Commercial Facial Recognition Privacy Act of 2019

II 116TH CONGRESS 1ST SESSION S. 847 To prohibit certain entities from using facial recognition technology to identify or track an end user without obtaining the affirmative consent of the end user, and for other purposes. IN THE SENATE OF THE UNITED STATES MARCH 14, 2019 Mr. BLUNT (for himself and Mr. SCHATZ) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To prohibit certain entities from using facial recognition technology to identify or track an end user without ob- taining the affirmative consent of the end user, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Commercial Facial 4 Recognition Privacy Act of 2019’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 2 •S 847 IS (1) AFFIRMATIVE CONSENT.—The term ‘‘af- 1 firmative consent’’ means the consent of an end user 2 that involves an individual, voluntary, and explicit 3 agreement to the collection and data use policies of 4 a controller. 5 (2) CONTROLLER.—The term ‘‘controller’’ 6 means a covered entity that, alone or jointly with 7 others, determines the purposes and means of the 8 processing of facial recognition data. 9 (3) COVERED ENTITY.—The term ‘‘covered en- 10 tity’’— 11 (A) means any person, including corporate 12 affiliates, that collects, stores, or processes fa- 13 cial recognition data; and 14 (B) does not include— 15 (i) the Federal Government or any 16 State or local government; 17 (ii) a law enforcement agency; 18 (iii) a national security agency; or 19 (iv) an intelligence agency. 20 (4) END USER.—The term ‘‘end user’’ means 21 an individual. 22 (5) FACIAL RECOGNITION TECHNOLOGY.—The 23 term ‘‘facial recognition technology’’ means tech- 24 nology that— 25 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 3 •S 847 IS (A) analyzes facial features in still or video 1 images; and 2 (B)(i) is used to assign a unique, per- 3 sistent identifier; or 4 (ii) is used for the unique personal identi- 5 fication of a specific individual. 6 (6) FACIAL RECOGNITION DATA.—The term 7 ‘‘facial recognition data’’ means any unique attribute 8 or feature of the face of an end user that is used 9 by facial recognition technology to assign a unique, 10 persistent identifier or for the unique personal iden- 11 tification of a specific individual. 12 (7) PROCESS.—The term ‘‘process’’ means any 13 operation that is performed on facial recognition 14 data, including collection, creation, generation, re- 15 cording, organization, structuring, storage, adapta- 16 tion, alteration, retrieval, consultation, use, disclo- 17 sure, transfer, dissemination or otherwise making 18 available, combination, erasure, or destruction. 19 (8) PROCESSOR.—The term ‘‘processor’’ means 20 a covered entity that processes facial recognition 21 data on behalf of a controller. 22 (9) SECURITY APPLICATION.—The term ‘‘secu- 23 rity application’’ means loss prevention and any 24 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 4 •S 847 IS other application intended to detect or prevent crimi- 1 nal activity, including shoplifting and fraud. 2 (10) UNAFFILIATED THIRD PARTY.—The term 3 ‘‘unaffiliated third party’’ means any person other 4 than— 5 (A) a user of a product or service of a cov- 6 ered entity; 7 (B) an employee of a covered entity; 8 (C) a person under common control or 9 ownership with a covered entity; or 10 (D) a person to whom— 11 (i) an end user directed a covered en- 12 tity to disclose information derived from 13 facial recognition technology; or 14 (ii) information derived from facial 15 recognition technology was disclosed with 16 the affirmative consent of an end user. 17 SEC. 3. PROHIBITED CONDUCT. 18 (a) IN GENERAL.—Except as provided in subsection 19 (e), it shall be unlawful for a controller to knowingly— 20 (1) use facial recognition technology to collect 21 facial recognition data, unless the controller— 22 (A) obtains from an end user affirmative 23 consent in accordance with subsection (b); and 24 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 5 •S 847 IS (B) to the extent possible, if facial recogni- 1 tion technology is present, provides to the end 2 user— 3 (i) a concise notice that facial recogni- 4 tion technology is present, and, if contex- 5 tually appropriate, where the end user can 6 find more information about the use of fa- 7 cial recognition technology by the con- 8 troller; and 9 (ii) documentation that includes gen- 10 eral information that explains the capabili- 11 ties and limitations of the facial recogni- 12 tion technology in terms that end users are 13 able to understand; 14 (2) use the facial recognition technology to dis- 15 criminate against an end user in violation of applica- 16 ble Federal or State law; 17 (3) repurpose facial recognition data for a pur- 18 pose that is different from those presented to the 19 end user under paragraph (1)(A); or 20 (4) share the facial recognition data with an 21 unaffiliated third party without affirmative consent 22 that is separate from the affirmative consent re- 23 quired under paragraph (1)(A). 