```

[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[S. 5334 Introduced in Senate (IS)]

<DOC>

117th CONGRESS
  2d Session
                                S. 5334

 To establish best practices for the Federal use of facial recognition 
                  technology, and for other purposes.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                           December 21, 2022

  Mr. Portman introduced the following bill; which was read twice and 
referred to the Committee on Homeland Security and Governmental Affairs

_______________________________________________________________________

                                 A BILL

 
 To establish best practices for the Federal use of facial recognition 
                  technology, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Facial, 
Accountability, Clarity, and Efficiency in Technology Act'' or the 
``FACE IT Act''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Definitions.
TITLE I--ESTABLISHING BEST PRACTICES FOR CURRENT FEDERAL USE OF FACIAL 
                         RECOGNITION TECHNOLOGY

Sec. 101. Disclosure of Federal uses of facial recognition technology.
Sec. 102. Accuracy requirements for the procurement of facial 
                            recognition technology.
Sec. 103. Requirement for procurement of facial recognition technology.
Sec. 104. Disclosure of high risk use case.
Sec. 105. Requirement of human involvement in facial recognition 
                            technology decisionmaking.
Sec. 106. United States person notice and opt-out for non-investigative 
                            uses of facial recognition technology.
Sec. 107. Guarantee of constitutional rights.
Sec. 108. Database access restrictions for Federal use of facial 
                            recognition technology.
Sec. 109. Notification for criminal defendants.
Sec. 110. Rule of construction for facial recognition technology that 
                            is not high risk.
Sec. 111. Limitation to civilian agencies.
 TITLE II--DEVELOPING BEST PRACTICES FOR FUTURE FEDERAL USE OF FACIAL 
                         RECOGNITION TECHNOLOGY

Sec. 201. Establishment of a Federal Advisory Committee on Facial 
                            Recognition Technology.
Sec. 202. Membership of the Federal Advisory Committee on Facial 
                            Recognition Technology.
Sec. 203. Meetings of the Federal Advisory Committee on Face 
                            Recognition Technology.
Sec. 204. Authorization of appropriations.
                            TITLE III--FOIA

Sec. 301. Applicability of FOIA.

SEC. 2. DEFINITIONS.

    In this Act--
            (1) the term ``Advisory Committee'' means the Federal 
        Advisory Committee on Facial Recognition Technology established 
        under section 201(a);
            (2) the term ``applicable congressional committee'' means--
                    (A) the Committee on Homeland Security and 
                Governmental Affairs, the Committee on Commerce, 
                Science, and Transportation, and the Committee on the 
                Judiciary of the Senate; and
                    (B) the Committee on Homeland Security, the 
                Committee on Energy and Commerce, the Committee on 
                Oversight and Reform, the Committee on Science, Space, 
                and Technology, and the Committee on the Judiciary of 
                the House of Representatives;
            (3) the term ``Director'' means the Director of the Office 
        of Management and Budget;
            (4) the term ``facial recognition technology'' means an 
        automated or semi-automated process of--
                    (A) generating a mathematical representation of an 
                individual's face, known as a probe face template; and
                    (B)(i) querying a gallery populated with many face 
                templates that may be linked to personally identifiable 
                information and subsequently returning an identity if 
                the similarity of the probe face template to any face 
                template in the gallery is above a specified threshold; 
                or
                    (ii) comparing the probe face template to a 
                specific face template of an existing image of the 
                individual to verify their identity;
            (5) the term ``Federal agency'' has the meaning given the 
        term ``agency'' in section 3502 of title 44, United States 
        Code;
            (6) the term ``high risk'', with respect to a use case, 
        means one in which face recognition query outputs influence the 
        decision to--
                    (A) arrest or convict an individual, deny an 
                individual access to government services to which the 
                individual is legally entitled; or
                    (B) take other action that directly impacts the 
                fundamental rights or equal protection of that 
                individual under the law;
            (7) the term ``intelligence community'' has the meaning 
        given the term in section 3 of the National Security Act of 
        1947 (50 U.S.C. 3003);
            (8) the term ``Secretary'' means the Secretary of Homeland 
        Security;
            (9) the term ``use case''--
                    (A) means a description of the ways and 
                circumstances in which a technology is operated to 
                perform a specific function; and
                    (B) does not include research programs that use 
                Institutional Review Board informed consent; and
            (10) the term ``security use case'' means the ways and 
        circumstances in which a technology is operated to perform a 
        specific function related to--
                    (A) conducting a criminal investigation;
                    (B) protecting national security;
                    (C) monitoring and preventing unauthorized access 
                to Federal buildings; or
                    (D) detecting or combating fraud or other illegal 
                activity.

