Strike everything after the enacting clause and insert the following:
"NEW SECTION. Sec. 1. The legislature finds that:
(1) Unconstrained use of facial recognition services by state and local government agencies poses broad social ramifications that should be considered and addressed. Accordingly, legislation is required to establish safeguards that will allow state and local government agencies to use facial recognition services in a manner that benefits society while prohibiting uses that threaten our democratic freedoms and put our civil liberties at risk.
(2) However, state and local government agencies may use facial recognition services in a variety of beneficial ways, such as locating missing or incapacitated persons, identifying victims of crime, identifying perpetrators of crime and bringing them to justice, and keeping the public safe.
NEW SECTION. Sec. 2. The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
(1)(a) "Facial recognition service" means technology that analyzes facial features and is used by a state or local government agency for the identification, verification, or ongoing surveillance of individuals in still or video images.
(b) "Facial recognition service" does not include: (i) The analysis of facial features to grant or deny access to a controlled access area or an electronic device or system; (ii) the use of an automated or semiautomated process for the purpose of redacting a recording for release or disclosure outside the law enforcement agency to protect the privacy of a subject depicted in the recording, if the process does not generate or result in the retention of any biometric data or surveillance information; (iii) the analysis of facial features as part of security systems protecting government facilities or property; or (iv) other uses that do not involve the involuntary analysis of the facial features of a member of the general public.
(2) "Facial recognition transparency report" means a report developed in accordance with section 3 of this act.
(3) "Meaningful human review" means review or oversight by one or more individuals who are trained in accordance with section 8 of this act and who have the authority to alter the decision under review.
(4) "Ongoing surveillance" means the continuous tracking of the physical movements of an identified individual through one or more public places for more than forty-eight consecutive hours by law enforcement.
NEW SECTION. Sec. 3. (1) At least ninety days prior to putting a facial recognition service into operational use for the first time after the effective date of this section, a state or local government agency must produce a facial recognition transparency report. The report must be clearly communicated to the public, posted on the agency's public web site, and submitted to the consolidated technology services agency established in RCW 43.105.006. The consolidated technology services agency must post each submitted transparency report on its public web site.
(2) Each facial recognition transparency report must include, at minimum, clear and understandable statements of the following:
(a) The name of the facial recognition service, vendor, and version, and a description of its general capabilities and limitations;
(b) A description of the purpose and proposed use of the facial recognition service and its intended benefits, including any data or research demonstrating those benefits;
(c) A clear use and data management policy;
(d) Measures taken to minimize inadvertent collection of additional data beyond the amount necessary for the specific purpose or purposes for which the facial recognition service will be used;
(e) Data integrity and retention policies applicable to the data collected using the facial recognition service, including how the agency will maintain and update records used in connection with the service, how long the agency will keep the data, and the processes by which data will be deleted;
(f) Any additional rules that will govern use of the facial recognition service;
(g) The agency's testing procedures, including its processes for periodically undertaking operational tests of the facial recognition service in accordance with section 6 of this act;
(h) The agency's procedures for receiving feedback, including the channels for receiving feedback from individuals affected by the use of the facial recognition service and from the community at large, as well as the procedures for responding to feedback.
(3) Prior to finalizing and implementing the facial recognition transparency report, the agency must consider issues raised by the public through:
(a) A public review and comment period; and
(b) Community consultation meetings during the public review period.
(4) The agency may update its facial recognition transparency report as it deems necessary and each update must be subject to the public comment and community consultation processes described in this section and submitted to the consolidated technology services agency.
(5) The facial recognition transparency report required for any facial recognition system in use as of the effective date of this section is due December 1, 2021.
NEW SECTION. Sec. 4. (1) State and local government agencies using a facial recognition service are required to prepare and publish an annual report that discloses:
(a) A summary of the extent of their use of such services;
(b) An assessment of compliance with the provisions of the agency's facial recognition transparency report;
(c) Any known violations of the agency's facial recognition transparency report; and
(d) Any revisions to the facial recognition transparency report recommended by the agency.
