By Jennifer K. Wagner, J.D., Ph.D.<\/p>\n
<\/p>\n
Background<\/em><\/strong><\/p>\n Previously on this blog, Patrick McKnight wrote<\/a> about facial recognition technologies coming under increased congressional scrutiny, noting companion bills introduced on June 25, 2020 by Senators Markey and Merkley (S. 4084<\/a>) and Representatives Jayapal and Pressley (H.R.7356<\/a>) known as the \u201cFacial Recognition and Biometric Technology Moratorium Act of 2020.\u201d Mr. McKnight described facial recognition as \u201cthe next frontier of privacy legislation.\u201d In addition to increased scrutiny from those on Capitol Hill, facial recognition technologies are facing increased scrutiny and criticism<\/a> from state<\/a> and local policymakers as well as scholars across the nation.<\/p>\n <\/p>\n As highlighted in a recent report issued by the Government Accountability Office (GAO-20-522<\/a>), there are only a few state laws protecting biometric information privacy specifically (i.e., those in Illinois, Washington, and Texas), but general data breach notification laws in several states encompass facial imaging data. Additionally, recent general data protection laws, such as the California Consumer Privacy Act (CCPA), contain carefully drafted definitions of \u201cbiometric information\u201d to ensure the protection of \u201cimagery of the face\u201d and \u201cfaceprints.\u201d There seems to be a growing movement to consider more specific legislation to address facial recognition technologies, as bills have been introduced in several states<\/a>. Additionally, within the past 18 months, more than a dozen cities have passed some sort of ordinance banning, imposing a moratorium, or otherwise limiting facial recognition technologies, including San Francisco, CA; Somerville, MA; Oakland, CA; Berkeley, CA; Brookline, MA; Alameda, CA; Northampton, MA; Cambridge, MA; Springfield, MA; Boston, MA; Easthampton, MA; Portland, OR; Jackson, MS; and Portland, ME. The most recent locale to join this group is Pittsburgh, PA.<\/p>\n <\/p>\n Pittsburgh Passes Ordinance on Facial Recognition Technology<\/em><\/strong><\/p>\n A proposed ordinance introduced<\/a> in August by Pittsburgh City Council<\/a> member Corey O\u2019Connor gained preliminary approval<\/a> on September 16, 2020. A week later (on September 22), the Pittsburgh City Council voted (8-0 with one abstention<\/a>) to pass<\/a> the ordinance, and Pittsburgh Mayor Bill Peduto signed the bill on Sept. 24, 2020.<\/p>\n <\/p>\n The ordinance requires law enforcement to seek approval from City Council before obtaining, accessing, or using \u201cFacial Recognition Technology\u201d or \u201cPredictive Policing Technology\u201d but allows law enforcement to make limited, temporary uses of \u201cSelect Surveillance Technology\u201d if in response to \u201cExigent Circumstances\u201d and limited to a period no longer than 90 days. The text of the ordinance suggests that approval is required for each technology rather than for each individual use case for a particular technology or information derived therefrom. The ordinance establishes four key definitions: Exigent Circumstances, Facial Recognition Technology, Predictive Policy Technology, and Select Surveillance Technology.<\/p>\n <\/p>\n Privacy Law Advocates Should Hold Off on Celebrations<\/em><\/strong><\/p>\n The ordinance has already been criticized<\/a> as merely symbolic and lacking any meaningful substance. Notably, this ordinance leaves intact all existing access to facial recognition technologies that Pittsburgh law enforcement has at this time and does so in a sweeping manner, effectively enabling those services to be enhanced and expanded without any consultation with City Council pursuant to this ordinance so long as those changes are made not directly by Pittsburgh police but by whatever entity provides those services to the City of Pittsburgh (whether it be an operator, manager, or publisher of databases, programs, and technologies). This means, for example, that Pittsburgh police may continue to access and use the Pennsylvania Justice Network (JNET<\/a>)\u2014which enables statewide photo searches of PennDOT (driver\u2019s licenses) and WebCPIN (mugshot photos and images from the Department of Corrections, Pennsylvania Board of Probation and Parole, and county prisons). When new facial recognition or predictive policing technology is desired, this ordinance simply mandates that City Council be part of the process prior to the technology\u2019s acquisition or use.