While it received little publicity in the midst of the COVID-19 pandemic, Washington State recently passed a landmark facial recognition law regulating state and local government agencies’ deployment of facial recognition software. The law becomes effective July 1, 2021, and could ultimately forecast future private sector regulation.

The law regulates facial recognition services, defined as technology that analyzes facial features for the “identification, verification, or persistent tracking of individuals”. The law requires agencies to conduct operational and independent testing of the facial recognition technology, requires employee training and meaningful human review. Agencies that use facial recognition technology must comply with multiple requirements, including filing a notice of intent with the relevant legislative authority. The agency must also file an accountability report, detailing the following:

• The name of the facial recognition technology, its proposed use and a description of its capabilities and limitations
• The type of data input and a description of how data is collected and processed
• The type of data the facial recognition technology will ultimately generate
• A use and data management policy requiring, in part, a description of how the agency will deploy the technology and whether it will be used by another entity on the agency’s behalf
• Principles of data minimization, data integrity, and data retention
• The agency’s training procedure for personnel who operate the technology or process personal data obtained from use of the technology
• A plan to address error rates and unauthorized use
• Potential impact to privacy and marginalized communities and a plan to mitigate those concerns

Prior to finalizing the accountability report, the agency must permit public review, comment, and community meetings. The report must be updated once every two years. Further, the agency must require vendors to disclose any complaints of bias found in the technology.

Importantly, meaningful human review is required where an agency uses facial recognition technology to make decisions that produce legal or “similarly significant effects” concerning the “provision or denial of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities such as food and water, or that impact civil rights of individuals.” Prior to making these decisions, the agency must first test the technology in operational conditions and make the tool available for independent testing.

In contrast to other state and local bans on deploying facial recognition tools, Washington State has shown itself to be a leader in regulating facial recognition technology. What is left to be determined, however, is its influence on the use and regulation of this technology in the private sector.

[View source.]