II
117th CONGRESS
2d Session
S. 5334
IN THE SENATE OF THE UNITED STATES
December 21, 2022
Mr. Portman introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs
A BILL
To establish best practices for the Federal use of facial recognition technology, and for other purposes.
Short title; table of contents
Short title
This Act may be cited as the Facial, Accountability, Clarity, and Efficiency in Technology Act
or the FACE IT Act
.
Table of contents
The table of contents for this Act is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Definitions.
TITLE I—Establishing best practices for current Federal use of facial recognition technology
Sec. 101. Disclosure of Federal uses of facial recognition technology.
Sec. 102. Accuracy requirements for the procurement of facial recognition technology.
Sec. 103. Requirement for procurement of facial recognition technology.
Sec. 104. Disclosure of high risk use case.
Sec. 105. Requirement of human involvement in facial recognition technology decisionmaking.
Sec. 106. United States person notice and opt-out for non-investigative uses of facial recognition technology.
Sec. 107. Guarantee of constitutional rights.
Sec. 108. Database access restrictions for Federal use of facial recognition technology.
Sec. 109. Notification for criminal defendants.
Sec. 110. Rule of construction for facial recognition technology that is not high risk.
Sec. 111. Limitation to civilian agencies.
TITLE II—Developing best practices for future Federal use of facial recognition technology
Sec. 201. Establishment of a Federal Advisory Committee on Facial Recognition Technology.
Sec. 202. Membership of the Federal Advisory Committee on Facial Recognition Technology.
Sec. 203. Meetings of the Federal Advisory Committee on Face Recognition Technology.
Sec. 204. Authorization of appropriations.
TITLE III—FOIA
Sec. 301. Applicability of FOIA.
Definitions
In this Act—
the term Advisory Committee means the Federal Advisory Committee on Facial Recognition Technology established under section 201(a);
the term applicable congressional committee means—
the Committee on Homeland Security and Governmental Affairs, the Committee on Commerce, Science, and Transportation, and the Committee on the Judiciary of the Senate; and
the Committee on Homeland Security, the Committee on Energy and Commerce, the Committee on Oversight and Reform, the Committee on Science, Space, and Technology, and the Committee on the Judiciary of the House of Representatives;
the term Director means the Director of the Office of Management and Budget;
the term facial recognition technology means an automated or semi-automated process of—
generating a mathematical representation of an individual’s face, known as a probe face template; and
querying a gallery populated with many face templates that may be linked to personally identifiable information and subsequently returning an identity if the similarity of the probe face template to any face template in the gallery is above a specified threshold; or
comparing the probe face template to a specific face template of an existing image of the individual to verify their identity;
the term Federal agency has the meaning given the term agency in section 3502 of title 44, United States Code;
the term high risk, with respect to a use case, means one in which face recognition query outputs influence the decision to—
arrest or convict an individual, deny an individual access to government services to which the individual is legally entitled; or
take other action that directly impacts the fundamental rights or equal protection of that individual under the law;
the term intelligence community has the meaning given the term in section 3 of the National Security Act of 1947 (50 U.S.C. 3003);
the term Secretary means the Secretary of Homeland Security;
the term use case—
means a description of the ways and circumstances in which a technology is operated to perform a specific function; and
does not include research programs that use Institutional Review Board informed consent; and
the term security use case means the ways and circumstances in which a technology is operated to perform a specific function related to—
conducting a criminal investigation;
protecting national security;
monitoring and preventing unauthorized access to Federal buildings; or
detecting or combating fraud or other illegal activity.
Establishing best practices for current Federal use of facial recognition technology
Disclosure of Federal uses of facial recognition technology
In general
Not later than 270 days after the date of enactment of this Act, and biannually thereafter, the Director shall submit to the applicable congressional committees a report on all Federal Government programs that use face recognition technology.
Execution of report
In order to facilitate the submission of the report under subsection (a), the head of each Federal agency shall provide necessary information to the Director at the request of the Director.
Contents
Each report submitted under subsection (a) shall include—
a description of each facial recognition technology use case deployed by a Federal agency;
an evaluation of how facial recognition technologies deployed by a Federal agency comply with the accuracy requirements under section 102;
a list of the private sector entities which provide facial recognition technologies to each Federal agency for each use case;
a list of the State, local, and Tribal government agencies and entities that provide access to facial recognition technologies to each Federal agency for each use case;
the databases that facial recognition technology queries for each Federal agency for each use case and, if applicable, the authorization allowing access to privately owned and maintained databases;
an explanation of the reasons, with quantitative rationales where possible, for using facial recognition technology for each use case;
for each use case described in paragraph (1), an enumeration of whether the use case is high risk; and
any additional information the Director determines appropriate.
Form of report
Each report required under subsection (a) shall be submitted in an unclassified form, but may contain a classified annex.
