[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[S. 5334 Introduced in Senate (IS)]
<DOC>
117th CONGRESS
2d Session
S. 5334
To establish best practices for the Federal use of facial recognition
technology, and for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
December 21, 2022
Mr. Portman introduced the following bill; which was read twice and
referred to the Committee on Homeland Security and Governmental Affairs
_______________________________________________________________________
A BILL
To establish best practices for the Federal use of facial recognition
technology, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Facial,
Accountability, Clarity, and Efficiency in Technology Act'' or the
``FACE IT Act''.
(b) Table of Contents.--The table of contents for this Act is as
follows:
Sec. 1. Short title; table of contents.
Sec. 2. Definitions.
TITLE I--ESTABLISHING BEST PRACTICES FOR CURRENT FEDERAL USE OF FACIAL
RECOGNITION TECHNOLOGY
Sec. 101. Disclosure of Federal uses of facial recognition technology.
Sec. 102. Accuracy requirements for the procurement of facial
recognition technology.
Sec. 103. Requirement for procurement of facial recognition technology.
Sec. 104. Disclosure of high risk use case.
Sec. 105. Requirement of human involvement in facial recognition
technology decisionmaking.
Sec. 106. United States person notice and opt-out for non-investigative
uses of facial recognition technology.
Sec. 107. Guarantee of constitutional rights.
Sec. 108. Database access restrictions for Federal use of facial
recognition technology.
Sec. 109. Notification for criminal defendants.
Sec. 110. Rule of construction for facial recognition technology that
is not high risk.
Sec. 111. Limitation to civilian agencies.
TITLE II--DEVELOPING BEST PRACTICES FOR FUTURE FEDERAL USE OF FACIAL
RECOGNITION TECHNOLOGY
Sec. 201. Establishment of a Federal Advisory Committee on Facial
Recognition Technology.
Sec. 202. Membership of the Federal Advisory Committee on Facial
Recognition Technology.
Sec. 203. Meetings of the Federal Advisory Committee on Face
Recognition Technology.
Sec. 204. Authorization of appropriations.
TITLE III--FOIA
Sec. 301. Applicability of FOIA.
SEC. 2. DEFINITIONS.
In this Act--
(1) the term ``Advisory Committee'' means the Federal
Advisory Committee on Facial Recognition Technology established
under section 201(a);
(2) the term ``applicable congressional committee'' means--
(A) the Committee on Homeland Security and
Governmental Affairs, the Committee on Commerce,
Science, and Transportation, and the Committee on the
Judiciary of the Senate; and
(B) the Committee on Homeland Security, the
Committee on Energy and Commerce, the Committee on
Oversight and Reform, the Committee on Science, Space,
and Technology, and the Committee on the Judiciary of
the House of Representatives;
(3) the term ``Director'' means the Director of the Office
of Management and Budget;
(4) the term ``facial recognition technology'' means an
automated or semi-automated process of--
(A) generating a mathematical representation of an
individual's face, known as a probe face template; and
(B)(i) querying a gallery populated with many face
templates that may be linked to personally identifiable
information and subsequently returning an identity if
the similarity of the probe face template to any face
template in the gallery is above a specified threshold;
or
(ii) comparing the probe face template to a
specific face template of an existing image of the
individual to verify their identity;
(5) the term ``Federal agency'' has the meaning given the
term ``agency'' in section 3502 of title 44, United States
Code;
(6) the term ``high risk'', with respect to a use case,
means one in which face recognition query outputs influence the
decision to--
(A) arrest or convict an individual, deny an
individual access to government services to which the
individual is legally entitled; or
(B) take other action that directly impacts the
fundamental rights or equal protection of that
individual under the law;
(7) the term ``intelligence community'' has the meaning
given the term in section 3 of the National Security Act of
1947 (50 U.S.C. 3003);
(8) the term ``Secretary'' means the Secretary of Homeland
Security;
(9) the term ``use case''--
(A) means a description of the ways and
circumstances in which a technology is operated to
perform a specific function; and
(B) does not include research programs that use
Institutional Review Board informed consent; and
(10) the term ``security use case'' means the ways and
circumstances in which a technology is operated to perform a
specific function related to--
(A) conducting a criminal investigation;
(B) protecting national security;
(C) monitoring and preventing unauthorized access
to Federal buildings; or
(D) detecting or combating fraud or other illegal
activity.
TITLE I--ESTABLISHING BEST PRACTICES FOR CURRENT FEDERAL USE OF FACIAL
RECOGNITION TECHNOLOGY
SEC. 101. DISCLOSURE OF FEDERAL USES OF FACIAL RECOGNITION TECHNOLOGY.
