Colorado Law Restricts Use of Facial Recognition Technology by Government Agencies | Robinson+Cole Data Privacy + Security Insider
Reinforcing the state’s continued focus on data privacy, on June 8, 2022, Colorado Governor Jared Polis signed legislation to limit the use of facial recognition technology by government agencies and organizations. state higher education institutions.
The new law, SB 113, requires an agency, defined as “an agency of the state or local government; or a public institution of higher education”, which intends to “develop, obtain, use or continue to use a facial recognition service” to provide a notice of intention to use these services with its “reporting authority before using the technology.
The notice should provide details of the provider to be used, the capabilities and limitations of using the facial recognition technology, the type of data collected by the technology, how the data will be collected and processed, the purpose of the use and benefits of the proposed use of the technology. In addition, the notice should provide information on how the data will be stored and secured, the policies that will govern the information collected, and details regarding testing and reporting of “mismatches, potential impacts on subpopulations protected and how the agency will deal with errors”. rates that are independently determined to be greater than one percent.
The law requires agencies and public institutions of higher education to provide an accountability report on the impact of the use of facial recognition on civil rights and liberties, “including potential impacts on privacy and disparate potential impacts on marginalized communities, including specific actions the agency will take to mitigate potential impacts” and how it will receive feedback on the use of the technology Agencies are required to submit an Accountability Report prior to deploy the technology and must allow for public review and comment, including three public meetings The Accountability Report must be publicly released at least 90 days prior to deployment of the technology.
The law requires users of facial recognition technology in an agency to be trained in its use and includes certain limitations and prohibitions on the use of the technology by law enforcement. It also prohibits the use of facial recognition services by any public school, charter school or institute charter school until January 1, 2025.
The law is dense in its requirements and comes into force on August 10, 2022.