Accuracy requirements for the procurement of facial recognition technology
Development of accuracy requirements
Not later than 1 year after the first report is submitted under section 101(a), the Director of the National Institute for Standards and Technology and the Secretary, in consultation with the Director of the Office of Science and Technology Policy and other agencies and entities as appropriate, shall develop minimum accuracy requirements, specific to each Federal agency, for use cases of facial recognition technology in the Federal Government as determined in the report.
Development of accuracy requirements for high risk use cases
In developing the requirements under subsection (a), the Director of the National Institute for Standards and Technology shall ensure that the requirements for the use cases identified as high risk shall be more strict than the requirements for the uses cases that are not high risk.
Certification for the accuracy standards
The head of each Federal agency shall develop a process to ensure that, with the exception of research and testing, the facial recognition technology used by the Federal agency meets the relevant requirements established under subsection (a).
Accuracy across demographic groups
The requirements under subsection (a) shall include minimum accuracy requirements for individuals regardless of different skin tone or race, disability status, age, or sex, alone and in combination, to ensure that facial recognition technology can accurately identify diverse individuals.
Transparency requirements
Not later than 30 days after the date on which the requirements are developed under subsection (a), the Director of the National Institute for Standards and Technology shall make such requirements available on a public website.
Requirement for procurement of facial recognition technology
In general
Except as provided in subsection (c), before a Federal agency procures or acquires a facial recognition technology, the Federal agency shall—
publicly report testing and performance results from the Face Recognition Vendor Testing Program of the National Institute of Standards and Technology or other reputable testing authority in a manner that is compatible with Global Reporting Initiative 102 requirements for the facial recognition systems that the Federal agency aims to procure or acquire;
certify to the Director that the technology shall meet the accuracy requirements developed under section 102; and
include the certification described in paragraph (1) in the next report required under section 101.
Limitation on procurement of facial recognition
In general
On and after the date on which the accuracy requirements are developed under section 102(a), the head of a Federal agency shall not procure or acquire facial recognition technology that does not meet the requirements under subsection (a).
Acquisitions before development of accuracy requirements
The head of a Federal agency—
may procure or acquire facial recognition technology before the date described in paragraph (1); and
if the head of the Federal agency procures or acquires technology described in subparagraph (A), shall ensure that the technology meets the requirements under subsection (a) not later than 1 year after the date on which the accuracy requirements are developed under section 102(a).
Exceptions
The requirements under subsection (a) shall not apply to a facial recognition algorithm software update, enhancement, derivative, correction, defect, or fix, or research program exempted under section 102.
Disclosure of high risk use case
Testing and transparency for high risk use cases
Not later than 30 days after a report required under section 101 is submitted, each Federal agency shall report on a publicly available and easily accessible Federal website the testing and performance results of the relevant facial recognition algorithm from the Face Recognition Vendor Testing Program of the National Institute of Standards and Technology or other reputable testing authority for high risk use cases.
Updates
Each Federal agency shall update the results published under subsection (a) following the identification of new high risk use cases in subsequent reports submitted under section 101.
Requirement of human involvement in facial recognition technology decisionmaking
In general
A Federal agency shall not take any adverse final action to an identified or verified individual that was based on a query output from facial recognition technology deployed by that Federal agency unless a human person has reviewed the facial recognition technology query output and documented the human involvement in the process.
Qualifications for high risk use cases
With respect to a high risk use case, the individual described in subsection (a) shall be qualified in accordance with the relevant training standards developed by the Face Identification Scientific Working Group for particular use cases.
United States person notice and opt-out for non-investigative uses of facial recognition technology
In general
A Federal agency that uses facial recognition technology for a purpose other than a criminal investigation or other security use case, such as identity verification, shall—
notify the United States person that they are or were subject to identity verification by facial recognition technology; and
provide the United States person an alternative method of identity verification that does not involve the use of facial recognition technology.
Publication of opt-Out availability
Federal agencies using facial recognition technology in a manner described in subsection (a) shall communicate to a United States person subject to the use of facial recognition technology that the United States person can elect to verify their identity using an alternative method that does not involve the use of facial recognition technology.
Simplicity of the opt-Out
For United States persons that exercise the rights under subsection (b), Federal agencies shall not impose a burden for opting out that is substantially greater than the person would experience by using facial recognition technology.
Guarantee of Constitutional rights
A Federal agency shall not use facial recognition technology to violate any rights guaranteed by the Constitution of the United States.
Database access restrictions for Federal use of facial recognition technology
No component, official, or personnel of a Federal agency shall use facial recognition technology to access a privately owned and maintained database without prior authorization from the head of the Federal agency, with the exception of a database used for a research and testing program.
Notification for criminal defendants
Any criminal defendant, or a counsel thereof, identified through an investigative process that used facial recognition technology in the course of the investigation that led to identifying the defendant by the Federal agency conducting the investigative process shall receive notice that facial recognition technology was used in the investigative process.
Rule of construction for facial recognition technology that is not high risk
Nothing in this title shall be construed to diminish any Federal requirements with respect to face recognition technology that is not classified as high risk.