(a) In General.--Not later than 270 days after the date of
enactment of this Act, and biannually thereafter, the Director shall
submit to the applicable congressional committees a report on all
Federal Government programs that use face recognition technology.
(b) Execution of Report.--In order to facilitate the submission of
the report under subsection (a), the head of each Federal agency shall
provide necessary information to the Director at the request of the
Director.
(c) Contents.--Each report submitted under subsection (a) shall
include--
(1) a description of each facial recognition technology use
case deployed by a Federal agency;
(2) an evaluation of how facial recognition technologies
deployed by a Federal agency comply with the accuracy
requirements under section 102;
(3) a list of the private sector entities which provide
facial recognition technologies to each Federal agency for each
use case;
(4) a list of the State, local, and Tribal government
agencies and entities that provide access to facial recognition
technologies to each Federal agency for each use case;
(5) the databases that facial recognition technology
queries for each Federal agency for each use case and, if
applicable, the authorization allowing access to privately
owned and maintained databases;
(6) an explanation of the reasons, with quantitative
rationales where possible, for using facial recognition
technology for each use case;
(7) for each use case described in paragraph (1), an
enumeration of whether the use case is high risk; and
(8) any additional information the Director determines
appropriate.
(d) Form of Report.--Each report required under subsection (a)
shall be submitted in an unclassified form, but may contain a
classified annex.
SEC. 102. ACCURACY REQUIREMENTS FOR THE PROCUREMENT OF FACIAL
RECOGNITION TECHNOLOGY.
(a) Development of Accuracy Requirements.--Not later than 1 year
after the first report is submitted under section 101(a), the Director
of the National Institute for Standards and Technology and the
Secretary, in consultation with the Director of the Office of Science
and Technology Policy and other agencies and entities as appropriate,
shall develop minimum accuracy requirements, specific to each Federal
agency, for use cases of facial recognition technology in the Federal
Government as determined in the report.
(b) Development of Accuracy Requirements for High Risk Use Cases.--
In developing the requirements under subsection (a), the Director of
the National Institute for Standards and Technology shall ensure that
the requirements for the use cases identified as high risk shall be
more strict than the requirements for the uses cases that are not high
risk.
(c) Certification for the Accuracy Standards.--The head of each
Federal agency shall develop a process to ensure that, with the
exception of research and testing, the facial recognition technology
used by the Federal agency meets the relevant requirements established
under subsection (a).
(d) Accuracy Across Demographic Groups.--The requirements under
subsection (a) shall include minimum accuracy requirements for
individuals regardless of different skin tone or race, disability
status, age, or sex, alone and in combination, to ensure that facial
recognition technology can accurately identify diverse individuals.
(e) Transparency Requirements.--Not later than 30 days after the
date on which the requirements are developed under subsection (a), the
Director of the National Institute for Standards and Technology shall
make such requirements available on a public website.
SEC. 103. REQUIREMENT FOR PROCUREMENT OF FACIAL RECOGNITION TECHNOLOGY.
(a) In General.--Except as provided in subsection (c), before a
Federal agency procures or acquires a facial recognition technology,
the Federal agency shall--
(1) publicly report testing and performance results from
the Face Recognition Vendor Testing Program of the National
Institute of Standards and Technology or other reputable
testing authority in a manner that is compatible with Global
Reporting Initiative 102 requirements for the facial
recognition systems that the Federal agency aims to procure or
acquire;
(2) certify to the Director that the technology shall meet
the accuracy requirements developed under section 102; and
(3) include the certification described in paragraph (1) in
the next report required under section 101.
(b) Limitation on Procurement of Facial Recognition.--
(1) In general.--On and after the date on which the
accuracy requirements are developed under section 102(a), the
head of a Federal agency shall not procure or acquire facial
recognition technology that does not meet the requirements
under subsection (a).
(2) Acquisitions before development of accuracy
requirements.--The head of a Federal agency--
(A) may procure or acquire facial recognition
technology before the date described in paragraph (1);
and
(B) if the head of the Federal agency procures or
acquires technology described in subparagraph (A),
shall ensure that the technology meets the requirements
under subsection (a) not later than 1 year after the
date on which the accuracy requirements are developed
under section 102(a).
(c) Exceptions.--The requirements under subsection (a) shall not
apply to a facial recognition algorithm software update, enhancement,
derivative, correction, defect, or fix, or research program exempted
under section 102.
SEC. 104. DISCLOSURE OF HIGH RISK USE CASE.
