Virginia SB 741: Facial recognition technology; authorized uses.

Bill Text

VIRGINIAACTSOFASSEMBLY--2022RECONVENEDSESSION
CHAPTER737
An Act to amend and reenact §§ 15.2-1723.2 and 23.1-815.1 of the Code of Virginia and to amend the
Code of Virginia by adding a section numbered 52-4.5, relating to facial recognition technology;
Department of State Police and authorized uses; report; penalty.
[S741]
ApprovedApril27,2022
Be it enacted by the General Assembly of Virginia:
1. That §§ 15.2-1723.2 and 23.1-815.1 of the Code of Virginia are amended and reenacted and that
the Code of Virginia is amended by adding a section numbered 52-4.5 as follows:
§15.2-1723.2. Facial recognition technology; approval; penalty.
A. For purposes of this section, "facial:
"Authorized use" means the use of facial recognition technology to (i) help identify an individual
when there is a reasonable suspicion the individual has committed a crime; (ii) help identify a crime
victim, including a victim of online sexual abuse material; (iii) help identify a person who may be a
missing person or witness to criminal activity; (iv) help identify a victim of human trafficking or an
individual involved in the trafficking of humans, weapons, drugs, or wildlife; (v) help identify an online
recruiter of criminal activity, including but not limited to human, weapon, drug, and wildlife trafficking;
(vi) help a person who is suffering from a mental or physical disability impairing his ability to
communicate and be understood; (vii) help identify a deceased person; (viii) help identify a person who
is incapacitated or otherwise unable to identify himself; (ix) help identify a person who is reasonably
believed to be a danger to himself or others; (x) help identify an individual lawfully detained; (xi) help
mitigate an imminent threat to public safety, a significant threat to life, or a threat to national security,
including acts of terrorism; (xii) ensure officer safety as part of the vetting of undercover law
enforcement; (xiii) determine whether an individual may have unlawfully obtained one or more state
driver's licenses, financial instruments, or other official forms of identification using information that is
fictitious or associated with a victim of identity theft; or (xiv) help identify a person who an officer
reasonably believes is concealing his true identity and about whom the officer has a reasonable
suspicion has committed a crime other than concealing his identity.
"Facial recognition technology" means an electronic system or service for enrolling, capturing,
extracting, comparing, and matching an individual's geometric facial data to identify individuals in
photos, videos, or real time conducting an algorithmic comparison of images of a person's facial
features for the purpose of identification. "Facial recognition technology" does not include the use of an
automated or semi-automated process to redact a recording in order to protect the privacy of a subject
depicted in the recording prior to release or disclosure of the recording outside of the law-enforcement
agency if the process does not generate or result in the retention of any biometric data or surveillance
information.
"Publicly post" means to post on a website that is maintained by the entity or on any other website
on which the entity generally posts information and that is available to the public or that clearly
describes how the public may access such data.
"State Police Model Facial Recognition Technology Policy" means the model policy developed and
published by the Department of State Police pursuant to §52-4.5.
B. No Pursuant to § 2.2-1112, the Division of Purchases and Supply (the Division) shall determine
the appropriate facial recognition technology for use in accordance with this section. The Division shall
not approve any facial recognition technology unless it has been evaluated by the National Institute of
Standards and Technology (NIST) as part of the Face Recognition Vendor Test. Any facial recognition
technology utilized shall utilize algorithms that have demonstrated (i) an accuracy score of at least 98
percent true positives within one or more datasets relevant to the application in a NIST Face
Recognition Vendor Test report and (ii) minimal performance variations across demographics associated
with race, skin tone, ethnicity, or gender. The Division shall require all approved vendors to annually
provide independent assessments and benchmarks offered by NIST to confirm continued compliance with
this section.
C. A local law-enforcement agency shall purchase or deploy may use facial recognition technology
unless such purchase or deployment of facial recognition technology is expressly authorized by statute
for authorized uses. For purposes of this section, a statute that does not refer to facial recognition
technology shall not be construed to provide express authorization. Such statute shall require that any
facial recognition technology purchased or deployed by the local law-enforcement agency be maintained
under the exclusive control of