24 (b) CONSENT.— 25 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 6 •S 847 IS (1) IN GENERAL.—When obtaining affirmative 1 consent, a controller shall make available to an end 2 user a notice that describes the specific practices of 3 the processor in terms that end users are able to un- 4 derstand regarding the collection, storage, and use 5 of facial recognition data, including— 6 (A) the reasonably foreseeable purposes, or 7 examples, for which the processor collects and 8 shares information derived from facial recogni- 9 tion technology or uses facial recognition tech- 10 nology; 11 (B) the data retention and deidentification 12 practices of the processor; and 13 (C) if the controller offers the ability to re- 14 view, correct, or delete information derived from 15 facial recognition technology, the process to ac- 16 complish such actions. 17 (2) PROCESSOR REQUIREMENT.—If the proc- 18 essor and controller are not the same entity, the 19 processor shall make easily accessible to controllers 20 the information required under paragraph (1). 21 (3) CONDITIONING SERVICE ON CONSENT PRO- 22 HIBITED.—If the use of facial recognition technology 23 is not necessary for a service, no controller may— 24 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 7 •S 847 IS (A) condition the service on consent by an 1 end user to waive privacy rights; or 2 (B) terminate or refuse the service as a di- 3 rect consequence of refusal by the end user to 4 provide affirmative consent to the covered enti- 5 ty. 6 (c) REVIEW.—A controller, and the processor if appli- 7 cable, shall employ meaningful human review prior to 8 making any final decision based on the output of facial 9 recognition technology if the final decision— 10 (1) may result in a reasonably foreseeable and 11 material physical or financial harm to an end user; 12 or 13 (2) may be unexpected or highly offensive to a 14 reasonable end user. 15 (d) APPLICATION PROGRAMMING INTERFACE.—A 16 covered entity that makes a facial recognition technology 17 available as an online service shall make available an ap- 18 plication programming interface to enable at least 1 third 19 party that is legitimately engaged in independent testing 20 to conduct reasonable tests of the facial recognition tech- 21 nology for accuracy and bias. 22 (e) EXCEPTIONS.— 23 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 8 •S 847 IS (1) IN GENERAL.—Except as provided in para- 1 graph (2), subsections (a)(1) and (b) shall not apply 2 to controllers that use— 3 (A) an application that— 4 (i) is a product or service designed for 5 personal file management or photo or video 6 sorting or storage if the facial recognition 7 technology is not used for unique personal 8 identification of a specific individual; 9 (ii) involves identification of public 10 figures for journalistic media created for 11 public interest; 12 (iii) involves identification of public 13 figures in copyrighted material for theat- 14 rical release; or 15 (iv) is used if there is an emergency 16 involving imminent danger or risk of death 17 or serious physical injury to an individual; 18 or 19 (B) facial recognition data to determine 20 whether an end user has given affirmative con- 21 sent if the controller immediately and perma- 22 nently destroys the facial recognition data after 23 determining that the end user has not given af- 24 firmative consent. 25 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 9 •S 847 IS (2) SECURITY APPLICATIONS.—Subsections 1 (a)(1)(A) and (b) shall not apply to controllers that 2 use an application that is a security application. 3 (3) RULE OF CONSTRUCTION.—Nothing in 4 paragraph (1)(B) may be construed to authorize the 5 mass scanning of faces in spaces where end users do 6 not have a reasonable expectation that facial rec- 7 ognition technology is being used on them. 8 SEC. 4. ENFORCEMENT. 