TITLE I--ESTABLISHING BEST PRACTICES FOR CURRENT FEDERAL USE OF FACIAL 
                         RECOGNITION TECHNOLOGY

SEC. 101. DISCLOSURE OF FEDERAL USES OF FACIAL RECOGNITION TECHNOLOGY.

    (a) In General.--Not later than 270 days after the date of 
enactment of this Act, and biannually thereafter, the Director shall 
submit to the applicable congressional committees a report on all 
Federal Government programs that use face recognition technology.
    (b) Execution of Report.--In order to facilitate the submission of 
the report under subsection (a), the head of each Federal agency shall 
provide necessary information to the Director at the request of the 
Director.
    (c) Contents.--Each report submitted under subsection (a) shall 
include--
            (1) a description of each facial recognition technology use 
        case deployed by a Federal agency;
            (2) an evaluation of how facial recognition technologies 
        deployed by a Federal agency comply with the accuracy 
        requirements under section 102;
            (3) a list of the private sector entities which provide 
        facial recognition technologies to each Federal agency for each 
        use case;
            (4) a list of the State, local, and Tribal government 
        agencies and entities that provide access to facial recognition 
        technologies to each Federal agency for each use case;
            (5) the databases that facial recognition technology 
        queries for each Federal agency for each use case and, if 
        applicable, the authorization allowing access to privately 
        owned and maintained databases;
            (6) an explanation of the reasons, with quantitative 
        rationales where possible, for using facial recognition 
        technology for each use case;
            (7) for each use case described in paragraph (1), an 
        enumeration of whether the use case is high risk; and
            (8) any additional information the Director determines 
        appropriate.
    (d) Form of Report.--Each report required under subsection (a) 
shall be submitted in an unclassified form, but may contain a 
classified annex.

SEC. 102. ACCURACY REQUIREMENTS FOR THE PROCUREMENT OF FACIAL 
              RECOGNITION TECHNOLOGY.

    (a) Development of Accuracy Requirements.--Not later than 1 year 
after the first report is submitted under section 101(a), the Director 
of the National Institute for Standards and Technology and the 
Secretary, in consultation with the Director of the Office of Science 
and Technology Policy and other agencies and entities as appropriate, 
shall develop minimum accuracy requirements, specific to each Federal 
agency, for use cases of facial recognition technology in the Federal 
Government as determined in the report.
    (b) Development of Accuracy Requirements for High Risk Use Cases.--
In developing the requirements under subsection (a), the Director of 
the National Institute for Standards and Technology shall ensure that 
the requirements for the use cases identified as high risk shall be 
more strict than the requirements for the uses cases that are not high 
risk.
    (c) Certification for the Accuracy Standards.--The head of each 
Federal agency shall develop a process to ensure that, with the 
exception of research and testing, the facial recognition technology 
used by the Federal agency meets the relevant requirements established 
under subsection (a).
    (d) Accuracy Across Demographic Groups.--The requirements under 
subsection (a) shall include minimum accuracy requirements for 
individuals regardless of different skin tone or race, disability 
status, age, or sex, alone and in combination, to ensure that facial 
recognition technology can accurately identify diverse individuals.
    (e) Transparency Requirements.--Not later than 30 days after the 
date on which the requirements are developed under subsection (a), the 
Director of the National Institute for Standards and Technology shall 
make such requirements available on a public website.