<\/p>\n <\/p>\n Broader Significance<\/em><\/strong><\/p>\n The Pittsburgh ordinance might not offer more than illusory constraints on law enforcement\u2019s use of facial recognition technologies; nevertheless, it marks the beginning of broader policy conversations across the commonwealth regarding how Pennsylvania residents should be protected from unreasonable \u201cdataveillance\u201d and how to promote, at a minimum, transparency in how facial recognition technologies are used in Pennsylvania. For example, following news reports earlier this year that the Philadelphia police had tested out Clearview AI<\/a> and that facial recognition was being deployed at PHL airport<\/a> by Customs and Border Protection at some international gates, the Philadelphia City Council considered a resolution (Resolution No. 20026700<\/a>) calling upon the Philadelphia Police Department and other law enforcement agencies \u201cto establish clear boundaries and issue transparent policies\u201d about how facial recognition technology is being used and \u201cto ensure that this technology does not lead to racial biases in policing practices and outcomes or infringe on individuals\u2019 civil liberties.\u201d While the resolution was apparently withdrawn from the calendar in June, the topic is likely to arise again in some form there and elsewhere.<\/p>\n <\/p>\n Already Allegheny County Council reportedly introduced<\/a> an identical bill to the Pittsburgh ordinance, and attorneys should assume that other locations will follow suit. While facial recognition technologies are deployed in diverse contexts and by diverse actors, it is in the context of police body camera recordings that political pressure might lead to meaningful legislative reforms to strengthen oversight<\/a> of and improve transparency for facial recognition technology practices. Act 22 of 2017<\/a> (S.B. 560<\/a>), which ushered in an expansion of police body cameras<\/a>, mandated law enforcement agencies to issue written policies specifically on any \u201cuse of facial recognition software or programs\u201d [\u00a767A07(a)(6)]. One might expect York, Scranton, Erie, Harrisburg, State College<\/a>, and other areas in Pennsylvania in which body camera programs have been moving forward<\/a> to be ripe for discussions about facial recognition technologies specifically and data justice issues more broadly.<\/p>\n <\/p>\n At the state level, there do not appear to be any laws or bills under current consideration regarding facial recognition technologies specifically. Pennsylvania\u2019s data breach notification law (73 Pa. Stat. \u00a72301 et seq.<\/em>, Breach of Personal Information Notification Act) does not explicitly cover facial imaging or other biometrics data. During the 2019-2020 regular session, the Pennsylvania General Assembly has been considering several bills related to biometrics generally (including, among others, H.B. 1010<\/a> and S.B.955<\/a> on data breach notifications and H.B. 1049<\/a> on consumer data privacy) the text of which could be broad enough to apply to faceprints and facial imaging data. Careful reading of how terms of art are defined will be critical when evaluating the strengths, weaknesses, and potential impacts of any legislation that might be on the horizon regarding data protections broadly or facial recognition technologies narrowly.<\/p>\n <\/p>\n Jennifer K. Wagner, J.D., Ph.D., is a solo practicing attorney and also conducts research as an Assistant Professor in the Center for Translational Bioethics & Health Care Policy at Geisinger. She is a former contributing editor of the Genomics Law Report and has published scholarly articles in prominent legal and scientific journals, including the Journal of Law & Biosciences; Journal of Law, Medicine, & Ethics; Albany Law Journal of Science & Technology; Virginia Sports and Entertainment Law Journal; North Carolina Journal of Law and Technology; Nature Communications; Nature Medicine; American Journal of Human Genetics; Genetics in Medicine; and PLOS Genetics. She served as a AAAS Congressional Fellow in a U.S. Senator\u2019s office in 2014-2015, and her work has been cited by the Supreme Court of the United States. You may follow her on Twitter as @DNAlawyer<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" By Jennifer K. Wagner, J.D., Ph.D. Background Previously on this blog, Patrick McKnight wrote about facial recognition technologies coming under increased congressional scrutiny, noting companion bills introduced on June 25, 2020 by Senators Markey and Merkley (S. 4084) and Representatives Jayapal and Pressley (H.R.7356) known as the \u201cFacial Recognition and Biometric Technology Moratorium Act
\n
Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,35,23],"tags":[],"_links":{"self":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/384"}],"collection":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/comments?post=384"}],"version-history":[{"count":3,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/384\/revisions"}],"predecessor-version":[{"id":388,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/384\/revisions\/388"}],"wp:attachment":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/media?parent=384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/categories?post=384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/tags?post=384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![bills have been introduced in several states<\/a>. Additionally, within the past 18 months, more than a dozen cities have passed some sort of ordinance banning, imposing a moratorium, or otherwise limiting facial recognition technologies, including San Francisco, CA; Somerville, MA; Oakland, CA; Berkeley, CA; Brookline, MA; Alameda, CA; Northampton, MA; Cambridge, MA; Springfield, MA; Boston, MA; Easthampton, MA; Portland, OR; Jackson, MS; and Portland, ME. The most recent locale to join this group is Pittsburgh, PA.<\/p>\n <\/p>\nPittsburgh Passes Ordinance on Facial Recognition Technology<\/em><\/strong><\/p>\nA proposed ordinance introduced<\/a> in August by Pittsburgh City Council<\/a> member Corey O\u2019Connor gained preliminary approval<\/a> on September 16, 2020. A week later (on September 22), the Pittsburgh City Council voted (8-0 with one abstention<\/a>) to pass<\/a> the ordinance, and Pittsburgh Mayor Bill Peduto signed the bill on Sept. 24, 2020.<\/p>\n <\/p>\nThe ordinance requires law enforcement to seek approval from City Council before obtaining, accessing, or using \u201cFacial Recognition Technology\u201d or \u201cPredictive Policing Technology\u201d but allows law enforcement to make limited, temporary uses of \u201cSelect Surveillance Technology\u201d if in response to \u201cExigent Circumstances\u201d and limited to a period no longer than 90 days. The text of the ordinance suggests that approval is required for each technology rather than for each individual use case for a particular technology or information derived therefrom. The ordinance establishes four key definitions: Exigent Circumstances, Facial Recognition Technology, Predictive Policy Technology, and Select Surveillance Technology.<\/p>\n <\/p>\nPrivacy Law Advocates Should Hold Off on Celebrations<\/em><\/strong><\/p>\nThe ordinance has already been criticized<\/a> as merely symbolic and lacking any meaningful substance. Notably, this ordinance leaves intact all existing access to facial recognition technologies that Pittsburgh law enforcement has at this time and does so in a sweeping manner, effectively enabling those services to be enhanced and expanded without any consultation with City Council pursuant to this ordinance so long as those changes are made not directly by Pittsburgh police but by whatever entity provides those services to the City of Pittsburgh (whether it be an operator, manager, or publisher of databases, programs, and technologies). This means, for example, that Pittsburgh police may continue to access and use the Pennsylvania Justice Network (JNET<\/a>)\u2014which enables statewide photo searches of PennDOT (driver\u2019s licenses) and WebCPIN (mugshot photos and images from the Department of Corrections, Pennsylvania Board of Probation and Parole, and county prisons). When new facial recognition or predictive policing technology is desired, this ordinance simply mandates that City Council be part of the process prior to the technology\u2019s acquisition or use.<\/p>\n <\/p>\nBroader Significance<\/em><\/strong><\/p>\nThe Pittsburgh ordinance might not offer more than illusory constraints on law enforcement\u2019s use of facial recognition technologies; nevertheless, it marks the beginning of broader policy conversations across the commonwealth regarding how Pennsylvania residents should be protected from unreasonable \u201cdataveillance\u201d and how to promote, at a minimum, transparency in how facial recognition technologies are used in Pennsylvania. For example, following news reports earlier this year that the Philadelphia police had tested out Clearview AI<\/a> and that facial recognition was being deployed at PHL airport<\/a> by Customs and Border Protection at some international gates, the Philadelphia City Council considered a resolution (Resolution No. 20026700<\/a>) calling upon the Philadelphia Police Department and other law enforcement agencies \u201cto establish clear boundaries and issue transparent policies\u201d about how facial recognition technology is being used and \u201cto ensure that this technology does not lead to racial biases in policing practices and outcomes or infringe on individuals\u2019 civil liberties.