Schatz Introduces Facial Recognition Privacy Act

Sens. Brian Schatz and Roy Blunt introduced the Commercial Facial Recognition Privacy Act of 2019 last Thursday. The bipartisan legislation would prohibit commercial users of facial recognition technology from collecting and re-sharing data to identify or track consumers without their consent.

“Our faces are our identities. They’re personal. So the responsibility is on companies to ask people for their permission before they track and analyze their faces,” Schatz said. “Our bill makes sure that people are given the information and – more importantly  – the control over how their data is shared with companies using facial recognition technology.”

While FR has been used for security and surveillance applications for decades, it is now being rapidly developed for commercial applications. Many consumers are unaware that FR technology exists in public places and can be used to collect personally identifiable data, which can be shared with undisclosed third parties.

According to Sen. Blunt, the bill promotes transparency and protects consumer choice by requiring individuals to give informed consent before commercial entities can collect and share data gathered through FR.

“Consumers are increasingly concerned about how their data is being collected and used, including data collected through facial recognition technology,” Blunt said. “That’s why we need guardrails to ensure that, as this technology continues to develop, it is implemented responsibly. This legislation is an important step toward protecting privacy and empowering consumers, and I encourage all of my colleagues to support it.”

Brad Smith, the president of Microsoft, said FR needs regulations to protect against acts of bias and discrimination and to uphold basic democratic freedoms.

“Facial recognition technology creates many new benefits for society and should continue to be developed,” Smith said. “Senators Blunt and Schatz’s bill has started an important conversation in Congress about the responsible use of this technology. We’re encouraged by their efforts, applaud their leadership and look forward to working with them to develop balanced policy.”

According to Chris Calabrese, the vice president for policy at the Center for Democracy and Technology, the bill recognizes that FR is a powerful and invasive new technology.

“We deserve clear rules and limits on how our faces can be analyzed, identified, and tracked over time,” Calabrese said. “While face recognition is improving rapidly, we must ensure these technologies are assessed for accuracy and bias.”

The bill would require companies to notify consumers when FR is being used. It also requires third-party testing and human review of technologies before they are implemented to address accuracy and bias issues and avoid harm to consumers.

The bill restricts redistributing data to third-party entities without express consent from the end user. It also clearly defines data controllers and processors in order to clarify requirements for entities that either develop or vend FR products or services, store facial recognition data, or implement these technologies on a physical premise. The bill would require FR providers to meet data security, minimization, and retention standards set by the Federal Trade Commission and the National Institute of Standards and Technology.