Artificial Intelligence Facial Recognition

The act requires a state or local government agency (agency), including an institution of higher education, that uses or intends to develop, procure, or use a facial recognition service (FRS) to file with its reporting authority a notice of intent to develop, procure, or use the FRS and specify a purpose for which the technology is to be used. For a state agency, the reporting authority is the office of information technology in the governor's office; for a local government agency, the reporting agency is the city council, county commission, or other local government agency vested with legislative powers. After filing the notice of intent, the agency must produce an accountability report that includes certain information and policies regarding the proposed use of the FRS. The act establishes requirements for the adoption, implementation, disclosure, and updating of accountability reports.

The act also requires an agency using an FRS to subject to meaningful human review any decisions that result from such use and produce legal or similarly significant effects concerning individuals. An agency must test the FRS in operational conditions before deploying the FRS in a context in which it will be used to make such decisions.

An agency using an FRS must conduct periodic training of all individuals who operate the FRS or who process personal data obtained from the FRS. An agency must maintain records that are sufficient to facilitate public reporting and auditing of compliance with the agency's facial recognition policies.

The act also prohibits a law enforcement agency (LEA) from:

• Using an FRS to engage in ongoing surveillance; conduct real-time or near real-time identification; or start persistent tracking unless the LEA obtains a warrant authorizing such use, such use is necessary to develop leads in an investigation, the LEA has established probable cause for such use, or the LEA obtains a court order authorizing the use of the service for the sole purpose of locating or identifying a missing person or identifying a deceased person;
• Applying an FRS to any individual based on the individual's religious, political, or social views or activities; participation in a particular noncriminal organization or lawful event; or any other characteristic protected by law;
• Using an FRS to create a record depicting any individual's exercise of rights guaranteed by the first amendment of the United States constitution and by section 10 of article II of the Colorado constitution;
• Using the results of an FRS as the sole basis to establish probable cause in a criminal investigation; or
• Substantively manipulating an image for use in an FRS in a manner not consistent with the FRS provider's intended use and training.

An agency must disclose its use of an FRS on a criminal defendant to that defendant in a timely manner prior to trial. In January of each year:

• Any judge who has issued or extended a warrant for the use of an FRS during the preceding year, or who has denied approval of such a warrant during that year, must report certain information to the state court administrator; and
• Any agency that has applied for a warrant or an extension of a warrant for the use of an FRS to engage in any surveillance must provide to the agency's reporting authority a report summarizing nonidentifying demographic data of individuals named in warrant applications as subjects of surveillance.

The requirements of the act do not apply to:

• An agency that is required to use a specific FRS pursuant to a federal regulation or order or that uses an FRS in partnership with a federal agency to fulfill a congressional mandate, fulfill aviation security directives, or comply with federal law; that uses an FRS in association with a federal agency to verify the identity of individuals presenting themselves for travel at an airport; or that uses an FRS in connection with a physical access control system in order to grant or deny access to a sterile area of an airport;
• The use of an FRS solely for research purposes by a state agency, so long as the use does not result in or affect any decisions that produce legal effects concerning individuals or similarly significant effects concerning individuals; or
• A utility.

The act also prohibits a school district or a public school, charter school, or institute charter school from contracting with a vendor for the purchase of, or services related to, an FRS until July 1, 2025. However, the prohibition does not apply to a contract:

• That was executed before the effective date of the act; or
• For the purchase of, or for services related to, a generally available consumer product that allows for the analysis of facial features in order to facilitate the user's ability to manage an address book or images for personal or household use.

The act also creates a task force for the consideration of FRSs (task force) and requires the task force to examine and report to the joint technology committee of the general assembly concerning the extent to which state and local government agencies are currently using FRSs and provide recommendations concerning the extent to which such agencies should be permitted to continue to do so, including certain specific considerations. The task force must submit a report on or before October 1, 2023, and on or before each October 1 thereafter, to the joint technology committee. The report must include a recommendation as to whether the scope of the issues for study by the task force should be expanded to include consideration of artificial intelligence other than FRSs, or even artificial intelligence itself, and whether the membership of the task force should be adjusted accordingly. The task force is repealed, effective September 1, 2027, subject to a sunset review by the department of regulatory agencies.

The act also states that an individual may authorize an agent to access and process the individual's personal data or other information held by a controller and that is otherwise accessible to the individual, and such an authorization does not constitute cybercrime.

For the 2022-23 state fiscal year, the act appropriates $11,109 from the general fund to the legislative department.

(Note: This summary applies to this bill as enacted.)