Washington's New Facial Recognition Law
April 3, 2020
By Eugenia Lostri
On March 31, the state of Washington approved most of SB 6280, which looks to regulate state and local government agencies’ use of facial recognition services by July 2021.
The bill attempts to provide an alternative to the frameworks that have been considered so far: it is neither a ban on the use of facial recognition nor does it allow for its unchecked use by local and state authorities. As expected, this middle ground will satisfy almost no one – except, perhaps Microsoft. The spirit behind the document is indeed commendable; recognizing that the positive uses for technology and the opportunities it represents for the advancement of security and protection of citizens has to be balanced with the always looming potential for abuse and exploitation, invariably affecting already vulnerable populations.
Is this balance something to be achieved through a moratorium on the technology until it is deemed to be good enough? Or do better frameworks governing its development, acquisition, and use need to be put in place?
The middle ground was received with criticism by both sides. The Washington’s ACLU considered the new legislation to amount to no more than “weak regulations” and called for a face surveillance moratorium or ban in its place. Some of their concerns pertain to the lack of accountability or enforcement measures to ensure agency compliance, allowing the use of facial recognition to make determinations on essential services, which is subject only to “meaningful human review,” and the lack of sufficient restrictions for certain categories of deployment.
The ACLU’s concerns are valid and need addressing; this bill does not do a good enough job at regulating the use of facial recognition technology by state and local agencies. But the problem does not stem from the technology itself, but from the lack of a proper legal framework to guide its use.
One of the bill’s flaws is that it does not really provide guidelines for the deployment and use of the technology, or the management of the data involved. The closest it comes to anything of the sort is by requiring that a task force be set up by the William D. Ruckelshaus Center – a collaboration between the Washington State University and the University of Washington that seeks to provide “university expertise” for the development of public policy – to issue a report and recommendations to address the threats posed by facial recognition technology, asses the effectiveness and adequacy of the state’s laws and “study the quality, accuracy, and efficacy of a facial recognition service”. Although SB 6280 requires agencies to develop accountability reports when they intend to “develop, procure or use a facial recognition service”, it provides no specifics as to what agencies need to keep in mind as to successfully avoid “uses that threaten our 12 democratic freedoms and put our civil liberties at risk”.
On that note, it is unfortunate that the bill was partially banned by Governor Inslee. Objecting to the multi-stakeholder facial recognition task force – on the grounds that such implementation was not included in the budget – halts the development of a comprehensive and inclusive debate on the effects of this technology. Broad and vague language in the text, paired up with a lack of subsequent determinations by a credible task force, weaken the claim that this can be an effective piece of legislation.
So, what is the impact of this bill? Not much as of now. It will come into effect July 2021, with no proper recommendations for its application, and in the meantime, current usage is still allowed. In addition to the use of facial recognition by the licensing department, which is explicitly excluded from the scope of the new bill, the state of Washington has been deploying this technology in partnership with the US Customs and Border Protection at air exit at the Seattle-Tacoma airport and for sea entry. These uses are also not subject to the new regulation, which does not apply when deployment of facial recognition services is done “in association with a federal agency to verify the identity of individuals presenting themselves for travel at an airport or seaport.” As conveyed, other known uses in the state involve the Seattle Police Department, two private schools, its use for mug shots, Jacksons food stores and a ring partnership with the Edgewood Police Department.
If there is something to be highlighted from this effort it is the attempt at recognizing the possibility for the use of facial recognition under formal scrutiny, developing a framework that would control how and why it is used. Execution of this intent failed to establish the one instance of multi-stakeholder accountability that could have provided the process with a diversity of viewpoints and provided legitimacy to the regulation. If this legislation is to be taken as an example for other states or even at the federal level, it should be in its spirit, and not its form.
Eugenia Lostri is a program coordinator and research assistant with the Technology Policy Program at the Center for Strategic and International Studies in Washington, DC.
The Technology Policy Blog is produced by the Technology Policy Program at the Center for Strategic and International Studies (CSIS), a private, tax-exempt institution focusing on international public policy issues. Its research is nonpartisan and nonproprietary. CSIS does not take specific policy positions. Accordingly, all views, positions, and conclusions expressed in this publication should be understood to be solely those of the author(s).
