Background: Facial Recognition in General. Facial recognition is a type of biometric technology that provides a way to establish or verify the identify of natural person based on one or more physical or behavioral characteristics and is used in various applications such as security, law enforcement, banking, and retail. Examples of physical characteristics are face, fingerprint, and iris images. An example of a behavioral characteristic is an individual's signature.

Facial recognition technology compares an individual’s facial features to available images for identification or authentication. Facial detection technology determines whether the image contains a face. Facial analysis technology aims to identify attributes such as gender, age, or emotion from detected faces.

Current State Laws. Unless authorized by law, state agencies may not collect, capture, purchase or otherwise obtain a biometric identifier without first providing notice and obtaining the individual's consent. Agencies that obtain any biometric identifier must establish certain security policies and meet certain requirements regarding the use, storage, sale, and sharing of such information.

Biometric identifier means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Exceptions are identified such as when information is derived from photographs, demographic data, or physical descriptions such as height, weight, hair color, or eye color.

State Agencies. The Consolidated Technology Services (CTS) agency supports state agencies as a centralized provider and procurer of information technology services. Within CTS, the Office of the Chief Information Officer (OCIO) has primary duties related to information technology for state government, which include establishing statewide enterprise architecture and standards for consistent and efficient operation. Within the OCIO, the Office of Privacy and Data Protection (OPDP) serves as a central point of contact for state agencies on policy matters involving data privacy and data protection.

Summary of Engrossed First Substitute Bill: Accountability Report. Agencies using or intending to develop, procure, or use a service must produce an accountability report for that service. Each accountability report must include certain statements such as a description of the proposed use of the service and procedures regarding testing and channels for receiving feedback.

Each accountability report must be subject to a public review period and be updated every two years. The report must be posted on the agency's website and submitted to CTS for posting to its public website.

Annual Report. Agencies using a service must publish an annual report disclosing:

• the extent of their use of such services;
• an assessment of compliance with the terms of their accountability report; and
• any known or reasonably suspected violations of their accountability report.

The annual report must be submitted to the OPDP. All agencies must hold community meetings to review their annual report within 60 days of its public release.

Meaningful Human Review. Agencies using a service to make decisions that produce legal effects must ensure those decisions are subject to meaningful human review. Decisions that produce legal effects must include, but not be limited to, denial of financial and lending services, housing, insurance, education enrollment, employment opportunities, and health care services.

Independent Testing. Agencies must require a service provider to make available an application programming interface to enable independent testing for accuracy and unfair performance differences across distinct subpopulations. If results of the independent testing identify material unfair performance difference across subpopulations and those results are validated, then the provider must develop and implement a plan to address the identified performance differences.

Operational Testing. Prior to deploying a service, agencies must test a service in operational conditions. Agencies must take steps to ensure best quality results by following guidance provided by the service developer.

Training. Agencies using a service must conduct periodic training of all individuals who operate a service or who process personal data obtained from the use of a service. Minimum training requirements are specified.

Prohibitions. Agencies may not use a service for ongoing surveillance unless in support of law enforcement and the ongoing surveillance may provide evidence of a serious criminal offense, and either:

• a search warrant has been obtained; or
• where the agency director determines it is necessary to prevent or respond to an emergency involving imminent danger or risk of death or serious physical injury to a person. Written approval must be obtained from the agency director prior to using the service for ongoing surveillance and a search warrant must subsequently be obtained 48-hours after the ongoing surveillance begins.

Agencies must not apply a service to any consumer based on certain characteristics protected by law. This prohibition does not prohibit agencies from applying a service to a consumer who happens to possess one or more characteristics where an officer of that agency holds a reasonable suspicion that the consumer has committed, is committing, or is about to commit a serious criminal offense.

Agencies may not use a service to create a record describing any consumer's exercise of rights guaranteed by the First Amendment of the U.S. Constitution and by Article I, section 5 of the state Constitution, unless:

• such use is specifically authorized by applicable law and is pertinent to and within scope of an authorized law enforcement activity; and
• there is reasonable suspicion to believe the consumer has committed, is committing, or is about to commit a serious criminal offense. 

Exemption. This act does apply to a state or local government agency mandated to use a specific facial recognition service pursuant to a federal regulation or order.

Disclosure and Records. Agencies must disclose their use of a service on a criminal defendant to that defendant in a timely manner prior to trial. Agencies using a service shall maintain records of their use of a service to facilitate public reporting and auditing of compliance with the agency's service policies.

Any judge who has issued a warrant for ongoing surveillance shall report to the state supreme court information regarding the warrants, such as the fact that a warrant or extension was applied for, the period of ongoing surveillance, and the nature of the public spaces where the surveillance was conducted.

Task Force.A task force on facial recognition services is established with the purpose of:

• providing recommendations addressing the potential abuses and threats posed by the use of a service while also addressing how to facilitate and encourage the continued development of a service so society continues to utilize its benefits;
• providing recommendations regarding the adequacy and effectiveness of applicable Washington state laws; and
• conducting a study on the quality, accuracy, and efficacy of a service.

Task force membership is composed of legislative members and representatives from advocacy organizations, government agencies, retailers that deploy services in public spaces, companies that develop and provide services, and research institutions with expertise on services. The task force shall submit a report of its findings and recommendations to the Governor and the Legislature by September 30, 2021.

Staff Summary of Public Testimony: The committee recommended a different version of the bill than what was heard. PRO: We need accountability measures in place to serve our communities. This is thoughtful regulation of the government's use of facial recognition technology by requiring transparency, judicial oversight, and community engagement.

CON: We suggest a moratorium on the government use of the technology until certain requirements are met. This seeks to regulate technology before allowing communities to decide if they want the technology used in the first place. The reporting requirements are a deterrent to the use of certain technology. There are concerns with provisions regarding a search warrant.

OTHER: We want to make sure that the testing requirements do not release any proprietary information and that this is not in conflict with the body camera statute