Full text
- This is an unofficial copy. The document has been archived and reformatted in plaintext for AGORA. Footnotes, tables, and similar material may be omitted. For the official text, visit the original source.
- Thematic tags for this document are awaiting validation (peer review by a second AGORA editor).
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 77-23e-101 is enacted to read:
CHAPTER 23e. GOVERNMENT USE OF FACIAL RECOGNITION TECHNOLOGY
77-23e-101. Title.
This chapter is known as "Government Use of Facial Recognition Technology."
Section 2. Section 77-23e-102 is enacted to read:
77-23e-102. Definitions.
As used in this chapter:
(1) "Department" means the Department of Public Safety, created in Section 53-1-103.
(2) "Facial biometric data" means data derived from a measurement, pattern, contour,
or other characteristic of an individual's face, either directly or from an image.
(3) "Facial recognition comparison" means the process of comparing an image or facial
biometric data to an image database.
(4) (a) "Facial recognition system" means a computer system that, for the purpose of
attempting to determine the identity of an unknown individual, uses an algorithm to compare
biometric data of the face of the unknown individual to facial biometric data of known
individuals.
(b) "Facial recognition system" does not include:
(i) a system described in Subsection (4)(a) that is available for use, free of charge, by
the general public; or
(ii) a system a consumer uses for the consumer's private purposes.
(5) (a) "Government entity" means:
(i) an executive department agency of the state;
(ii) the office of:
(A) the governor;
(B) the lieutenant governor;
(C) the state auditor;
(D) the attorney general; or
(E) the state treasurer;
(iii) the Board of Pardons and Parole;
(iv) the Board of Examiners;
(v) the National Guard;
(vi) the Career Service Review Office;
(vii) the State Board of Education;
(viii) the Utah Board of Higher Education;
(ix) the State Archives;
(x) the Office of the Legislative Auditor General;
(xi) the Office of Legislative Fiscal Analyst;
(xii) the Office of Legislative Research and General Counsel;
(xiii) the Legislature;
(xiv) a legislative committee of the Legislature;
(xv) a court, the Judicial Council, the Administrative Office of the Courts, and similar
administrative units in the judicial branch;
(xvi) a state institution of higher education as that term is defined in Section
53B-3-102;
(xvii) an entity within the system of public education that receives funding from the
state; or
(xviii) a political subdivision of the state as that term is defined in Section 63G-7-102.
(b) "Government entity" includes:
(i) every office, agency, board, bureau, committee, department, advisory board, or
commission of an entity described in Subsection (5)(a) that is funded or established by the
government to carry out the public's business; or
(ii) an individual acting as an agent of a government entity or acting on behalf of an
entity described in this Subsection (5).
(6) (a) "Image database" means a database maintained by a government entity that
contains images the government entity captures of an individual while the individual interacts
with the government entity.
(b) "Image database" does not include publicly available information.
(7) "Law enforcement agency" means a public entity that exists primarily to prevent,
detect, or prosecute crime or enforce criminal statutes or ordinances.
(8) "Trained employee" means an individual who is trained to make a facial
recognition comparison and identification and who has completed implicit bias training.
Section 3. Section 77-23e-103 is enacted to read:
77-23e-103. Government use of facial recognition system with image database --
Restrictions -- Process -- Disclosure.
(1) Except as provided in this section, in Section 77-23e-104, and in Section
77-23e-105, a government entity may not use a facial recognition system on an image database.
(2) (a) (i) Only a law enforcement agency may make a request for a government entity
to conduct a facial recognition comparison using a facial recognition system.
(ii) Except as provided in Subsection (2)(a)(iii), a law enforcement agency shall submit
a request for a facial recognition comparison on an image database in writing to the
government entity that manages the image database.
(iii) A law enforcement agency shall submit a request for a facial recognition
comparison on an image database shared with or maintained by the department in accordance
with Section 77-23e-104.
(b) A trained employee who is employed by the government entity that maintains or
has access to the image database shall complete the request if the request:
(i) is for a purpose described in Subsection (2)(c);
(ii) includes a case identification number; and
(iii) is, if it is a request made for the purpose of investigating a crime, supported by a
statement of the specific crime and factual narrative to support that there is a fair probability
that the individual who is the subject of the request is connected to the crime.
(c) An individual described in Subsection (2)(b) shall only comply with requests made
for a purpose of:
(i) investigating a felony, a violent crime, or a threat to human life; or
(ii) identifying an individual who is:
(A) deceased;
(B) incapacitated; or
(C) at risk and otherwise unable to provide the law enforcement agency with his or her
identity.