SEC. 103. REQUIREMENT FOR PROCUREMENT OF FACIAL RECOGNITION TECHNOLOGY.

    (a) In General.--Except as provided in subsection (c), before a 
Federal agency procures or acquires a facial recognition technology, 
the Federal agency shall--
            (1) publicly report testing and performance results from 
        the Face Recognition Vendor Testing Program of the National 
        Institute of Standards and Technology or other reputable 
        testing authority in a manner that is compatible with Global 
        Reporting Initiative 102 requirements for the facial 
        recognition systems that the Federal agency aims to procure or 
        acquire;
            (2) certify to the Director that the technology shall meet 
        the accuracy requirements developed under section 102; and
            (3) include the certification described in paragraph (1) in 
        the next report required under section 101.
    (b) Limitation on Procurement of Facial Recognition.--
            (1) In general.--On and after the date on which the 
        accuracy requirements are developed under section 102(a), the 
        head of a Federal agency shall not procure or acquire facial 
        recognition technology that does not meet the requirements 
        under subsection (a).
            (2) Acquisitions before development of accuracy 
        requirements.--The head of a Federal agency--
                    (A) may procure or acquire facial recognition 
                technology before the date described in paragraph (1); 
                and
                    (B) if the head of the Federal agency procures or 
                acquires technology described in subparagraph (A), 
                shall ensure that the technology meets the requirements 
                under subsection (a) not later than 1 year after the 
                date on which the accuracy requirements are developed 
                under section 102(a).
    (c) Exceptions.--The requirements under subsection (a) shall not 
apply to a facial recognition algorithm software update, enhancement, 
derivative, correction, defect, or fix, or research program exempted 
under section 102.

SEC. 104. DISCLOSURE OF HIGH RISK USE CASE.

    (a) Testing and Transparency for High Risk Use Cases.--Not later 
than 30 days after a report required under section 101 is submitted, 
each Federal agency shall report on a publicly available and easily 
accessible Federal website the testing and performance results of the 
relevant facial recognition algorithm from the Face Recognition Vendor 
Testing Program of the National Institute of Standards and Technology 
or other reputable testing authority for high risk use cases.
    (b) Updates.--Each Federal agency shall update the results 
published under subsection (a) following the identification of new high 
risk use cases in subsequent reports submitted under section 101.

SEC. 105. REQUIREMENT OF HUMAN INVOLVEMENT IN FACIAL RECOGNITION 
              TECHNOLOGY DECISIONMAKING.

    (a) In General.--A Federal agency shall not take any adverse final 
action to an identified or verified individual that was based on a 
query output from facial recognition technology deployed by that 
Federal agency unless a human person has reviewed the facial 
recognition technology query output and documented the human 
involvement in the process.
    (b) Qualifications for High Risk Use Cases.--With respect to a high 
risk use case, the individual described in subsection (a) shall be 
qualified in accordance with the relevant training standards developed 
by the Face Identification Scientific Working Group for particular use 
cases.

SEC. 106. UNITED STATES PERSON NOTICE AND OPT-OUT FOR NON-INVESTIGATIVE 
              USES OF FACIAL RECOGNITION TECHNOLOGY.

    (a) In General.--A Federal agency that uses facial recognition 
technology for a purpose other than a criminal investigation or other 
security use case, such as identity verification, shall--
            (1) notify the United States person that they are or were 
        subject to identity verification by facial recognition 
        technology; and
            (2) provide the United States person an alternative method 
        of identity verification that does not involve the use of 
        facial recognition technology.
    (b) Publication of Opt-Out Availability.--Federal agencies using 
facial recognition technology in a manner described in subsection (a) 
shall communicate to a United States person subject to the use of 
facial recognition technology that the United States person can elect 
to verify their identity using an alternative method that does not 
involve the use of facial recognition technology.
    (c) Simplicity of the Opt-Out.--For United States persons that 
exercise the rights under subsection (b), Federal agencies shall not 
impose a burden for opting out that is substantially greater than the 
person would experience by using facial recognition technology.

