Washington Governor Signs Facial Recognition LawPrivacy Advocates Criticize Measure That Microsoft Supported
Washington Gov. Jay Inslee has signed a new law that regulates the use of facial recognition technology. But some privacy and civil rights advocates argue the measure, which was backed by Microsoft, doesn’t do enough to protect individuals’ rights.
The new law establishes some restrictions on how state agencies can use the technology and requires law enforcement agencies to obtain a warrant before they can use the technology as part of a criminal investigation.
The Washington Senate approved the law, SB6280, by a vote of 53 to 43 on March 12; the House of Representatives earlier approved the measure by a vote of 63 to 33. It will go into effect on Jan. 1, 2021.
Action in Other States
Some other states have laws governing the collection of biometric data.
In Illinois, the Biometric Information Privacy Act, which has been in effect since 2008, requires companies to inform individuals if their biometric data is going to be collected. In January, Facebook paid a fine of $550 million to settle a class action lawsuit brought under this state law (see: Facebook Settles Facial Recognition Lawsuit for $550 Million).
In New Hampshire, lawmakers introduced a bill in February to prohibit state agencies from using facial recognition technology.
And California has banned the use of facial recognition in body cameras that police wear.
Washington Law's Provisions
The Washington law allows state government agencies to use facial recognition technology, but creates some restrictions on deployment to help protect citizens' privacy rights. It also includes legal safeguards to ensure that the technology is not used to track individuals who are not accused of a crime or wrongdoing.
If a state agency wants to use facial recognition software, the department must publish a public notice of its use, hold meetings about the initiative and file a detailed report about how the technology is being used, including what companies are involved in providing the software and hardware and what its capabilities are, according to the law.
Under the new law, state police and other law enforcement agencies must obtain a warrant or permission from a judge before they can use facial recognition technology as part of a criminal investigation.
"Right now, we have seen this technology already being used without much concern for the moral implications that are associated with it," says Sen. Joe Nguyen, who sponsored the original bill and is a Microsoft employee. "This bill will change that, and ensure that facial recognition isn’t being used unless there are regulatory checks and balances."
In an article about the law, Aravind Swaminathan, Nicholas Farnsworth and Michelle Nance, attorneys with the practice of Orrick Herrington & Sutcliffe LLP, note that with limited resources available to them, many state and local agencies will likely push some of the requirements of the law down to the vendors that are supplying the facial recognition technology. This will create more responsibility for companies wanting to do business with Washington.
"Vendors and suppliers to Washington state and local agencies need to carefully consider how this new law will impact their business and begin to predict what demands their government customers will place on them," according to the article. "And, to restate the obvious, facial recognition-related technology vendors will need to develop additional technical measures to continue to be able to supply these government customers."
Microsoft Lobbied for the Law
The legislation was back by one of Washington's biggest employers - Microsoft - which lobbied for the version of the law signed by Inslee this week. The software giant has poured millions into developing its own facial recognition technology and software over the last several years, making these applications available through its Azure cloud platform.
"Until today, no government has enacted specific legal controls that permit facial recognition to be used while regulating the risks inherent in the technology," Microsoft President Brad Smith noted in blog post.
Privacy advocates, who claim the new law doesn’t go far enough, claimed Microsoft backed the legislation to protect its own interests and investments.
Marietje Schaake, the international director of policy at Stanford University's Cyber Policy Center, wrote on Twitter that Microsoft's power to influence such a bill was "unprecedented."
Washington state adopted a Microsoft-backed law on facial recognition technology potentially serving as a model for other states. Microsoft’s power is unprecedented in setting standards & governance models.— Marietje Schaake (@MarietjeSchaake) March 31, 2020
Not nearly as scrutinized as other tech giants https://t.co/KBS80KPXNY
Jennifer Lee, an attorney with the Washington chapter of the American Civil Liberties Union, contends the new law offers weak privacy protections for citizens and calls for a temporary ban on the technology.
"This is why we strongly opposed SB 6280, which purports to put safeguards around the use of facial recognition technology but does just the opposite. The first iteration of this bill, strongly supported by Microsoft, wasn’t just weak - it actually undermined existing state constitutional privacy protections," Lee says.
The Washington Association of Sheriffs and Police Chiefs, however, claims the new law will impede the ability to enforce laws and conduct investigations. James McMahan, the group’s policy director, told the Wall Street Journal that police now need to obtain a warrant to use facial recognition software in cases of a missing or deceased person.
"It hinders our ability to keep people safe," McMahan told the Journal.
Managing Editor Scott Ferguson contributed to this report.