Protections for Biometric Data

Not specific to FRT, many states have enacted or are considering enacting biometric protection legislation targeting private sector collection, use, and disclosure of biometric data, including photographs or facial scans that are integral to deploying FRT. Illinois, Texas, and Washington have enacted biometric-specific legislation that requires notice and consent for the collection and/or disclosure of biometric identifiers. Facebook is currently embroiled in litigation under the Illinois statute, facing a claim that it used FRT on individuals’ photographs without their knowledge or consent.

Similar legislation has been introduced in several state legislatures, including Massachusetts (S.120, Sen. Creem (D)), New York (S01203, Sen. Ritchie (R); A01911, Asm. Gunther (D) and others), and Michigan (HB5019, Rep. Lucido). Notably, the California Consumer Privacy Act of 2018, which provides expansive privacy protections including for biometric data, comes into force on January 1, 2020.

Restrictions on Probe Images

Several jurisdictions have enacted or are considering legislation or policies to restrict the type of probe images that law enforcement may use. Broadly speaking, these laws fall into at least two different categories.

First, a variety of laws prohibit the use of FRT in conjunction with certain types of technologies, namely police body cameras and drones (or “unmanned aerial vehicles”). New Hampshire and Oregon, for example, prohibit the use of FRT in conjunction with body cams and/or video obtained from body cams. California’s proposed Body Camera Accountability Act (AB1215, Asm. Ting (D)) would also expressly prohibit the use of FRT on police body cams. The federal Police Camera and Accountability Act (HR3364, Reps. Norton (D) and Beyer (D)) would require all federal officers to wear body cams while prohibiting the use of FRT in conjunction with those cameras. Finally, the federal Police CAMERA Act of 2019 (HR120, Reps. Cohen (D) and others) would authorize grants for the purchase of law enforcement body cameras, a condition of which would be limiting the use of FRT in conjunction with them to certain circumstances. It is also worth noting that the Axon AI and Policing Technology Ethics Board recently recommended that Axon not develop FRT for body cameras - a recommendation that Axon has adopted.

Similarly, laws prohibiting or restricting the use of FRT in conjunction with drones or “unmanned aerial vehicles” exist in Maine and Vermont, and have been proposed in New York (A04030, Asm. Englebright (D) and others; S06435, Sens. Ramos (D) and Salazar (D)) and Massachusetts (S.1447, Sen. O’Connor (R); S.1446, Sen. Moore (D) and others), among other places.

Second, an important substantive limitation on FRT, and one supported by the Policing Project, is limiting the types of crimes that may be investigated with FRT. In other words, for criminal investigations, limiting probe photos to serious felonies and prohibiting FRT use on low-level misdemeanors. This type of limitation was recommended by the Georgetown Law Center on Privacy and Technology, and is currently being considered for a U.S. Senate bill that has yet to be formally proposed. At the local level, a directive currently under consideration in Detroit would limit police use of FRT to specified violent crime (e.g., robbery, sexual assault, or homicide) and home invasion investigations.

Restrictions on the Target Database

In addition to limiting the types of probe photographs that may be used, numerous legislatures have enacted or are considering a variety of restrictions on target databases – the databases that law enforcement may use to identify a probe photograph.

First, a subject of recent media attention, a number of states have enacted legislation or regulations (a) prohibiting or restricting law enforcement access to such databases, or (b) restricting the use of FRT or collection of biometric data altogether. These states include Missouri, Hawaii, New Hampshire, Oregon, Vermont, and Washington. (However, notwithstanding the existence of this type of legislation in Vermont, it was recently reported that its license photograph database has been used by the FBI, as well as by Immigration and Customs Enforcement in recent undocumented immigrant raids.) The Canadian province of Saskatchewan also prohibits disclosure of its facial recognition software or information obtained using it in relation to license and identification photos to any other entity, including police, without a warrant or court order (except in the case of identity theft).

Short of prohibiting law enforcement from accessing these databases, the recently-introduced Facial, Analysis, Comparison and Evaluation (FACE) Protection Act (HR4021, Rep. Engel (D) and others) would prohibit a federal agency from using FRT on state or federal photo identification without a federal court order based on probable cause.

Another type of target-database restriction relates to the types of mugshots that law enforcement may use as part of their target database. The Georgetown Law Center on Privacy & Technology’s Model Face Recognition Legislation includes provisions that would regulate police access to both identification photo databases and arrest photo databases for the purposes of FRT-assisted searches. Certain law enforcement agencies are already bound by such restrictions. Michigan State Police, for example, are required by law to delete mug shots and other biometric data of people who aren’t charged or who are acquitted.