We need sensible facial recognition regulations at state, federal level

You know a new technology is pervasive when it starts to make its way into crime shows and soap operas. Recently, criminals on at least three shows I've seen used facial recognition to unlock a victim's cellphone to send a text or email designed to throw off friends and family who otherwise would have become suspicious and started searching for the person or gone to the police.

Misuse of facial recognition technology isn't always fictional, however. At the 2001 Super Bowl, Tampa police secretly employed facial recognition technology to digitally scan football fans' faces and cross reference them with a database of wanted and suspected criminals. This digital cattle round up was widely criticized but other seemingly innocuous uses of facial recognition technology are also troubling.

Uber uses a facial recognition system it calls Real Time ID Check to verify the identity of its drivers. The system requires drivers to take a selfie to unlock their ride-sharing app. The selfie photo is compared to the driver's photo on file with Uber and if the two photos don't match, the driver's account is deactivated. Amazon has a facial recognition technology called Rekognition that has been used by police departments and ICE to hunt for criminals and immigrants.

The problem is that Microsoft's technology, and facial recognition technology generally, are disproportionately inaccurate for certain groups of people. An MIT study found that Microsoft's technology has an error rate as high as 20% for people with dark skin. A study from the National Institute of Standards and Technology found similar deficiencies. A 2016 study published by IEEE found that facial recognition systems are not accurate for transgender people.

The ACLU did a test of Amazon's Rekognition in 2018 that compared photographs of the U.S. Congress against a database of mugshots and the system falsely identified 28 members as people who have been arrested for a crime. The mismatches were disproportionately people of color, including six members of the Congressional Black Caucus, among them the late civil rights icon Rep. John Lewis (D-Ga.).

While some might chuckle about the erroneous identification of politicians as criminals, real world consequences are not funny. Uber's ID Check has mistakenly locked out Black and transgender drivers because the facial recognition software gave false positives and those people were unable to earn income while the matter was investigated.

The data gathered by biometric surveillance systems is protected under some state privacy statues such as the Illinois Biometric Information Privacy Act and the California Consumer Privacy Act. 740 ILCS 14; Cal Civ Code Section 1798.140(b). California defines biometric data to include "imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information."

But these data privacy protections only address use of biometric data after the surveillance has occurred and these rights have to be enforced through litigation, which is not only expensive but guaranteed not to result in quick resolution, particularly due to court backlogs during COVID-19. The Illinois law has reportedly spawned more than more than 200 consumer lawsuits.

Given the foibles of facial recognition technology, why not just ban it altogether? There is a growing trend calling for just that. A group of human rights organizations, including Fight for the Future, the Electronic Privacy Information Center, the Muslim Justice League and Secure Justice, signed an open letter last week asking that private and corporate entities commit to ending their use of facial recognition. The letter opposes the technology not just because of privacy intrusion, but also that misidentifications disproportionately affect certain groups of people.

In 2019, the San Francisco board of supervisors voted 8-1 to ban the use of facial recognition software by the police and other agencies. Last year Portland, Oregon approved two ordinances that ban the use of facial recognition technology. The first ban, which took effect last year, banned government offices and bureaus from acquiring or using the technology and the second, which took effect Jan. 1, 2021, banned all private entities from using facial recognition technology in places of public accommodation as defined in the as defined by the Americans with Disabilities Act.

A Washington state law that restricts use of facial recognition technology by all public agencies in the state takes effect on July 1 of this year. Chapter 43.386b RCW. The law requires agencies to obtain a warrant to run facial recognition scans, except in case of emergency. Also, the technology must be independently tested for "accuracy and unfair performance differences" across skin tone, gender, age and other characteristics, according to the legislation, which applies to all public agencies in the state.

Last year, the Sens. Cory Booker (D-N.J.) and Jeff Merkley (D-Ore.) introduced the Ethical Use of Facial Recognition Act which would have stopped the federal government from using facial recognition until Congress could decide whether and how to regulate it. The legislation was not approved, but similar legislation is likely to be reintroduced.

Facial recognition cattle round ups like the Super Bowl debacle are unreasonable, particularly given the consistent data showing errors that disproportionately affect minority groups. Sensible regulations should be passed at the federal and state level that preclude use of facial recognition technology to do blanket police or government surveillance of people in public places and use of such technology by corporate or individuals to make employment, housing or health care decisions. Reasonable exceptions could be allowed for police or border security if they have a warrant or similar due process, as the Washington statute includes. 