(a) Testing and Transparency for High Risk Use Cases.--Not later
than 30 days after a report required under section 101 is submitted,
each Federal agency shall report on a publicly available and easily
accessible Federal website the testing and performance results of the
relevant facial recognition algorithm from the Face Recognition Vendor
Testing Program of the National Institute of Standards and Technology
or other reputable testing authority for high risk use cases.
(b) Updates.--Each Federal agency shall update the results
published under subsection (a) following the identification of new high
risk use cases in subsequent reports submitted under section 101.
SEC. 105. REQUIREMENT OF HUMAN INVOLVEMENT IN FACIAL RECOGNITION
TECHNOLOGY DECISIONMAKING.
(a) In General.--A Federal agency shall not take any adverse final
action to an identified or verified individual that was based on a
query output from facial recognition technology deployed by that
Federal agency unless a human person has reviewed the facial
recognition technology query output and documented the human
involvement in the process.
(b) Qualifications for High Risk Use Cases.--With respect to a high
risk use case, the individual described in subsection (a) shall be
qualified in accordance with the relevant training standards developed
by the Face Identification Scientific Working Group for particular use
cases.
SEC. 106. UNITED STATES PERSON NOTICE AND OPT-OUT FOR NON-INVESTIGATIVE
USES OF FACIAL RECOGNITION TECHNOLOGY.
(a) In General.--A Federal agency that uses facial recognition
technology for a purpose other than a criminal investigation or other
security use case, such as identity verification, shall--
(1) notify the United States person that they are or were
subject to identity verification by facial recognition
technology; and
(2) provide the United States person an alternative method
of identity verification that does not involve the use of
facial recognition technology.
(b) Publication of Opt-Out Availability.--Federal agencies using
facial recognition technology in a manner described in subsection (a)
shall communicate to a United States person subject to the use of
facial recognition technology that the United States person can elect
to verify their identity using an alternative method that does not
involve the use of facial recognition technology.
(c) Simplicity of the Opt-Out.--For United States persons that
exercise the rights under subsection (b), Federal agencies shall not
impose a burden for opting out that is substantially greater than the
person would experience by using facial recognition technology.
SEC. 107. GUARANTEE OF CONSTITUTIONAL RIGHTS.
A Federal agency shall not use facial recognition technology to
violate any rights guaranteed by the Constitution of the United States.
SEC. 108. DATABASE ACCESS RESTRICTIONS FOR FEDERAL USE OF FACIAL
RECOGNITION TECHNOLOGY.
No component, official, or personnel of a Federal agency shall use
facial recognition technology to access a privately owned and
maintained database without prior authorization from the head of the
Federal agency, with the exception of a database used for a research
and testing program.
SEC. 109. NOTIFICATION FOR CRIMINAL DEFENDANTS.
Any criminal defendant, or a counsel thereof, identified through an
investigative process that used facial recognition technology in the
course of the investigation that led to identifying the defendant by
the Federal agency conducting the investigative process shall receive
notice that facial recognition technology was used in the investigative
process.
SEC. 110. RULE OF CONSTRUCTION FOR FACIAL RECOGNITION TECHNOLOGY THAT
IS NOT HIGH RISK.
Nothing in this title shall be construed to diminish any Federal
requirements with respect to face recognition technology that is not
classified as high risk.
SEC. 111. LIMITATION TO CIVILIAN AGENCIES.
Nothing in this title shall apply to the Department of Defense or
any element of the intelligence community.
TITLE II--DEVELOPING BEST PRACTICES FOR FUTURE FEDERAL USE OF FACIAL
RECOGNITION TECHNOLOGY
SEC. 201. ESTABLISHMENT OF A FEDERAL ADVISORY COMMITTEE ON FACIAL
RECOGNITION TECHNOLOGY.
(a) Establishment.--The Director, in consultation with the
Secretary, the Director of the National Institute for Standards and
Technology, and the head of any other Federal agency that the Director
determines appropriate, shall establish a Federal advisory committee on
the use of facial recognition technology to be known as the ``Federal
Advisory Committee on Facial Recognition Technology'' to advise Federal
agencies on matters related to the use of facial recognition
technology.
(b) Purposes of the Advisory Committee.--The Advisory Committee
shall advise the Federal agencies on--
(1) opportunities to deploy facial recognition technology
to improve the effectiveness of the Federal Government;
(2) the risks associated with the use of facial recognition
technology in different use cases;
(3) the ways that Federal agencies can improve the safety
and reliability of facial recognition technology, including
through research and development funding to support face
recognition technology innovation;
(4) the ethics of facial recognition technology and its
use, including mitigating potential bias associated with the
use of facial recognition;
(5) protections for privacy, civil liberties, civil rights,
and information security when using facial recognition;
(6) the ways that Federal agencies can manage, track, and
resolve facial recognition failure rates relating to skin
complexion or color;
(7) trends in the use of facial recognition technology;
(8) any necessary updates to the list of high risk use
cases that should be enumerated in the biannual reports
required under section 101(a);
(9) requirements for monitoring and documenting any Federal
agency use of facial recognition technology that the Federal
Government does not own for a high risk use case; and
(10) any other safeguards necessary, including audit and
compliance procedures, standards, and training programs, to
ensure the safe and reliable deployment of new facial
recognition systems not currently used by the Federal
Government.
