While Washington’s comprehensive data privacy bill (SB 6182) — inspired by California’s CCPA — died when legislators could not hammer out a compromise over enforcement mechanisms, the state legislature did reach agreement and Gov. Jay Inslee signed into law a facial recognition bill (SB 6280) that provides some important privacy and antidiscrimination provisions regarding state and local governmental use of the technology.
The Washington law defines a “facial recognition service” as “technology that analyzes facial features and is used by a state or local government agency for the identification, verification, or persistent tracking of individuals in still or video images.” The law imposes quite a few requirements on state and local governmental agencies using facial recognition services. For example, such agencies must file a notice of intent and an accountability report prior to developing, procuring, or using a facial recognition service. The report would outline a number of key issues such as how that data is collected and processed; how the agency will use, manage, retain and secure the data; how employees will be trained on its use; and how the software will be tested before roll-out. By way of further example, the law requires agencies using facial technology to make decisions that produce legal effects for individuals (e.g., finance and lending, housing, insurance, criminal justice, health care) to ensure such decisions are “subject to meaningful human review.” Other requirements extend to training, testing, disclosures of errors and complaints, and a variety of other important issues.
The law does include a number of important exceptions, such as for the analysis of facial features to access an electronic device or uses mandated by federal regulation, including verifying identities at an airport or seaport.
On the whole, the Washington law obtains a certain level of transparency regarding state and local governmental use of facial recognition applications, while at the same time, creating a pathway for such use. It is possible that given its balanced approach, the law could become a template of sorts for other states, although some have already imposed limitations on the use of facial recognition by government agencies (such as California’s three-year moratorium on the use by law enforcement of facial recognition and other biometric surveillance in connection with body cameras). Of course, this law does not regulate commercial uses of the technology, a topic that is contentious and multifaceted, but also on the radar of many state legislatures (particularly given the steady flow of litigation stemming from Illinois’s Biometric Information Privacy Act (BIPA)).