§ 77-23e-103 — Government use of facial recognition system with image database -- Restrictions -- Process -- Disclosure.

(1) Except as provided in this section, in Section 77-23e-104, and in Section 77-23e-105, a government entity may not use a facial recognition system on an image database.
(2) (2)(a) (2)(a)(i) Only a law enforcement agency may make a request for a government entity to conduct a facial recognition comparison using a facial recognition system.
(2)(a)(ii) Except as provided in Subsection (2)(a)(iii), a law enforcement agency shall submit a request for a facial recognition comparison on an image database in writing to the government entity that manages the image database.
(2)(a)(iii) A law enforcement agency shall submit a request for a facial recognition comparison on an image database shared with or maintained by the department in accordance with Section 77-23e-104.
(2)(b) A trained employee who is employed by the government entity that maintains or has access to the image database shall complete the request if the request:
(2)(b)(i) is for a purpose described in Subsection (2)(c);
(2)(b)(ii) includes a case identification number; and
(2)(b)(iii) is, if it is a request made for the purpose of investigating a crime, supported by a statement of the specific crime and factual narrative to support that there is a fair probability that the individual who is the subject of the request is connected to the crime.
(2)(c) An individual described in Subsection (2)(b) shall only comply with requests made for a purpose of:
(2)(c)(i) investigating a felony, a violent crime, or a threat to human life; or
(2)(c)(ii) identifying an individual who is:

(2)(c)(ii)(A) deceased;
(2)(c)(ii)(B) incapacitated; or
(2)(c)(ii)(C) at risk and otherwise unable to provide the law enforcement agency with his or her identity.
(2)(d) The law enforcement agency shall only use the facial recognition comparison:
(2)(d)(i) in accordance with the requirements of law; and
(2)(d)(ii) in relation to a purpose described in Subsection (2)(c).
(3) A government entity may not use a facial recognition system for a civil immigration violation.
(4) To make a facial recognition comparison, a trained employee described in Subsection (2)(b) shall:

(4)(a) use a facial recognition system that, in accordance with industry standards:
(4)(a)(i) makes the comparison using an algorithm that compares only facial biometric data;
(4)(a)(ii) is secure; and
(4)(a)(iii) is produced by a company that is currently in business;
(4)(b) if the facial recognition system indicates a possible match, make an independent visual comparison to determine whether the facial recognition system's possible match is a probable match;
(4)(c) if the trained employee determines that there is a possible match that is a probable match, seek a second opinion from another trained employee or the trained employee's supervisor; and
(4)(d) (4)(d)(i) if the other trained employee or the trained employee's supervisor agrees that the match is a probable match:

(4)(d)(i)(A) report the result to the requesting law enforcement agency through an encrypted method; and
(4)(d)(i)(B) return to the requesting law enforcement agency only a result that all trained employees agree is a probable match; or
(4)(d)(ii) if the other trained employee or the trained employee's supervisor disagrees that there is a probable match, report the fact that the search returned no results to the requesting law enforcement agency.
(5) When submitting a case to a prosecutor, a law enforcement agency of the state or of a political subdivision shall disclose to the prosecutor, in writing:

(5)(a) whether a facial recognition system was used in investigating the case; and
(5)(b) if a facial recognition system was used:
(5)(b)(i) the information the law enforcement agency received in accordance with Subsection (4)(d)(ii); and
(5)(b)(ii) a description of how the facial recognition comparison was used in the investigation.

Legislative History

Enacted by Chapter 200, 2021 General Session