Artificial Intelligence Facial Recognition

Section 1 of the bill creates a task force for the consideration of artificial intelligence (task force) and requires the task force to:

• Study issues relating to the use of artificial intelligence; and
• Submit a report on or before October 1, 2023, and on or before each October 1 thereafter, to the joint technology committee.

Section 2 repeals the task force, effective September 1, 2032, subject to a sunset review by the department of regulatory agencies.Section 3 adds new definitions of terms and renumbers existing definitions.Section 4 requires a state or local government agency (agency), including an institution of higher education , that uses or intends to develop, procure, or use a facial recognition service (FRS) to file with a reporting authority a notice of intent to develop, procure, or use the FRS and specify a purpose for which the technology is to be used. After filing the notice of intent, the agency must produce an accountability report that includes certain information and policies regarding the proposed use of the FRS. The bill establishes requirements for the adoption, implementation, and updating of accountability reports. Section 4 also requires an agency using an FRS to subject to meaningful human review any decisions that result from such use and produce legal effects concerning individuals or similarly significant effects concerning individuals. An agency must test the FRS in operational conditions before deploying the FRS in a context in which it will be used to make such decisions.

An agency using an FRS must conduct periodic training of all individuals who operate the FRS or who process personal data obtained from the FRS. An agency must maintain records that are sufficient to facilitate public reporting and auditing of compliance with the agency's facial recognition policies.

Section 4 also prohibits a law enforcement agency (LEA) from:

• Using an FRS to engage in ongoing surveillance, conduct real-time or near real-time identification, or start persistent tracking unless the LEA obtains a warrant authorizing such use, exigent circumstances exist, the LEA has established probable cause for such use , or the LEA obtains a court order authorizing the use of the service for the sole purpose of locating or identifying a missing person or identifying a deceased person;
• Applying an FRS to any individual based on the individual's religious, political, or social views or activities or any other characteristic protected by law;
• Using an FRS to create a record depicting any individual's exercise of rights guaranteed by the first amendment of the United States constitution and by section 10 of article II of the Colorado constitution;
• Using the results of an FRS as the sole basis to establish probable cause in a criminal investigation; or
• Using an FRS to identify an individual based on a sketch or other manually produced image; or
• Substantively manipulating an image for use in an FRS in a manner not consistent with the FRS provider's intended use and training.

An agency must disclose its use of an FRS on a criminal defendant to that defendant in a timely manner prior to trial. In January of each year:

• Any judge who has issued or extended a warrant for the use of an FRS during the preceding year, or who has denied approval of such a warrant during that year, must report certain information to the state court administrator; and
• Any agency that has applied for a warrant or an extension of a warrant for the use of an FRS to engage in any surveillance must provide to the agency's reporting authority a report summarizing nonidentifying demographic data of individuals named in warrant applications as subjects of surveillance.

Sections 5 and 6 prohibit the use of facial recognition services by any public school, charter school, or institute charter school until January 1, 2025.Section 7 states that an individual may authorize an agent to access and process the individual's personal data or other information held by a controller and that is otherwise accessible to the individual, and such an authorization does not constitute cybercrime.Sections 8 and 9 make conforming amendments.Section 10 makes an appropriation.

(Note: Italicized words indicate new material added to the original summary; dashes through words indicate deletions from the original summary.)

(Note: This summary applies to the reengrossed version of this bill as introduced in the second house.)