Rachel Kemel
Senior Editor
Loyola University Chicago School of Law, JD 2020

In March 2019, Senator Brian Schatz and Senator Roy Blunt introduced a bill to Congress designed to provide oversight for facial recognition technology, known as the Commercial Facial Recognition Privacy Act. If passed, this law could change the way Americans deal with privacy.

What is the big deal about facial recognition technology?

Facial recognition technology is technology that has the ability to analyze the human face for the purpose of identifying them. A big issue surrounding such technology is the potential for discrimination. Amazon’s technology, Rekognition, in particular faced backlash when it misidentified people of color, and even in one test identified lawmakers as criminals.

And recently, the American Civil Liberties Union sued the FBI, the Department of Justice, and the Drug Enforcement Agency to get access to their records to determining if there is any secrete surveillance in use across the country. The American Civil Liberties Union argues that the only way there can be accountability is if there is transparency, and it has caused a debate as to what is private nowadays and what is not.

What is the Commercial Facial Recognition Privacy Act?

The Commercial Facial Recognition Privacy Act would require companies to receive explicit consent from customers before they are able to collect any such data, and it would limit companies from how they are able to share this data with third parties. Also, it would require there to be testing with human subjects before implementation as a way to eliminate any bias before release. The Act would also require companies to meet standards on data security, minimization, and retention as established by the Federal Trade Commission and the National Institute of Standards and Technology.

Senator Schatz and Blunt argue that their bill is necessary to protect the American people, because “[o]ur faces are our identities. They’re personal.” However, the senators are not arguing against the use of such technology, in fact they even stated that it should continue to be developed as it will provide many benefits to society. But its use must be regulated “to protect against acts of bias and discrimination, preserve consumer privacy, and uphold our basic democratic freedoms.”

Why pass such a bill?

A benefit of this bill is that it will help consolidate facial recognition rules across states. Currently, the landscape for these types of laws is all over the place. Portland, Oregon will soon be holding a public meeting to decide whether it wishes to block use of such technology by not only private companies, but also the government. Cities in California have already instituted a ban on the use of facial recognition technology by their city agencies, while Detroit only allows the use when it is in connection with investigation of violent crimes and home invasions, but they are not allowed to use live or recorded video, nor use it to assess a person’s immigration status

Would any companies be happy with this?

In December, Microsoft president Brad Smith released a statement saying that Microsoft was in favor of such a bill, that it is “important for governments in 2019 to start adopting laws to regulate this technology”. Facial recognition is such new technology, that no one really knows where it is going, and Microsoft argues that it is best to act now unless we wish to “risk waking up five years from now to find that facial recognition services have spread in ways that exacerbate societal issues.” And by that point in time, the issues will be “more difficult” to battle than if they are tried to combat early on. Microsoft even went on to say that technology companies should not wait for this bill to pass, that it is their responsibility to start creating safeguards for the people. To do so, Microsoft promised to release new materials and training resources to their customers.

Microsoft even lobbied for a bill in Washington, its home state, that would bring “European-style privacy and transparency regulations.” Currently, the European Union has the General Data Protection Regulation which details citizens’ individual rights and requires companies to ask permission before gathering such data.

The future of the Bill

The bill has been referred to the Committee on Commerce, Science, and Transportation. Whether it will go forward and require companies to limit their actions is still in the air but having a foundation for future legislation would likely be beneficial as facial recognition technology continues to become prevalent in society.