Limitation to civilian agencies
Nothing in this title shall apply to the Department of Defense or any element of the intelligence community.
Developing best practices for future Federal use of facial recognition technology
Establishment of a Federal Advisory Committee on Facial Recognition Technology
Establishment
The Director, in consultation with the Secretary, the Director of the National Institute for Standards and Technology, and the head of any other Federal agency that the Director determines appropriate, shall establish a Federal advisory committee on the use of facial recognition technology to be known as the Federal Advisory Committee on Facial Recognition Technology
to advise Federal agencies on matters related to the use of facial recognition technology.
Purposes of the Advisory Committee
The Advisory Committee shall advise the Federal agencies on—
opportunities to deploy facial recognition technology to improve the effectiveness of the Federal Government;
the risks associated with the use of facial recognition technology in different use cases;
the ways that Federal agencies can improve the safety and reliability of facial recognition technology, including through research and development funding to support face recognition technology innovation;
the ethics of facial recognition technology and its use, including mitigating potential bias associated with the use of facial recognition;
protections for privacy, civil liberties, civil rights, and information security when using facial recognition;
the ways that Federal agencies can manage, track, and resolve facial recognition failure rates relating to skin complexion or color;
trends in the use of facial recognition technology;
any necessary updates to the list of high risk use cases that should be enumerated in the biannual reports required under section 101(a);
requirements for monitoring and documenting any Federal agency use of facial recognition technology that the Federal Government does not own for a high risk use case; and
any other safeguards necessary, including audit and compliance procedures, standards, and training programs, to ensure the safe and reliable deployment of new facial recognition systems not currently used by the Federal Government.
Annual report
Not later than 1 year after the date of enactment of this Act and every year thereafter, the Director shall submit a report on the activities of the of the Advisory Committee and any guidance provided to Federal agencies on matters related to the use of facial recognition technology to—
the Committee on Homeland Security and Governmental Affairs of the Senate;
the Committee on Commerce, Science, and Transportation of the Senate;
the Committee on Homeland Security of the House of Representatives;
the Committee on Oversight and Reform of the House of Representatives; and
the Committee on Science, Space, and Technology of the House of Representatives.
Membership of the Federal Advisory Committee on Facial Recognition Technology
In general
The Advisory Committee shall be composed of 17 members who shall be appointed by the Secretary in addition to the representatives listed in subsection (c).
Representation
In carrying out subsection (a), the Secretary shall ensure that members are appointed as follows:
4 members from private industry, including small businesses.
4 members from the academic or research community who are computer scientists or otherwise primarily technical experts in the science and engineering behind facial recognition technology.
4 members from civil society, including individuals that advocates for privacy, civil liberties, or civil rights.
1 member from the Biometric and Identity Technology Center of the Department of Homeland Security.
1 member from the Face Identification Scientific Working Group.
1 member from the Face Identification Subcommittee of the Organization of Scientific Area Committees for Forensic Science of the National Institute of Standards and Technology.
Ex-Officio representation
The Advisory Committee shall be composed of 1 ex-officio representative knowledgeable in biometric risks, benefits, programs, policies, operations, and applications from—
the National Institute of Standards and Technology;
the Department of Commerce;
the General Services Administration;
the Department of Justice;
the Department of Homeland Security;
the Department of State;
the Department of Education;
the Department of Energy;
the Transportation Security Administration;
the Department of Veterans Affairs;
U.S. Customs and Border Protection;
U.S. Immigration and Customs Enforcement;
the Federal Emergency Management Agency;
the Office of Biometric Identity Management;
the National Science Foundation;
the National Science and Technology Council;
the Office of Science and Technology Policy; and
such other Federal agencies as the Secretary considers appropriate.
Chairperson
The Secretary shall appoint a chairperson for the Advisory Committee from among the members appointed under subsection (a).
Meetings of the Federal Advisory Committee on Face Recognition Technology
Meetings
The Advisory Committee shall meet in person, or by telepresence, not less frequently than twice per year.
Powers
In order to carry out its duties under section 201, the Advisory Committee shall—
hold such hearings, sit and act at such times and places, take such testimony, and receive such evidence as the Advisory Committee considers appropriate;
submit to Federal agencies such recommendations as the Advisory Committee considers appropriate;
issue reports, guidelines, and memoranda;
hold or host conferences and symposia;
establish subcommittees; and
establish rules of procedure.
Travel expenses
The members of the Advisory Committee shall be allowed travel expenses, including per diem in lieu of subsistence, at rates authorized for employees of Federal agencies under subchapter I of chapter 57 of title 5, United States Code, while away from their homes or regular places of business in the performance of services for the Advisory Committee.
Authorization of appropriations
There is authorized to be appropriated such sums as may be necessary to carry out the requirements of this title.
FOIA
Applicability of FOIA
Nothing in this Act, or in a report produced under section 101, shall be construed to allow the disclosure of information or a record that is exempt from public disclosure under section 552 of title 5, United States Code (commonly known as the Freedom of Information Act
).