77-23e - Government Use of Facial Recognition Technology

Title 77 > 77-23e

Sections (6)

77-23e-101 - Title.

This chapter is known as “Government Use of Facial Recognition Technology.”

77-23e-102 - Definitions.

As used in this chapter: 77-23e-102(1) “Department” means the Department of Public Safety, created in Section 53-1-103. 77-23e-102(2) “Facial biometric data” means data derived from a measurement, pattern, contour, or other characteristic of an individual’s face, either directly or from an image. 77-23e-102(3) “Facial recognition comparison” means the process of comparing an image or facial biometric data to an image database.”Facial recognition comparison” does not include biometric surveillance information as that term is defined in Section 77-23d-102. 77-23e-102(4) “Facial recognition system” means a computer system that, for the purpose of attempting to determine the identity of an unknown individual, uses an algorithm to compare biometric data of the face of the unknown individual to facial biometric data of known individuals.”Facial recognition system” does not include:a system described in Subsection (4)(a) that is available for use, free of charge, by the general public; ora system a consumer uses for the consumer’s private purposes. 77-23e-102(5) “Government entity” means:an executive department agency of the state;the office of:the governor;the lieutenant governor;the state auditor;the attorney general; orthe state treasurer;the Board of Pardons and Parole;the Board of Examiners;the National Guard;the Career Service Review Office;the State Board of Education;the Utah Board of Higher Education;the State Archives;the Office of the Legislative Auditor General;the Office of Legislative Fiscal Analyst;the Office of Legislative Research and General Counsel;the Legislature;a legislative committee of the Legislature;a court, the Judicial Council, the Administrative Office of the Courts, and similar administrative units in the judicial branch;an institution of higher education as that term is defined in Section 53H-1-101;an entity within the system of public education that receives funding from the state; ora political subdivision of the state as that term is defined in Section 63G-7-102.”Government entity” includes:every office, agency, board, bureau, committee, department, advisory board, or commission of an entity described in Subsection (5)(a) that is funded or established by the government to carry out the public’s business; oran individual acting as an agent of a government entity or acting on behalf of an entity described in this Subsection (5). 77-23e-102(6) “Image database” means a database maintained by a government entity that contains images the government entity captures of an individual while the individual interacts with the government entity.”Image database” does not include publicly available information. 77-23e-102(7) “Law enforcement agency” means a public entity that exists primarily to prevent, detect, or prosecute crime or enforce criminal statutes or ordinances. 77-23e-102(8) “Trained employee” means an individual who is trained to make a facial recognition comparison and identification and who has completed implicit bias training.

77-23e-103 - Government use of facial recognition system with image database — Restrictions — Process — Disclosure.

77-23e-103(1) Except as provided in this section, in Section 77-23e-104, and in Section 77-23e-105, a government entity may not use a facial recognition system on an image database. 77-23e-103(2) Only a law enforcement agency may make a request for a government entity to conduct a facial recognition comparison using a facial recognition system. Except as provided in Subsection (2)(a)(iii), a law enforcement agency shall submit a request for a facial recognition comparison on an image database in writing to the government entity that manages the image database. A law enforcement agency shall submit a request for a facial recognition comparison on an image database shared with or maintained by the department in accordance with Section 77-23e-104. A trained employee who is employed by the government entity that maintains or has access to the image database shall complete the request if the request: is for a purpose described in Subsection (2)(c); includes a case identification number; and is, if it is a request made for the purpose of investigating a crime, supported by a statement of the specific crime and factual narrative to support that there is a fair probability that the individual who is the subject of the request is connected to the crime. An individual described in Subsection (2)(b) shall only comply with requests made for a purpose of: investigating a felony, a violent crime, or a threat to human life; or identifying an individual who is:

deceased; incapacitated; or at risk and otherwise unable to provide the law enforcement agency with his or her identity. The law enforcement agency shall only use the facial recognition comparison: in accordance with the requirements of law; and in relation to a purpose described in Subsection (2)(c). 77-23e-103(3) A government entity may not use a facial recognition system for a civil immigration violation. 77-23e-103(4) To make a facial recognition comparison, a trained employee described in Subsection (2)(b) shall:

use a facial recognition system that, in accordance with industry standards: makes the comparison using an algorithm that compares only facial biometric data; is secure; and is produced by a company that is currently in business; if the facial recognition system indicates a possible match, make an independent visual comparison to determine whether the facial recognition system’s possible match is a probable match; if the trained employee determines that there is a possible match that is a probable match, seek a second opinion from another trained employee or the trained employee’s supervisor; and if the other trained employee or the trained employee’s supervisor agrees that the match is a probable match:

report the result to the requesting law enforcement agency through an encrypted method; and return to the requesting law enforcement agency only a result that all trained employees agree is a probable match; or if the other trained employee or the trained employee’s supervisor disagrees that there is a probable match, report the fact that the search returned no results to the requesting law enforcement agency. 77-23e-103(5) When submitting a case to a prosecutor, a law enforcement agency of the state or of a political subdivision shall disclose to the prosecutor, in writing:

whether a facial recognition system was used in investigating the case; and if a facial recognition system was used: the information the law enforcement agency received in accordance with Subsection (4)(d)(ii); and a description of how the facial recognition comparison was used in the investigation.

77-23e-104 - Department use of facial recognition system with specific images — Restrictions.

77-23e-104(1) The department is the only government entity in the state authorized to use a facial recognition system to conduct a facial recognition comparison on an image database that is maintained by or shared with the department. 77-23e-104(2) The department may only use a facial recognition system:

for a purpose authorized in Subsection 77-23e-103(2)(c); or notwithstanding Subsection 77-23e-103(2)(b), to: compare an image taken of an applicant for a license certificate or an identification card to determine whether the applicant has submitted a fraudulent or an inaccurate application; or provide images for a photo lineup for a purpose authorized in Subsection 77-23e-103(2)(c). 77-23e-104(3) Notwithstanding Subsection 77-23e-103(2)(a)(ii), a law enforcement agency shall submit a request to the department to use a facial recognition system on an image database maintained by the department through the Utah Criminal Justice Information System.

77-23e-105 - Notice requirement.

77-23e-105(1) When capturing an image of an individual when the individual interacts with the government entity, the government entity shall notify the individual that the individual’s image may be used in conjunction with facial recognition technology. 77-23e-105(2) At least 30 days before the day on which a government entity other than the department begins using a facial recognition system to conduct a facial recognition comparison on the government entity’s image database, the government entity shall:

publish on the government entity’s website: notice of the proposed use of facial recognition system; a description of the image database on which the government entity plans to use the facial recognition system; and information about how to provide public comment; allow the public to submit written comments to the government entity within 15 days after the date of publication; consider timely submitted public comments and the criteria established in this chapter in determining whether to proceed with the intended use of the facial recognition system; and post notice of the final decision on the government entity’s website. 77-23e-105(3) The process described in Subsection (2) does not create a right of appeal.

77-23e-106 - Data protection and disclosure.

77-23e-106(1) Notwithstanding Title 63G, Chapter 2, Government Records Access and Management Act, data relating to a facial recognition comparison may not be used or shared for any purpose other than a purpose described in this chapter. 77-23e-106(2) Upon request, a government entity shall release statistical information regarding facial recognition comparisons, including: the different types of crime for which the government entity received a request; how many requests the government entity received for each type of crime; and the number of probable matches the government entity provided in response to each request. In responding to a request for a release of statistical information under Subsection (2)(a), a government entity may not disclose details regarding a pending investigation. 77-23e-106(3) On or after August 1 but before October 15 of each year, a government entity that uses a facial recognition system to conduct a facial recognition comparison shall provide to the Government Operations Interim Committee a report that discloses: the different types of crime for which the department received a request; how many requests the department received for each type of crime; the number of probable matches the department provided in response to each request; and the image source from which the department made each match. In responding to a request for a release of statistical information under Subsection (2)(a), a government entity may not disclose details regarding a pending investigation.