_____________ bill NO. _____________

INTRODUCED BY _________________________________________________

By Request of the ****

A BILL FOR AN ACT ENTITLED: "AN ACT requiring private entities to notice the use of facial recognition technology; providing RESTRICTIONS for the use of facial recognition technology; PROVIDING DEFINITIONS; and PROVIDING AN IMMEDIATE EFFECTIVE DATE."

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:

NEW SECTION. Section 1. Definitions. As used in [sections 1 and 2], unless the context clearly indicates otherwise, the following definitions apply:

(1) "Consent" means an affirmative act signifying an informed indication of a consumer's agreement, such as by a written statement, including by electronic means, or other clear affirmative action.

(2) "Consumer" means a person who is a Montana resident acting only in an individual or household context. It does not include a person acting in a commercial or employment context.

(3) "Controller" means the person that, alone or jointly with others, determines the purposes and means of the processing of personal data.

(4) "Enroll," "enrolled," or "enrolling" means the process by which a facial recognition service creates a facial template from one or more images of a consumer and adds the facial template to a gallery used by the facial recognition service for identification, verification, or persistent tracking of consumers. It also includes the act of adding an existing facial template directly into a gallery used by a facial recognition service.

(5) "Facial recognition service" means technology that analyzes facial features and is used for the identification, verification, or persistent tracking of consumers in still or video images.

(6) "Facial template" means the machine-interpretable pattern of facial features that is extracted from one or more images of a consumer by a facial recognition service.

(7) "Identification" means the use of a facial recognition service by a controller to determine whether an unknown consumer matches any consumer who has been enrolled in a gallery used by the facial recognition service.

(8) "Identified or identifiable" means that a person can be readily identified, directly or indirectly.

(9) "Persistent tracking" means the use of a facial recognition service to track the movements of a consumer on a persistent basis without recognition of that consumer. Such tracking becomes persistent as soon as:

(a) the facial template that permits the tracking uses a facial recognition service for more than 48 hours after the first enrolling of that facial template; or

(b) the data created by the facial recognition service are linked to any other data such that the consumer who has been tracked is identified or identifiable.

(10) "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal data does not include deidentified data or publicly available information. For purposes of this subsection, "publicly available information" means information that is lawfully made available from federal, state, or local government records.

(11) "Process" or "processing" means any operation or set of operations that are performed on personal data or on sets of personal data, whether or not by automated means, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.

(12) "Processor" means a natural or legal person who processes personal data on behalf of a controller.

(13) "Recognition" means the use of a facial recognition service to determine whether:

(a) an unknown consumer matches any consumer who has been enrolled in a gallery used by the facial recognition service; or

(b) an unknown consumer matches a specific consumer who has been enrolled in a gallery used by the facial recognition service.

(14) "Security or safety purpose" means physical security, protection of consumer data, safety, fraud prevention, or asset protection. The term does not include marketing, advertising, or other incentive programs.

(15) "Verification" means the use of a facial recognition service by a controller to determine whether a consumer is a specific consumer enrolled in a gallery used by the facial recognition service.

NEW SECTION. Section 2. Facial recognition on private premises. (1) A controller shall provide a conspicuous and contextually appropriate notice whenever a facial recognition service is deployed in a physical premise open to the public that includes, at minimum, the following:

(a) the purpose or purposes for which the facial recognition service is deployed; and

(b) information about where consumers can obtain additional information about the facial recognition service.

(2) A controller shall obtain consent from a consumer prior to enrolling an image of that consumer in a facial recognition service used in a physical premise open to the public.

(3) Except as provided in subsection (5), a controller may enroll an image of a consumer in a facial recognition service for a security or safety purpose without first obtaining consent from that consumer, provided that all of the following requirements are met:

(a) the controller must hold a reasonable suspicion, based on a specific incident, that the consumer has engaged in criminal activity, including but not limited to shoplifting, fraud, stalking, or domestic violence;

(b) a database used by a facial recognition service for identification, verification, or persistent tracking of consumers for a security or safety purpose must be used solely for that purpose and maintained separately from any other databases maintained by the controller;

(c) the controller shall review a database used by the controller's facial recognition service no less than annually to remove facial templates of consumers whom the controller no longer holds a reasonable suspicion that they have engaged in criminal activity; and

(d) the controller shall establish an internal process whereby a consumer may correct or challenge the decision to enroll the image of the consumer in a facial recognition service for a security or safety purpose.

(4) A controller using a facial recognition service to make decisions that produce legal effects on consumers shall ensure that those decisions are subject to meaningful human review.

(5) A controller may not knowingly disclose personal data obtained from a facial recognition service to a law enforcement agency, except when the disclosure is:

(a) pursuant to the consent of the consumer to whom the personal data relates;

(b) required by federal, state, or local law in response to a court order, court-ordered warrant, or subpoena or summons issued by a judicial officer or grand jury;

(c) necessary to prevent or respond to an emergency involving danger of death or serious physical injury to any person, upon a good faith belief by the controller; or

(d) to the national center for missing and exploited children, in connection with a report submitted to the center under 18 U.S.C. 2258A.

(6) Voluntary facial recognition services used to verify an aviation passenger's identity in connection with services regulated by the secretary of the United States department of transportation under 49 U.S.C. 41712 and exempt from state regulation under 49 U.S.C. 41713(b)(1) are exempt from this section. Images captured by an airline may not be retained for more than 24 hours. An airline facial recognition service shall disclose and obtain consent from the customer prior to capturing an image.

(7) As used in this section, "meaningful human review" means review or oversight by one or more individuals who are trained and who have the authority to alter the decision under review.

NEW SECTION. Section 3. Codification instruction. [Sections 1 and 2] are intended to be codified as an integral part of Title 46, chapter 5, and the provisions of Title 46, chapter 5, apply to [sections 1 and 2].

NEW SECTION. Section 4. Effective date. [This act] is effective on passage and approval.