(d) The law enforcement agency shall only use the facial recognition comparison:
(i) in accordance with the requirements of law; and
(ii) in relation to a purpose described in Subsection (2)(c).
(3) A government entity may not use a facial recognition system for a civil immigration
violation.
(4) To make a facial recognition comparison, a trained employee described in
Subsection (2)(b) shall:
(a) use a facial recognition system that, in accordance with industry standards:
(i) makes the comparison using an algorithm that compares only facial biometric data;
(ii) is secure; and
(iii) is produced by a company that is currently in business;
(b) if the facial recognition system indicates a possible match, make an independent
visual comparison to determine whether the facial recognition system's possible match is a
probable match;
(c) if the trained employee determines that there is a possible match that is a probable
match, seek a second opinion from another trained employee or the trained employee's
supervisor; and
(d) (i) if the other trained employee or the trained employee's supervisor agrees that the
match is a probable match:
(A) report the result to the requesting law enforcement agency through an encrypted
method; and
(B) return to the requesting law enforcement agency only a result that all trained
employees agree is a probable match; or
(ii) if the other trained employee or the trained employee's supervisor disagrees that
there is a probable match, report the fact that the search returned no results to the requesting
law enforcement agency.
(5) When submitting a case to a prosecutor, a law enforcement agency of the state or of
a political subdivision shall disclose to the prosecutor, in writing:
(a) whether a facial recognition system was used in investigating the case; and
(b) if a facial recognition system was used:
(i) the information the law enforcement agency received in accordance with Subsection
(4)(d)(ii); and
(ii) a description of how the facial recognition comparison was used in the
investigation.
Section 4. Section 77-23e-104 is enacted to read:
77-23e-104. Department use of facial recognition system with specific images --
Restrictions.
(1) The department is the only government entity in the state authorized to use a facial
recognition system to conduct a facial recognition comparison on an image database that is
maintained by or shared with the department.
(2) The department may only use a facial recognition system:
(a) for a purpose authorized in Subsection 77-23e-103(2)(c); or
(b) notwithstanding Subsection 77-23e-103(2)(b), to:
(i) compare an image taken of an applicant for a license certificate or an identification
card to determine whether the applicant has submitted a fraudulent or an inaccurate application;
or
(ii) provide images for a photo lineup for a purpose authorized in Subsection
77-23e-103(2)(c).
(3) Notwithstanding Subsection 77-23e-104(2)(a)(ii), a law enforcement agency shall
submit a request to the department to use a facial recognition system on an image database
maintained by the department through the Utah Criminal Justice Information System.
Section 5. Section 77-23e-105 is enacted to read:
77-23e-105. Notice requirement.
(1) When capturing an image of an individual when the individual interacts with the
government entity, the government entity shall notify the individual that the individual's image
may be used in conjunction with facial recognition technology.
(2) At least 30 days before the day on which a government entity other than the
department begins using a facial recognition system to conduct a facial recognition comparison
on the government entity's image database, the government entity shall:
(a) publish on the government entity's website:
(i) notice of the proposed use of facial recognition system;
(ii) a description of the image database on which the government entity plans to use the
facial recognition system; and
(iii) information about how to provide public comment;
(b) allow the public to submit written comments to the government entity within 15
days after date of publication;
(c) consider timely submitted public comments and the criteria established in this
chapter in determining whether to proceed with the intended use of the facial recognition
system; and
(d) post notice of the final decision on the government entity's website.
(3) The process described in Subsection (2) does not create a right of appeal.
Section 6. Section 77-23e-106 is enacted to read:
77-23e-106. Data protection and disclosure.
(1) Notwithstanding Title 63G, Chapter 2, Government Records Access and
Management Act, data relating to a facial recognition comparison may not be used or shared
for any purpose other than a purpose described in this chapter.
(2) (a) Upon request, a government entity shall release statistical information regarding
facial recognition comparisons, including:
(i) the different types of crime for which the government entity received a request;
(ii) how many requests the government entity received for each type of crime; and
(iii) the number of probable matches the government entity provided in response to
each request.
(b) In responding to a request for a release of statistical information under Subsection
(2)(a), a government entity may not disclose details regarding a pending investigation.
(3) (a) On or after August 1 but before October 15 of each year, a government entity
that uses a facial recognition system to conduct a facial recognition comparison shall provide to
the Government Operations Interim Committee a report that discloses:
(i) the different types of crime for which the department received a request;
(ii) how many requests the department received for each type of crime;
(iii) the number of probable matches the department provided in response to each
request; and
(iv) the image source from which the department made each match.
(b) In responding to a request for a release of statistical information under Subsection
(2)(a), a government entity may not disclose details regarding a pending investigation.