(c) Annual Report.--Not later than 1 year after the date of
enactment of this Act and every year thereafter, the Director shall
submit a report on the activities of the of the Advisory Committee and
any guidance provided to Federal agencies on matters related to the use
of facial recognition technology to--
(1) the Committee on Homeland Security and Governmental
Affairs of the Senate;
(2) the Committee on Commerce, Science, and Transportation
of the Senate;
(3) the Committee on Homeland Security of the House of
Representatives;
(4) the Committee on Oversight and Reform of the House of
Representatives; and
(5) the Committee on Science, Space, and Technology of the
House of Representatives.
SEC. 202. MEMBERSHIP OF THE FEDERAL ADVISORY COMMITTEE ON FACIAL
RECOGNITION TECHNOLOGY.
(a) In General.--The Advisory Committee shall be composed of 17
members who shall be appointed by the Secretary in addition to the
representatives listed in subsection (c).
(b) Representation.--In carrying out subsection (a), the Secretary
shall ensure that members are appointed as follows:
(1) 4 members from private industry, including small
businesses.
(2) 4 members from the academic or research community who
are computer scientists or otherwise primarily technical
experts in the science and engineering behind facial
recognition technology.
(3) 4 members from civil society, including individuals
that advocates for privacy, civil liberties, or civil rights.
(4) 1 member from the Biometric and Identity Technology
Center of the Department of Homeland Security.
(5) 1 member from the Face Identification Scientific
Working Group.
(6) 1 member from the Face Identification Subcommittee of
the Organization of Scientific Area Committees for Forensic
Science of the National Institute of Standards and Technology.
(c) Ex-Officio Representation.--The Advisory Committee shall be
composed of 1 ex-officio representative knowledgeable in biometric
risks, benefits, programs, policies, operations, and applications
from--
(1) the National Institute of Standards and Technology;
(2) the Department of Commerce;
(3) the General Services Administration;
(4) the Department of Justice;
(5) the Department of Homeland Security;
(6) the Department of State;
(7) the Department of Education;
(8) the Department of Energy;
(9) the Transportation Security Administration;
(10) the Department of Veterans Affairs;
(11) U.S. Customs and Border Protection;
(12) U.S. Immigration and Customs Enforcement;
(13) the Federal Emergency Management Agency;
(14) the Office of Biometric Identity Management;
(15) the National Science Foundation;
(16) the National Science and Technology Council;
(17) the Office of Science and Technology Policy; and
(18) such other Federal agencies as the Secretary considers
appropriate.
(d) Chairperson.--The Secretary shall appoint a chairperson for the
Advisory Committee from among the members appointed under subsection
(a).
SEC. 203. MEETINGS OF THE FEDERAL ADVISORY COMMITTEE ON FACE
RECOGNITION TECHNOLOGY.
(a) Meetings.--The Advisory Committee shall meet in person, or by
telepresence, not less frequently than twice per year.
(b) Powers.--In order to carry out its duties under section 201,
the Advisory Committee shall--
(1) hold such hearings, sit and act at such times and
places, take such testimony, and receive such evidence as the
Advisory Committee considers appropriate;
(2) submit to Federal agencies such recommendations as the
Advisory Committee considers appropriate;
(3) issue reports, guidelines, and memoranda;
(4) hold or host conferences and symposia;
(5) establish subcommittees; and
(6) establish rules of procedure.
(c) Travel Expenses.--The members of the Advisory Committee shall
be allowed travel expenses, including per diem in lieu of subsistence,
at rates authorized for employees of Federal agencies under subchapter
I of chapter 57 of title 5, United States Code, while away from their
homes or regular places of business in the performance of services for
the Advisory Committee.
SEC. 204. AUTHORIZATION OF APPROPRIATIONS.
There is authorized to be appropriated such sums as may be
necessary to carry out the requirements of this title.
TITLE III--FOIA
SEC. 301. APPLICABILITY OF FOIA.
Nothing in this Act, or in a report produced under section 101,
shall be construed to allow the disclosure of information or a record
that is exempt from public disclosure under section 552 of title 5,
United States Code (commonly known as the ``Freedom of Information
Act'').
<all>