May 25, 2020

Washington Governor Signs Bill Addressing Government Use of Facial Recognition Technology

While Washington’s comprehensive data privacy bill (SB 6182) — inspired by California’s CCPA — died when legislators could not hammer out a compromise over enforcement mechanisms, the state legislature did reach agreement and Gov. Jay Inslee signed into law a facial recognition bill (SB 6280) that provides some important privacy and antidiscrimination provisions regarding state and local governmental use of the technology.

The Washington law defines a “facial recognition service” as “technology that analyzes facial features and is used by a state or local government agency for the identification, verification, or persistent tracking of individuals in still or video images.” The law imposes quite a few requirements on state and local governmental agencies using facial recognition services. For example, such agencies must file a notice of intent and an accountability report prior to developing, procuring, or using a facial recognition service. The report would outline a number of key issues such as how that data is collected and processed; how the agency will use, manage, retain and secure the data; how employees will be trained on its use; and how the software will be tested before roll-out. By way of further example, the law requires agencies using facial technology to make decisions that produce legal effects for individuals (e.g., finance and lending, housing, insurance, criminal justice, health care) to ensure such decisions are “subject to meaningful human review.” Other requirements extend to training, testing, disclosures of errors and complaints, and a variety of other important issues.

The law does include a number of important exceptions, such as for the analysis of facial features to access an electronic device or uses mandated by federal regulation, including verifying identities at an airport or seaport.

On the whole, the Washington law obtains a certain level of transparency regarding state and local governmental use of facial recognition applications, while at the same time, creating a pathway for such use. It is possible that given its balanced approach, the law could become a template of sorts for other states, although some have already imposed limitations on the use of facial recognition by government agencies (such as California’s three-year moratorium on the use by law enforcement of facial recognition and other biometric surveillance in connection with body cameras). Of course, this law does not regulate commercial uses of the technology, a topic that is contentious and multifaceted, but also on the radar of many state legislatures (particularly given the steady flow of litigation stemming from Illinois’s Biometric Information Privacy Act (BIPA)).

© 2020 Proskauer Rose LLP.


About this Author

Jeffrey D Neuburger, Proskauer Rose Law Firm, Technology Attorney

Jeffrey Neuburger is co-head of Proskauer’s Technology, Media & Telecommunications Group, head of the Firm’s Blockchain Group and a member of the Firm’s Privacy & Cybersecurity Group.

Jeff’s practice focuses on technology, media and intellectual property-related transactions, counseling and dispute resolution. That expertise, combined with his professional experience at General Electric and academic experience in computer science, makes him a leader in the field.

As one of the architects of the technology law...