When submitting a case to a prosecutor, a law enforcement agency of the state or of
156 a political subdivision shall disclose to the prosecutor, in writing:
157 (a) whether a facial recognition system was used in investigating the case; and
158 (b) if a facial recognition system was used:
159 (i) the information the law enforcement agency received in accordance with Subsection
160 (4)(d)(ii); and
161 (ii) a description of how the facial recognition comparison was used in the
162 investigation.
163 Section 4. Section 77-23e-104 is enacted to read:
164 77-23e-104. Department use of facial recognition system with specific images --
165 Restrictions.
166 (1) The department is the only government entity in the state authorized to use a facial
167 recognition system to conduct a facial recognition comparison on an image database that is
168 maintained by or shared with the department.
169 (2) The department may only use a facial recognition system:
170 (a) for a purpose authorized in Subsection 77-23e-103(2)(c); or
171 (b) notwithstanding Subsection 77-23e-103(2)(b), to:
172 (i) compare an image taken of an applicant for a license certificate or an identification
173 card to determine whether the applicant has submitted a fraudulent or an inaccurate application;
174 or
175 (ii) provide images for a photo lineup for a purpose authorized in Subsection
176 77-23e-103(2)(c).
177 (3) Notwithstanding Subsection 77-23e-104(2)(a)(ii), a law enforcement agency shall
178 submit a request to the department to use a facial recognition system on an image database
179 maintained by the department through the Utah Criminal Justice Information System.
180 Section 5. Section 77-23e-105 is enacted to read:
181 77-23e-105. Notice requirement.
182 (1) When capturing an image of an individual when the individual interacts with the
183 government entity, the government entity shall notify the individual that the individual's image
184 may be used in conjunction with facial recognition technology.
185 (2) At least 30 days before the day on which a government entity other than the
186 department begins using a facial recognition system to conduct a facial recognition comparison
187 on the government entity's image database, the government entity shall:
188 (a) publish on the government entity's website:
189 (i) notice of the proposed use of facial recognition system;
190 (ii) a description of the image database on which the government entity plans to use the
191 facial recognition system; and
192 (iii) information about how to provide public comment;
193 (b) allow the public to submit written comments to the government entity within 15
194 days after date of publication;
195 (c) consider timely submitted public comments and the criteria established in this
196 chapter in determining whether to proceed with the intended use of the facial recognition
197 system; and
198 (d) post notice of the final decision on the government entity's website.
199 (3) The process described in Subsection (2) does not create a right of appeal.
200 Section 6. Section 77-23e-106 is enacted to read:
201 77-23e-106. Data protection and disclosure.
202 (1) Notwithstanding Title 63G, Chapter 2, Government Records Access and
203 Management Act, data relating to a facial recognition comparison may not be used or shared
204 for any purpose other than a purpose described in this chapter.
205 (2) (a) Upon request, a government entity shall release statistical information regarding
206 facial recognition comparisons, including:
207 (i) the different types of crime for which the government entity received a request;
208 (ii) how many requests the government entity received for each type of crime; and
209 (iii) the number of probable matches the government entity provided in response to
210 each request.
211 (b) In responding to a request for a release of statistical information under Subsection
212 (2)(a), a government entity may not disclose details regarding a pending investigation.
213 (3) (a) On or after August 1 but before October 15 of each year, a government entity
214 that uses a facial recognition system to conduct a facial recognition comparison shall provide to
215 the Government Operations Interim Committee a report that discloses:
216 (i) the different types of crime for which the department received a request;
217 (ii) how many requests the department received for each type of crime;
218 (iii) the number of probable matches the department provided in response to each
219 request; and
220 (iv) the image source from which the department made each match.
221 (b) In responding to a request for a release of statistical information under Subsection
222 (2)(a), a government entity may not disclose details regarding a pending investigation.