\u201d While the resolution was apparently withdrawn from the calendar in June, the topic is likely to arise again in some form there and elsewhere.<\/p>\n <\/p>\nAlready Allegheny County Council reportedly introduced<\/a> an identical bill to the Pittsburgh ordinance, and attorneys should assume that other locations will follow suit. While facial recognition technologies are deployed in diverse contexts and by diverse actors, it is in the context of police body camera recordings that political pressure might lead to meaningful legislative reforms to strengthen oversight<\/a> of and improve transparency for facial recognition technology practices. Act 22 of 2017<\/a> (S.B. 560<\/a>), which ushered in an expansion of police body cameras<\/a>, mandated law enforcement agencies to issue written policies specifically on any \u201cuse of facial recognition software or programs\u201d [\u00a767A07(a)(6)]. One might expect York, Scranton, Erie, Harrisburg, State College<\/a>, and other areas in Pennsylvania in which body camera programs have been moving forward<\/a> to be ripe for discussions about facial recognition technologies specifically and data justice issues more broadly.<\/p>\n <\/p>\nAt the state level, there do not appear to be any laws or bills under current consideration regarding facial recognition technologies specifically. Pennsylvania\u2019s data breach notification law (73 Pa. Stat. \u00a72301 et seq.<\/em>, Breach of Personal Information Notification Act) does not explicitly cover facial imaging or other biometrics data. During the 2019-2020 regular session, the Pennsylvania General Assembly has been considering several bills related to biometrics generally (including, among others, H.B. 1010<\/a> and S.B.955<\/a> on data breach notifications and H.B. 1049<\/a> on consumer data privacy) the text of which could be broad enough to apply to faceprints and facial imaging data. Careful reading of how terms of art are defined will be critical when evaluating the strengths, weaknesses, and potential impacts of any legislation that might be on the horizon regarding data protections broadly or facial recognition technologies narrowly.<\/p>\n <\/p>\n\nJennifer K. Wagner, J.D., Ph.D., is a solo practicing attorney and also conducts research as an Assistant Professor in the Center for Translational Bioethics & Health Care Policy at Geisinger. She is a former contributing editor of the Genomics Law Report and has published scholarly articles in prominent legal and scientific journals, including the Journal of Law & Biosciences; Journal of Law, Medicine, & Ethics; Albany Law Journal of Science & Technology; Virginia Sports and Entertainment Law Journal; North Carolina Journal of Law and Technology; Nature Communications; Nature Medicine; American Journal of Human Genetics; Genetics in Medicine; and PLOS Genetics. She served as a AAAS Congressional Fellow in a U.S. Senator\u2019s office in 2014-2015, and her work has been cited by the Supreme Court of the United States. You may follow her on Twitter as @DNAlawyer<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"By Jennifer K. Wagner, J.D., Ph.D. Background Previously on this blog, Patrick McKnight wrote about facial recognition technologies coming under increased congressional scrutiny, noting companion bills introduced on June 25, 2020 by Senators Markey and Merkley (S. 4084) and Representatives Jayapal and Pressley (H.R.7356) known as the \u201cFacial Recognition and Biometric Technology Moratorium Act Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,35,23],"tags":[],"_links":{"self":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/384"}],"collection":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/comments?post=384"}],"version-history":[{"count":3,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/384\/revisions"}],"predecessor-version":[{"id":388,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/384\/revisions\/388"}],"wp:attachment":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/media?parent=384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/categories?post=384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/tags?post=384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}](\"https:\/\/s3.amazonaws.com\/multistate.us\/production\/articles\/a9fybhE9BWPPXJ5Ir\/body\/upload-55021b.png\"){kind=link}