SEC. 107. GUARANTEE OF CONSTITUTIONAL RIGHTS.

    A Federal agency shall not use facial recognition technology to 
violate any rights guaranteed by the Constitution of the United States.

SEC. 108. DATABASE ACCESS RESTRICTIONS FOR FEDERAL USE OF FACIAL 
              RECOGNITION TECHNOLOGY.

    No component, official, or personnel of a Federal agency shall use 
facial recognition technology to access a privately owned and 
maintained database without prior authorization from the head of the 
Federal agency, with the exception of a database used for a research 
and testing program.

SEC. 109. NOTIFICATION FOR CRIMINAL DEFENDANTS.

    Any criminal defendant, or a counsel thereof, identified through an 
investigative process that used facial recognition technology in the 
course of the investigation that led to identifying the defendant by 
the Federal agency conducting the investigative process shall receive 
notice that facial recognition technology was used in the investigative 
process.

SEC. 110. RULE OF CONSTRUCTION FOR FACIAL RECOGNITION TECHNOLOGY THAT 
              IS NOT HIGH RISK.

    Nothing in this title shall be construed to diminish any Federal 
requirements with respect to face recognition technology that is not 
classified as high risk.

SEC. 111. LIMITATION TO CIVILIAN AGENCIES.

    Nothing in this title shall apply to the Department of Defense or 
any element of the intelligence community.

 TITLE II--DEVELOPING BEST PRACTICES FOR FUTURE FEDERAL USE OF FACIAL 
                         RECOGNITION TECHNOLOGY

SEC. 201. ESTABLISHMENT OF A FEDERAL ADVISORY COMMITTEE ON FACIAL 
              RECOGNITION TECHNOLOGY.

    (a) Establishment.--The Director, in consultation with the 
Secretary, the Director of the National Institute for Standards and 
Technology, and the head of any other Federal agency that the Director 
determines appropriate, shall establish a Federal advisory committee on 
the use of facial recognition technology to be known as the ``Federal 
Advisory Committee on Facial Recognition Technology'' to advise Federal 
agencies on matters related to the use of facial recognition 
technology.
    (b) Purposes of the Advisory Committee.--The Advisory Committee 
shall advise the Federal agencies on--
            (1) opportunities to deploy facial recognition technology 
        to improve the effectiveness of the Federal Government;
            (2) the risks associated with the use of facial recognition 
        technology in different use cases;
            (3) the ways that Federal agencies can improve the safety 
        and reliability of facial recognition technology, including 
        through research and development funding to support face 
        recognition technology innovation;
            (4) the ethics of facial recognition technology and its 
        use, including mitigating potential bias associated with the 
        use of facial recognition;
            (5) protections for privacy, civil liberties, civil rights, 
        and information security when using facial recognition;
            (6) the ways that Federal agencies can manage, track, and 
        resolve facial recognition failure rates relating to skin 
        complexion or color;
            (7) trends in the use of facial recognition technology;
            (8) any necessary updates to the list of high risk use 
        cases that should be enumerated in the biannual reports 
        required under section 101(a);
            (9) requirements for monitoring and documenting any Federal 
        agency use of facial recognition technology that the Federal 
        Government does not own for a high risk use case; and
            (10) any other safeguards necessary, including audit and 
        compliance procedures, standards, and training programs, to 
        ensure the safe and reliable deployment of new facial 
        recognition systems not currently used by the Federal 
        Government.
    (c) Annual Report.--Not later than 1 year after the date of 
enactment of this Act and every year thereafter, the Director shall 
submit a report on the activities of the of the Advisory Committee and 
any guidance provided to Federal agencies on matters related to the use 
of facial recognition technology to--
            (1) the Committee on Homeland Security and Governmental 
        Affairs of the Senate;
            (2) the Committee on Commerce, Science, and Transportation 
        of the Senate;
            (3) the Committee on Homeland Security of the House of 
        Representatives;
            (4) the Committee on Oversight and Reform of the House of 
        Representatives; and
            (5) the Committee on Science, Space, and Technology of the 
        House of Representatives.

