On March 31, 2020, Washington became the first state in the U.S. with a law governing the use of Facial Recognition Services (FRS). The new law, which takes effect on July 1, 2021, is aimed at facilitating the use of FRS by state and local agencies. In passing this new law, Washington has taken a completely different path from cities like San Francisco, which had banned the use of FRS by local government agencies last year.

The law defines FRS as “technology that analyzes facial features and is used by a state or local government agency for the identification, verification, or persistent tracking of individuals in still or video images.” It requires an agency intending to use FRS to follow various requirements including filing a notice of intent with a legislative authority specifying the purpose for which the technology will be used, and producing an accountability report, which should include the name of FRS, types of data input, purpose and proposed use, use and data management policy, rate of false matches and impact on protected subpopulations, potential impact on civil rights and liberties and procedures for receiving feedback. The agency has to allow for public review and comment of the accountability report, including three community consultation meetings, prior to finalizing it. The law also provides that the accountability report should be clearly communicated to the public at least 90 days before the FRS is operational, should be updated every two years and submitted to a legislative authority.

One of the major criticisms against the use of FRS is the inaccurate results produced when used on photos of racial minorities. This issue was highlighted in a study by the ACLU, which showed that Amazon’s face recognition system falsely matched photographs of 28 members of Congress with mugshot photos. A study by NIST also found that algorithms falsely identified African-American and Asian faces 10 to 100 times more than Caucasian faces. The law requires vendors to report any complaints or report of bias. It also requires the FRS provider to make available an Application Programming Interface (API), without increasing the risk of cyberattacks or disclosing proprietary data, to enable tests for accuracy and unfair performance differences across distinct subpopulations. If the testing shows material unfair performance differences across subpopulations, the FRS provider must develop and implement a plan to mitigate those differences within 90 days of receipt of such results. However, the law does not state a required standard of accuracy that providers should meet. It also does not require that the data sets used to train the FRS algorithms contain photographs from a diverse population.

Another major concern regarding the use of FRS is that it can be used as a passive system for general surveillance without the knowledge, consent, or participation of the subject. The widely reported use of FRS by China to track, monitor and target ethnic minorities has accentuated these concerns. The law attempts to address this issue by requiring that a state or local government agency may not use FRS to engage in ongoing surveillance unless: a) a warrant is obtained authorizing its use; b) “exigent circumstances” exist; or c) a court order is obtained authorizing the use of the service for the sole purpose of locating or identifying a missing person, or identifying a deceased person. If the FRS is used for surveillance, the law requires the agency to provide a report summarizing non-identifying demographic data of individuals named in warrant applications to a legislative authority. It also includes reporting requirements for judges who have either issued or denied warrants for the use of FRS for the purpose of surveillance. The law does not include any consent requirements from the subject of the surveillance, or any rights to those persons regarding the collection, use or storage of their data.

The use of FRS in criminal investigations is also allowed. The law requires that the use of FRS on a criminal defendant should be disclosed to that defendant in a timely manner prior to trial, though this required timeliness is not defined. FRS should not be used as the sole basis to establish probable cause in a criminal investigation, or to identify an individual based on a sketch or other manually produced image. It also requires “meaningful human review” and testing of the FRS in operational conditions, if the service is used to make decisions that produce legal or significant effects concerning individuals. “Meaningful human review" is defined as review or oversight by one or more individuals who are trained and who have the authority to alter the decision under review. The law does not provide any standards for the review process.

The law contains provisions for training, auditing and compliance. Any agency using FRS is required to conduct periodic training of all individuals who operate the FRS, or who process personal data obtained from the use of FRS. The agency should also maintain records of the use of FRS that are sufficient to facilitate public reporting and auditing for compliance. The law requires the formation of a task force to provide recommendations addressing the potential abuses and threats posed by the use of FRS to civil liberties, including privacy, while facilitating and encouraging the continued development of FRS so that society could continue to utilize its benefits.

While the law is generally aimed at allowing the increased use of FRS, it does provide some minimal limits to the use of the technology. For example, it prohibits the use of FRS based on an individual’s: a) religious, political, or social views or activities, participation in lawful events, or actual or perceived characteristic protected by law; and b) exercise of rights guaranteed by the First Amendment or Article I Section 5 of the State Constitution. It is unclear whether this amounts to any additions to already existing constitutional protections. An agency is also prohibited from manipulating an image for use in an FRS in a manner not consistent with the FRS provider's intended use and training. This provides a potential defense to an FRS provider in any litigation based on prohibited use by an agency.

U.S. Customs and Border Protection (CBP) and the Transportation Security Administration (TSA) are some of the major users of FRS. According to a report by the Department of Homeland Security, the Traveler Verification Service (TVS), developed by CBP, uses facial comparison to automate manual identity verification, and had scanned the faces of more than 20 million travelers entering and exiting the country as of June 2019. The law specifically excludes the use of FRS in association with a federal agency to verify the identity of individuals presenting themselves for travel at an airport or seaport. It is also not applicable to the use of FRS pursuant to a federal regulation or order, undertaken through partnership with a federal agency to fulfill a congressional mandate, or use by the state department of licensing.

The law is aimed at facilitating the use of FRS. While it contains various reporting requirements for agencies using FRS, there are minimal rights for the persons subject to the use of FRS, and it does not provide any standards that the FRS providers or users should meet. However, as the first legislation in the United States devoted to the use of FRS, it is a significant development that will influence regulation of this fast-evolving technology with potential widespread application, and substantial impact to civil rights and privacy.