(2) All agencies must hold community meetings to review and discuss their annual report within sixty days of its public release.
NEW SECTION. Sec. 5. State and local government agencies using a facial recognition service to make decisions that produce legal effects concerning individuals must ensure that those decisions are subject to meaningful human review. Decisions that produce legal effects concerning individuals means decisions that result in the provision or denial of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities such as food and water.
NEW SECTION. Sec. 6. Prior to deploying a facial recognition service in the context in which it will be used, state and local government agencies using a facial recognition service to make decisions that produce legal effects on individuals must test the facial recognition service in operational conditions. State and local government agencies must take reasonable steps to ensure best quality results by following all reasonable guidance provided by the developer of the facial recognition service.
NEW SECTION. Sec. 7. (1)(a) A state or local government agency that deploys a facial recognition service must require a facial recognition service provider to either:
(i) Make available an application programming interface or other technical capability, chosen by the provider, to enable legitimate, independent, and reasonable tests of those facial recognition services for accuracy and unfair performance differences across distinct subpopulations. However, making such an application programming interface or other technical capability available does not require the disclosure of proprietary data, trade secrets, intellectual property, or other information, or if doing so would increase the risk of cyber attacks including, without limitation, cyber attacks related to unique methods of conducting business, data unique to the product or services, or determining prices or rates to be charged for services. Such subpopulations are defined by visually detectable characteristics such as: (A) Race, skin tone, ethnicity, gender, age, or disability status; or (B) other protected characteristics that are objectively determinable among the individuals portrayed in the testing data set: Provided, however, that such characteristics are characteristics that the facial recognition service provider claims the technology is capable of detecting, and are characteristics that the state or local government agency intends to detect with its facial recognition service; or
(ii) Submit the service to the national institute of standards and technology for review and testing.
(b) If the results of the independent testing identify material unfair performance differences across subpopulations, and the methodology, data, and results are disclosed in a manner that allows full reproduction directly to the provider who, acting reasonably, determines that the methodology and results of that testing are valid, then the provider must develop and implement a plan to mitigate the identified performance differences.
(2) This section does not apply to any facial recognition service in use as of the effective date of this section. Upon renewal or extension of any contract as of the effective date of this section, or upon entering into a new contract for facial recognition services, the state or local government agency must ensure that the facial recognition service provider fulfills the requirements of this section.
NEW SECTION. Sec. 8. State and local government agencies using a facial recognition service must conduct periodic training of all individuals who operate a facial recognition service or who process personal data obtained from the use of a facial recognition service. The training must include, but not be limited to, coverage of:
(1) The capabilities and limitations of the facial recognition service;
(2) Procedures to interpret and act on the output of the facial recognition service; and
(3) To the extent applicable to the deployment context, the meaningful human review requirement for decisions that produce legal effects concerning individuals.
NEW SECTION. Sec. 9. (1) State and local government agencies must disclose to a criminal defendant evidence gathered through the use of a facial recognition service that has been used, or is intended to be used against the defendant in the current criminal proceeding in a timely manner prior to trial.
(2) State and local government agencies using a facial recognition service shall maintain records of their use of the service that are sufficient to facilitate the annual reporting under section 4 of this act.
NEW SECTION. Sec. 10. This chapter does not apply to a state or local government agency that is mandated to use a specific facial recognition service pursuant to a federal regulation or order.
NEW SECTION. Sec. 11.
A new section is added to chapter 9.73
RCW to read as follows:
(1) State and local government agencies may not use a facial recognition service:
(a) In a manner that disturbs a person's private affairs, or invades their home, without authority of law;
(b) Without a bona fide criminal justice purpose;
(c) Without reasonable suspicion that a criminal offense has been committed, is being committed, or is about to be committed; or
(d) To engage in ongoing surveillance unless the use is in support of law enforcement activities and there is reasonable suspicion to believe that an individual has committed, is engaged in, or is about to commit, a criminal offense or there is a need by law enforcement to invoke their community caretaking function, and either:
(i) A court order has been obtained to permit the use of the facial recognition service for ongoing surveillance; or
(ii) Where the agency reasonably determines that an exigent circumstance exists, and an appropriate court order is obtained as soon as reasonably practicable. In the absence of an authorizing order, such use must immediately terminate at the earliest of the following:
(A) The information sought is obtained;
(B) The application for the order is denied; or
(C) When forty-eight hours have lapsed since the beginning of the emergency surveillance for the purpose of ongoing surveillance.