SEC. 202. MEMBERSHIP OF THE FEDERAL ADVISORY COMMITTEE ON FACIAL 
              RECOGNITION TECHNOLOGY.

    (a) In General.--The Advisory Committee shall be composed of 17 
members who shall be appointed by the Secretary in addition to the 
representatives listed in subsection (c).
    (b) Representation.--In carrying out subsection (a), the Secretary 
shall ensure that members are appointed as follows:
            (1) 4 members from private industry, including small 
        businesses.
            (2) 4 members from the academic or research community who 
        are computer scientists or otherwise primarily technical 
        experts in the science and engineering behind facial 
        recognition technology.
            (3) 4 members from civil society, including individuals 
        that advocates for privacy, civil liberties, or civil rights.
            (4) 1 member from the Biometric and Identity Technology 
        Center of the Department of Homeland Security.
            (5) 1 member from the Face Identification Scientific 
        Working Group.
            (6) 1 member from the Face Identification Subcommittee of 
        the Organization of Scientific Area Committees for Forensic 
        Science of the National Institute of Standards and Technology.
    (c) Ex-Officio Representation.--The Advisory Committee shall be 
composed of 1 ex-officio representative knowledgeable in biometric 
risks, benefits, programs, policies, operations, and applications 
from--
            (1) the National Institute of Standards and Technology;
            (2) the Department of Commerce;
            (3) the General Services Administration;
            (4) the Department of Justice;
            (5) the Department of Homeland Security;
            (6) the Department of State;
            (7) the Department of Education;
            (8) the Department of Energy;
            (9) the Transportation Security Administration;
            (10) the Department of Veterans Affairs;
            (11) U.S. Customs and Border Protection;
            (12) U.S. Immigration and Customs Enforcement;
            (13) the Federal Emergency Management Agency;
            (14) the Office of Biometric Identity Management;
            (15) the National Science Foundation;
            (16) the National Science and Technology Council;
            (17) the Office of Science and Technology Policy; and
            (18) such other Federal agencies as the Secretary considers 
        appropriate.
    (d) Chairperson.--The Secretary shall appoint a chairperson for the 
Advisory Committee from among the members appointed under subsection 
(a).

SEC. 203. MEETINGS OF THE FEDERAL ADVISORY COMMITTEE ON FACE 
              RECOGNITION TECHNOLOGY.

    (a) Meetings.--The Advisory Committee shall meet in person, or by 
telepresence, not less frequently than twice per year.
    (b) Powers.--In order to carry out its duties under section 201, 
the Advisory Committee shall--
            (1) hold such hearings, sit and act at such times and 
        places, take such testimony, and receive such evidence as the 
        Advisory Committee considers appropriate;
            (2) submit to Federal agencies such recommendations as the 
        Advisory Committee considers appropriate;
            (3) issue reports, guidelines, and memoranda;
            (4) hold or host conferences and symposia;
            (5) establish subcommittees; and
            (6) establish rules of procedure.
    (c) Travel Expenses.--The members of the Advisory Committee shall 
be allowed travel expenses, including per diem in lieu of subsistence, 
at rates authorized for employees of Federal agencies under subchapter 
I of chapter 57 of title 5, United States Code, while away from their 
homes or regular places of business in the performance of services for 
the Advisory Committee.

SEC. 204. AUTHORIZATION OF APPROPRIATIONS.

    There is authorized to be appropriated such sums as may be 
necessary to carry out the requirements of this title.

                            TITLE III--FOIA

SEC. 301. APPLICABILITY OF FOIA.

    Nothing in this Act, or in a report produced under section 101, 
shall be construed to allow the disclosure of information or a record 
that is exempt from public disclosure under section 552 of title 5, 
United States Code (commonly known as the ``Freedom of Information 
Act'').
                                 <all>
```