In an unprecedented move, the Portland City Council (“City Council”) on September 9, 2020, passed 2 (two) unanimous ordinances(“City Ordinance(s)”) on what is hailed as the nation’s strictest ban on (1) commercial use of facial recognition technology in places of public accommodation in the city by private entities and (2) prohibition on the use of facial recognition technology by the city government. The City Ordinance stated its rationale as face recognition technology falsely identifying women and people of colour on a routine basis. The City Council also found instances of racial and gender bias along with marginalised communities being subjected to over surveillance and disparate and detrimental impact of the use of surveillance.
In a study published in December 2019 by the National Institute of Standard and Technology (NIST) titled as Face Recognition Vendor Test (FRVT), the U.S Department of Commerce stated evidences of biases against coloured people, women, and older people through facial recognition systems. The federal study stated that algorithms currently sold in the market could misidentify members of some groups or ethnicities up to 100 (hundred) times more frequently than others. The empirical evidence provided that many of the world’s most advanced facial recognition algorithms are not ready for use in critical areas such as law enforcement and national security.
The City Ordinance for private entities(“City Ordinance 1”) which will be in effect from January 1, 2021, would prohibit private entities from using face recognition technologies of public accommodation within the borders of Portland. However, in order to understand the ambit of such a restriction it is quintessential to know the definition of these terms:
1. Face Recognition- “the automated searching for a reference image in an image repository by comparing the facial features of a probe image with the features of images contained in an image repository (one-to-many search). A face recognition search will typically result in one or more most likely candidates—or candidate images—ranked by computer-evaluated similarity or will return a negative result.”
2. Face Recognition Technologies- “automated or semi-automated processes using Face Recognition that assist in identifying, verifying, detecting, or characterising facial features of an individual or capturing information about an individual based on an individual’s face.”
3. Places of Public Accommodation- “any place or service offering to the public accommodations, advantages, facilities, or privileges whether in the nature of goods, services, lodgings, amusements, transportation or otherwise”
But does not include “an institution, bona fide club, private residence, or place of accommodation that is in its nature distinctly private”.
4. Private Entity- “any individual, sole proprietorship, partnership, corporation, limited liability company, association, or any other legal entity, however, organised.”
But does not include any government agency.
Enforcement and Remedies under City Ordinance 1
The City Ordinance 1 provides the injured for a right to proceed to the court for any violation by a private entity causing damage as a result of those violations or a USD1000 per day for each day of violation whichever is greater and also entitled any other appropriate remedy.
Exceptions to the Prohibition under City Ordinance 1
The prohibition to the use of face recognition also came with certain exceptions like:
1. The prohibition does not apply to private entities that are required to comply with federal, state, or local laws;
2. Verification purposes of an individual’s own personal or employer-issued communication and electronic devices; and
3. Face recognition services in social media applications.
Therefore the City Ordinance 1 does not prevent individuals from setting up facial recognition technology at homes or gadgets that use facial recognition software for authenticating users, like a face ID feature for unlocking a phone. However, the ban extends to facial recognition at airports, banks, restaurants, public transit stations, stores, and other businesses that identify potential suspects using the technology.
The City Ordinance prohibiting the use of face recognition by city bureaus (“City Ordinance 2”) goes into effect immediately and provides a 90 (ninety) day period from the effective date to ensure non-usage of face recognition technology for any purpose. The City Ordinance 2 required each bureau staff to assess and review if the face recognition technologies were used and provide the report of the assessment to the Bureau of Planning and Sustainability’s open data coordinator.
The City Ordinance 2 only allowed the city bureau including the police officials to use the face recognition technologies for the following purposes:
1. for verification of the bureau staff to access their own personal or city issued electronic devices;
2. automatic face detection services in social media applications; and
3. only in cases where recording needs to be redacted for release or disclosure outside Portland to protect the privacy of a subject depicted in the recording.
The City Ordinance 2 also provides a standard operating procedure in cases the city of Portland bureau mistakenly receives, uses, or accesses data from face recognition technologies which then would not deem, the unintentional receipt of data, illegal. The bureau, on the knowledge of data being obtained from face recognition technology, should cease to use it. It is required to document its receipt, access, or use in an impact report which would contain (i) the date the information was received (ii) source of the information (iii) summary of the incident (iv)whether the bureau accessed or used any information and (v) corrective measure by the bureau to prevent further transmission of data. The report is then required to be submitted to the city council within 60 (sixty) days of the discovery and finally, the bureau is required to dispose of the information within the time it is allowed to retain it.
The City Ordinance 2 also highlighted that the essence of this prohibition was to ensure that Portland city adopted or revised its comprehensive data governance and privacy and information protection framework that could address the appropriate use of face recognition technologies and the information derived. The lack of such a framework had put the vulnerable and marginalised sections of the city people to the risk of over-surveillance and misidentification by the system to put criminal sanctions on them.
Enforcement and Remedies under City Ordinance 2
In case of a material violation committed by the bureau, the injured person reserved all the right to institute proceedings against the city before the court for seeking injunctive relief, etc. However, before moving the court, it is important to intimate the city by giving written notice via the City Attorney’s office of the violation and such bureau committing the offence must be provided a 30 (thirty) day time to correct such a violation.
In case such an alleged violation is subsequently made good, the bureau would post a notice on its website addressing the corrective measures taken and each bureau director shall be liable to enforce this policy.
Status of facial recognition in the US
Ever since the protests for the murder of George Floyd and the black lives matter movement has gained pace, the discriminatory nature of facial recognition saw legislation enacted against the use of the technology.
A bill titled S 4400- National Biometric Information Privacy Act of 2020 was introduced in the 116th session of United States (“US”) Congress backed by senators Bernie Sanders and Jeff Merkley that proposed to ban private entities from collecting people's biometrics, including facial data, eye scans, speech, and fingerprints, without their permission. It also prohibited private companies from selling and leasing people's biometric data. However, the bill is still pending enactment and yet to see the daylight. Interestingly, just a week before the introduction of this bill before the US Senate, the New York state legislature passed bill no. 5140—B as an act to amend the education law, in relation to the use of biometric identifying technology that puts a ban on the use of biometric identification technologies, including facial recognition, in schools until July 2022, becoming the first state in the US to prohibit the use of facial recognition technology in schools.
Moreover, the member of the US Congress had also introduced a bill titled Facial Recognition and Biometric Technology Moratorium Act of 2020 that sought to restrict federal agencies and officials from obtaining, possessing, accessing, and even using "any biometric surveillance system" such as facial recognition technology. The bill also prohibited government agencies from utilising information obtained from systems run by other organisations.
While Portland’s City Council seems to have imposed strict restrictions on the use of facial recognition technology, it is not the only city in the US to have done so, Boston, San Francisco, Oakland, Cambridge, Berkley, and Somerville too have banned the use of technology. The stark difference could be noticed in the magnitude of the ban when Portland bans use by both public and private entities making it presumably the harshest ban on the use of technology, other cities’ ban are only limited to public authorities.
While the US seems to have realised the perils of too much dependence on technology and taken quick measures, although city wise to protect the integrity of its freedoms and privacy granted to each citizen, India even after declaring the right to privacy as a fundamental right continues to use facial recognition indiscriminately at rallies, polling booths and protests without any law or policy governing its use. For instance- The National Crime Records Bureau (NCRB) is looking to implement a centralised Automated Facial Recognition System (AFRS) which would be a platform of facial data accessible to all police stations of the country.
The article is authored by Ayush Chowdhury, Co-Head, BlockSuits.
Comments