Members of the state Assembly’s Committee on Privacy and Consumer Protection voted 8-3 to send a bill on facial recognition by its Chairman Ed Chau, D-Monterey Park, to the Assembly Committee on Appropriations. Assembly Bill 2261 would give residents some control over this area of their personal information, but critics say the technology is biased and the bill doesn’t go far enough. Among the takeaways:
• Chau’s bill, which was voted on May 5, builds on the California Consumer Privacy Act to require a so-called “processor” providing facial recognition services to also make available an app or other tool to let “controllers or third parties” test those services for accuracy. Among its other requirements, it would require a “controller” to post notice whenever facial recognition is deployed in a “physical presence open to the public” and would mandate that the controller secure residents’ consent before acquiring their image, unless it’s for “a security or safety purpose as specified.” The bill would let residents discover whether a controller has acquired their image or “facial template” via facial recognition at a public place, and would give them the right to challenge that and have that image deleted.
The bill would require a state or local agency intending to “develop, procure or use” a facial recognition service to let the public know at least 90 days beforehand. It would also require that agencies using facial recognition with “legal” or “significant” effects train the people conducting the facial recognition.
The legislation "would prohibit an agency from using a facial recognition service to engage in ongoing surveillance, unless specified conditions are met relating to a law enforcement investigation of a serious criminal offense,” and violations could result in injunctions and penalties ranging from $2,500 to $7,500. In an email to Techwire, Chau said facial recognition technology is unregulated in the state and its negative impacts will continue if nothing is done.
“I am working on this bill, because if we do nothing to regulate facial recognition technology in a comprehensive way, it will become increasingly costly and difficult to implement regulations since more entities will have developed infrastructures without consideration for these limits,” Chau said. He indicated that the new bill builds in part on his AB 1281 last session, which he noted only requires businesses to disclose when they’re using facial recognition tech; and said it's likely to be heard in Appropriations in early June.
• The bill has garnered support from Microsoft, which in commentary praised it for “a thoughtful approach which recognizes the need for safeguards to balance the opportunities and the risks associated with facial recognition technology." The company said it firmly believes that government must determine “what regulations will permit the use of facial recognition technology to provide society with a whole host of benefits, while also addressing the challenges that facial recognition technology poses. …”
• However, it has drawn opposition from the California State Sheriffs’ Association and a coalition of more than 40 civil rights organizations, including the American Civil Liberties Union (ACLU) California, the Electronic Frontier Foundation, and the California Immigrant Policy Center. In a statement provided to Techwire, the ACLU said the privacy committee “rightfully acknowledged concerns with the serious shortcomings of this bill that would not protect Californians from invasive facial recognition.”
“This bill seeks to create an illusion of privacy without real privacy protections,” said Matt Cagle, technology and civil liberties attorney with the ACLU of Northern California. In an interview, he said it would “legitimize police and corporate-faced surveillance that will outlast this crisis” and unduly empower law enforcement and companies in its use. “There’s a lot of words on the page, but the actual provisions do little to nothing to protect actual privacy,” he added.
Assemblymember Buffy Wicks, D-Oakland, cast one of the committee’s three “no” votes and aired her “deep concerns" about consumer protections, racial bias and "the latitude afforded to companies in the bill.”
“Facial recognition is demonstrably less accurate when used against women and people of color, and I don’t believe the state should sanction technology that has built-in biases on these grounds,” Wicks told Techwire via email. She said she “would prefer a ban on the commercial use of facial recognition technology, unless someone explicitly opts in.”
• Chau pointed out that “a majority of the opposition admits” state and private facial recognition is currently in use “to target immigrants, people of color, and to oppress religious minorities and discourage free expression.”
“This means,” he said, “the integration of facial recognition technology into our everyday lives is occurring now, but, under the current system, we have no way of knowing it, controlling its use, and there are no regulations or transparency requirements, for both public and private entities, to account for biases and inaccuracies.” But banning facial recognition, he said, is not the answer, given its potential to locate missing children and human trafficking victims, and officials should collaborate on a solution.
“This bill provides individuals with controls over their facial image that do not exist now and regulates the technology in a comprehensive way, before it completely becomes increasingly costly and difficult to implement regulations,” once additional entities stand up infrastructure without considering such limitations.