9 (a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—A 10 violation of section 3 shall be treated as a violation of a 11 rule defining an unfair or deceptive act or practice pre- 12 scribed under section 18(a)(1)(B) of the Federal Trade 13 Commission Act (15 U.S.C. 57a(a)(1)(B)). 14 (b) POWERS OF COMMISSION.— 15 (1) IN GENERAL.—The Federal Trade Commis- 16 sion shall enforce this Act in the same manner, by 17 the same means, and with the same jurisdiction as 18 though all applicable terms and provisions of the 19 Federal Trade Commission Act (15 U.S.C. 41 et 20 seq.) were incorporated into and made a part of this 21 Act. 22 (2) PRIVILEGES AND IMMUNITIES.—Any person 23 who violates section 3 shall be subject to the pen- 24 alties and entitled to the privileges and immunities 25 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 10 •S 847 IS provided in the Federal Trade Commission Act (15 1 U.S.C. 41 et seq.). 2 (c) ENFORCEMENT BY STATES.— 3 (1) IN GENERAL.—If the attorney general of a 4 State has reason to believe that an interest of the 5 residents of the State has been or is being threat- 6 ened or adversely affected by a practice that violates 7 section 3, the attorney general of the State may, as 8 parens patriae, bring a civil action on behalf of the 9 residents of the State in an appropriate district 10 court of the United States to obtain appropriate re- 11 lief. 12 (2) RIGHTS OF COMMISSION.— 13 (A) NOTICE TO COMMISSION.— 14 (i) IN GENERAL.—Except as provided 15 in clause (iii), the attorney general of a 16 State, before initiating a civil action under 17 paragraph (1), shall provide written notifi- 18 cation to the Commission that the attorney 19 general intends to bring such civil action. 20 (ii) CONTENTS.—The notification re- 21 quired under clause (i) shall include a copy 22 of the complaint to be filed to initiate the 23 civil action. 24 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 11 •S 847 IS (iii) EXCEPTION.—If it is not feasible 1 for the attorney general of a State to pro- 2 vide the notification required under clause 3 (i) before initiating a civil action under 4 paragraph (1), the attorney general shall 5 notify the Commission immediately upon 6 instituting the civil action. 7 (B) INTERVENTION BY COMMISSION.—The 8 Commission may— 9 (i) intervene in any civil action 10 brought by the attorney general of a State 11 under paragraph (1); and 12 (ii) upon intervening— 13 (I) be heard on all matters aris- 14 ing in the civil action; and 15 (II) file petitions for appeal of a 16 decision in the civil action. 17 (3) INVESTIGATORY POWERS.—Nothing in this 18 subsection may be construed to prevent the attorney 19 general of a State from exercising the powers con- 20 ferred on the attorney general by the laws of the 21 State to conduct investigations, to administer oaths 22 or affirmations, or to compel the attendance of wit- 23 nesses or the production of documentary or other 24 evidence. 25 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 12 •S 847 IS (4) VENUE; SERVICE OF PROCESS.— 1 (A) VENUE.—Any action brought under 2 paragraph (1) may be brought in— 3 (i) the district court of the United 4 States that meets applicable requirements 5 relating to venue under section 1391 of 6 title 28, United States Code; or 7 (ii) another court of competent juris- 8 diction. 9 (B) SERVICE OF PROCESS.—In an action 10 brought under paragraph (1), process may be 11 served in any district in which— 12 (i) the defendant is an inhabitant, 13 may be found, or transacts business; or 14 (ii) venue is proper under section 15 1391 of title 28, United States Code. 16 (5) ACTIONS BY OTHER STATE OFFICIALS.— 17 (A) IN GENERAL.—In addition to a civil 18 action brought by an attorney general under 19 paragraph (1), any other officer of a State who 20 is authorized by the State to do so may bring 21 a civil action under paragraph (1), subject to 22 the same requirements and limitations that 23 apply under this subsection to civil actions 24 brought by attorneys general. 25 VerDate Sep 11 2014 23:57 Mar 28, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S847.IS S847 pamtmann on DSKBFK8HB2PROD with BILLS 13 •S 847 IS (B) SAVINGS PROVISION.—Nothing in this 1 subsection may be construed to prohibit an au- 2 thorized official of a State from initiating or 3 continuing any proceeding in a court of the 4 State for a violation of any civil or criminal law 5 of the State. 6 SEC. 5. REGULATIONS. 7 (a) REGULATIONS.—Not later than 180 days af [Text truncated for display. Full text available on Congress.gov.]