(2) State and local government agencies must not apply a facial recognition service to any individual based on their religious, political, or social views or activities, participation in a particular noncriminal organization or lawful event, or actual or perceived race, ethnicity, citizenship, place of origin, age, disability, gender, gender identity, sexual orientation, or other characteristic protected by law. This subsection does not condone profiling. The prohibition in this subsection does not prohibit state and local government agencies from applying a facial recognition service to an individual who possesses one or more of these characteristics where an officer of that agency holds a reasonable suspicion that that individual has committed, is engaged in, or is about to commit a criminal offense or there is need to invoke their community caretaking function.
(3) State and local government agencies may not use a facial recognition service to create a record describing any individual's exercise of rights guaranteed by the First Amendment of the United States Constitution and by Article I, section 5 of the state Constitution, unless:
(a) Such use is pertinent to and within the scope of an authorized law enforcement activity; and
(b) There is reasonable suspicion to believe the individual has committed, is engaged in, or is about to commit a criminal offense or there is need to invoke their community caretaking function.
(4) Law enforcement agencies that utilize body worn camera recordings shall comply with the provisions of RCW 42.56.240
(5) State and local law enforcement agencies may not use the results of a facial recognition service as the sole basis to establish probable cause in a criminal investigation. The results of a facial recognition service may be used in conjunction with other information and evidence lawfully obtained by a law enforcement officer to establish probable cause in a criminal investigation.
(6) State and local law enforcement agencies may not use a facial recognition service to identify an individual based on a sketch or other manually produced image.
(7) State and local law enforcement agencies may not substantively manipulate an image for use in a facial recognition service in any manner not consistent with the facial recognition service provider's intended use and training.
NEW SECTION. Sec. 12. Sections 1 through 10 of this act constitute a new chapter in Title 43 RCW."
(2) Modifies definitions of facial recognition service and ongoing surveillance. Adds a definition of facial recognition transparency report. Deletes the definition of persistent tracking and others.
(3) Requires transparency reports (rather than accountability reports), and specifies their content, review, and timing.
(4) Modifies annual reports to include summaries of uses of facial recognition services, as well as compliance with, known violations of, and recommended revisions to, transparency reports. Does not require submission to the Office of Privacy and Data Protection.
(5) Narrows requirements for human review and operational testing. Requires human review of decisions producing legal effects, but not decisions producing "similarly significant effects concerning individuals."
(6) Modifies independent testing requirements. Authorizes government agencies to submit facial recognition services to the National Institute of Standards & Technology (in addition to making an Application Programming Interface (API) available). Modifies API provisions to describe certain characteristics as those that providers claim the technology is capable of detecting and that government agencies intend to detect. Does not require testing of services already in use.
(7) Modifies disclosure and report requirements. Requires timely disclosure to criminal defendants of the evidence gathered through facial recognition services for use in current criminal proceedings. Does not require reports of ongoing surveillance to the state Administrator for the Courts.
(8) Prohibits use of facial recognition services without authority of law, a bona fide criminal justice purpose, or without reasonable suspicion of a criminal offense. Also prohibits the use of services to engage in ongoing surveillance unless certain conditions are met, including that there is reasonable suspicion of a criminal offense (rather than probable cause of a felony).
(9) Modifies permitted and prohibited applications. Permits applying facial recognition services in specified circumstances where there is reasonable suspicion of a criminal offense (rather than a felony).
(10) Specifies that government agencies may not use results of facial recognition services as the sole basis to establish probable cause. Prohibits using services to identify individuals based on sketches and manipulating images for use inconsistent with the service provider's intended use and training.
(11) Strikes the Legislative Task Force on Facial Recognition Services.