§ 220 — Facial recognition searches; requests; valid purposes; documentation; reporting; exceptions

Section 220. (a) As used in this section, the following words shall, unless the context clearly requires otherwise, have the following meanings:''Biometric surveillance system'', any computer software that performs facial recognition or other remote biometric recognition.''Facial recognition'', an automated or semi-automated process that assists in identifying or verifying an individual or capturing information about an individual based on the physical characteristics of an individual's face, head or body, that uses characteristics of an individual's face, head or body to infer emotion, associations, activities or the location of an individual; provided, however, that ''facial recognition'' shall not include the use of search terms to sort images in a database.''Facial recognition search'', a computer search using facial recognition to attempt to identify an unidentified person by comparing an image containing the face of the unidentified person to a set of images of identified persons; provided, however, that a set of images shall not include moving images or video data.''Law enforcement agency'', as defined in section 1 of chapter 6E.''Other remote biometric recognition'', an automated or semi-automated process that assists in identifying or verifying an individual or capturing information about an individual based on an individual's gait, voice or other biometric characteristic or that uses such characteristics to infer emotion, associations, activities or the location of an individual; provided, however, that ''other remote biometric recognition'' shall not include the identification or verification of an individual using deoxyribonucleic acid, fingerprints, palm prints or other information derived from physical contact.''Public agency'', any: (i) agency, executive office, department, board, commission, bureau, division or authority of the commonwealth; (ii) political subdivision thereof; or (iii) authority established by the general court to serve a public purpose.''Public official'', any officer, employee, agent, contractor or subcontractor of any public agency.(b) Any law enforcement agency performing or requesting a facial recognition search using facial recognition technology shall only do so through a written request submitted to the registrar of motor vehicles, the department of state police or the Federal Bureau of Investigation. A law enforcement agency may perform such a facial recognition search for the following purposes: (i) to execute an order, issued by a court or justice authorized to issue warrants in criminal cases, based upon specific and articulable facts and reasonable inferences therefrom that provide reasonable grounds to believe that the information sought would be relevant and material to an ongoing criminal investigation or to mitigate a substantial risk of harm to any individual or group of people; or (ii) without an order to identify a deceased person or if the law enforcement agency reasonably believes that an emergency involving substantial risk of harm to any individual or group of people requires the performance of a facial recognition search without delay. Any emergency request shall be narrowly tailored to address the emergency and shall document the factual basis for believing that an emergency requires the performance of a facial recognition search without delay.This subsection shall not apply to the department of state police when performing investigatory functions related to the issuance of identification documents by the registrar of motor vehicles.(c) Law enforcement agencies shall document each facial recognition search performed and shall provide such documentation quarterly to the executive office of public safety and security. Such documentation shall include: (i) a copy of any written request made for a facial recognition search; (ii) the date and time of the request; (iii) the number of matches returned, if any; (iv) the database searched; (v) the name and position of the requesting individual and employing law enforcement agency; (vi) the reason for the request, including, but not limited to, any underlying suspected crime; (vii) the entity to which the request was submitted; and (viii) data detailing the individual characteristics included in the facial recognition request. Such documentation shall not be a public record, except for as provided for in (d).(d) Annually, not later than September 1, the executive office of public safety and security shall publish on its website documentation received from law enforcement agencies under subsection (c) and the following data for the previous calendar year: (i) the total number of facial recognition search requests made by other law enforcement agencies to the department of state police, disaggregated by law enforcement agency; (ii) the total number of facial recognition searches performed by the department of state police, disaggregated by law enforcement agency on whose behalf the search was performed; (iii) the total number of facial recognition searches requested and performed by the state police; (iv) the total number of facial recognition search requests made by the department of state police to the Federal Bureau of Investigation, disaggregated by law enforcement agency on whose behalf the requests were made; and (v) the total number of facial recognition searches performed by the Federal Bureau of Investigation on behalf of Massachusetts law enforcement agencies, disaggregated by law enforcement agency on whose behalf the search was performed. For each category of data and each law enforcement agency, the published information shall specify the number of requests made or searches performed pursuant to a court order, the number of emergency requests made or searches performed, and the reason for requesting the search, including, but not limited to, any underlying suspected crime.(e) Notwithstanding subsection (b), a law enforcement agency may: (i) acquire and possess personal electronic devices, such as a cell phone or tablet, that utilizes facial recognition technology for the sole purpose of user authentication; (ii) acquire, possess and use automated video or image redaction software; provided, that such software does not have the capability of performing facial recognition or other remote biometric recognition; and (iii) receive evidence related to the investigation of a crime derived from a biometric surveillance system; provided, that the use of a biometric surveillance system was not knowingly solicited by or obtained with the assistance of a public agency or any public official in violation of said subsection (b).