Section 103 – Government use of facial recognition system with image database — Restrictions — Process — Disclosure.

• (1) Except as provided in this section, in Section 77-23e-104, and in Section 77-23e-105, a government entity may not use a facial recognition system on an image database.

• (2)
  • (a)
    • (i) Only a law enforcement agency may make a request for a government entity to conduct a facial recognition comparison using a facial recognition system.
    • (ii) Except as provided in Subsection (2)(a)(iii), a law enforcement agency shall submit a request for a facial recognition comparison on an image database in writing to the government entity that manages the image database.
    • (iii) A law enforcement agency shall submit a request for a facial recognition comparison on an image database shared with or maintained by the department in accordance with Section 77-23e-104.
  • (b) A trained employee who is employed by the government entity that maintains or has access to the image database shall complete the request if the request:
    • (i) is for a purpose described in Subsection (2)(c);
    • (ii) includes a case identification number; and
    • (iii) is, if it is a request made for the purpose of investigating a crime, supported by a statement of the specific crime and factual narrative to support that there is a fair probability that the individual who is the subject of the request is connected to the crime.
  • (c) An individual described in Subsection (2)(b) shall only comply with requests made for a purpose of:
    • (i) investigating a felony, a violent crime, or a threat to human life; or
    • (ii) identifying an individual who is:
      • (A) deceased;
      • (B) incapacitated; or
      • (C) at risk and otherwise unable to provide the law enforcement agency with his or her identity.
  • (d) The law enforcement agency shall only use the facial recognition comparison:
    • (i) in accordance with the requirements of law; and
    • (ii) in relation to a purpose described in Subsection (2)(c).

• (3) A government entity may not use a facial recognition system for a civil immigration violation.

• (4) To make a facial recognition comparison, a trained employee described in Subsection (2)(b) shall:
  • (a) use a facial recognition system that, in accordance with industry standards:
    • (i) makes the comparison using an algorithm that compares only facial biometric data;
    • (ii) is secure; and
    • (iii) is produced by a company that is currently in business;
  • (b) if the facial recognition system indicates a possible match, make an independent visual comparison to determine whether the facial recognition system’s possible match is a probable match;
  • (c) if the trained employee determines that there is a possible match that is a probable match, seek a second opinion from another trained employee or the trained employee’s supervisor; and
  • (d)
    • (i) if the other trained employee or the trained employee’s supervisor agrees that the match is a probable match:
      • (A) report the result to the requesting law enforcement agency through an encrypted method; and
      • (B) return to the requesting law enforcement agency only a result that all trained employees agree is a probable match; or
    • (ii) if the other trained employee or the trained employee’s supervisor disagrees that there is a probable match, report the fact that the search returned no results to the requesting law enforcement agency.

• (5) When submitting a case to a prosecutor, a law enforcement agency of the state or of a political subdivision shall disclose to the prosecutor, in writing:
  • (a) whether a facial recognition system was used in investigating the case; and
  • (b) if a facial recognition system was used:
    • (i) the information the law enforcement agency received in accordance with Subsection (4)(d)(ii); and
    • (ii) a description of how the facial recognition comparison was used in the investigation.

Enacted by Chapter 200, 2021 General Session