Time to Face the Country’s Strictest Facial Recognition Law

Companies that do business in Portland, Oregon may need to add one more item to their holiday to-do list: disable face recognition technologies in Portland.

Portland's new ordinance, which goes into effect on January 1, broadly prohibits the use of face recognition technologies by private entities in places of public accommodation. Violators can be sued and are subject to damages and other relief, including statutory damages of up to $1,000 per day of violation.

The one-of-a-kind ordinance bans private entities from using face recognition technologies to address concerns that they could be used in a way that is discriminatory or that could otherwise harm Black, Indigenous, and People of Color communities. The ordinance recognizes that the technology is improving, but seeks to implement "safeguards until better infrastructure and policies are in place."

What Does It Mean?

With some important exceptions discussed below, the ordinance states that no "Private Entity" may "use" any "Face Recognition Technologies" in "Places of Public Accommodation" in Portland. The ordinance might be interpreted to cover a wide range of companies, products, and services. For example:

Definition of "Face Recognition Technologies" 
The ordinance broadly defines "Face Recognition Technologies" to mean "automated or semi-automated processes using Face Recognition that assist in identifying, verifying, detecting, or characterizing facial features of an individual or capturing information about an individual based on an individual's face. "Face Recognition," in turn, is defined to mean "the automated searching for a reference image in an image repository by comparing the facial features of a probe image with the features of images contained in an image repository (one-to-many search)."

The scope of these definitions remains unclear. It seems likely that the authors intended the ordinance to apply to the types of technologies that have long been used by brick-and-mortar companies for security purposes. For example, some stores use face comparison technology to determine whether a shopper is someone who has shoplifted in the past. Those sorts of technologies typically involve the comparison of what might be considered "probe images" and "reference images" (to use the ordinance's language).

It is unclear how the ordinance's definition of "Face Recognition Technologies" would apply beyond that context. For example, to help manage capacity, some brick-and-mortar retailers may use technologies that merely count the number of faces in their stores, and emerging technology allows store owners and employers to automatically check to see whether patrons are wearing masks. Similarly, some online service providers use technologies that detect the presence of a face in an image to allow users to apply filters to those images. These new technologies may involve characterizing or detecting facial features or capturing information about a person based on their face. But because these sorts of technologies typically do not involve comparisons of probe images with reference images or any other kind of "one-to-many search," they may not fall within the ordinance's definition of "Face Recognition Technologies."

"Use" of Face Recognition Technologies
Importantly, the ordinance does not define what it means to "use" Face Recognition Technologies in Portland. Thus, for example, it remains an open question whether a company "uses" Face Recognition Technologies merely by providing products or services to consumers, or to other businesses, which then incorporate such technologies in services provided to Portland customers. Litigation under the ordinance may clarify the scope of the "use" limitation.

Definition of "Private Entity"
As noted above, the ordinance applies to any "Private Entity," which is defined broadly, as "any individual, sole proprietorship, partnership, corporation, limited liability company, association, or any other legal entity, however organized." The Ordinance excludes government agencies, but a different ordinance bans use of face recognition technology by City of Portland bureaus and offices.

Definition of "Places of Public Accommodation"
The ordinance defines "Places of Public Accommodation" to include "[a]ny place or service offering to the public accommodations, advantages, facilities, or privileges whether in the nature of goods, services, lodgings, amusements, transportation or otherwise." Notably, the definition specifically excludes "[a]n institution, bona fide club, private residence, or place of accommodation that is in its nature distinctly private."

Based on comments from Portland officials, the term "Places of Public Accommodation" was meant to encompass all places subject to the state of Oregon's definition and implementing regulations. Examples include establishments serving food or drink, sales or retail and service establishments, and places of recreation, public gathering, exercise, or entertainment. It is not yet clear whether this will include websites and online services that are open to the public.

Are There Exceptions?

Yes, and they are potentially significant. The ordinance expressly does not apply to the use of Face Recognition Technologies in the following circumstances:

• "To the extent necessary for a Private Entity to comply with federal, state, or local laws"
• "For user verification purposes by an individual to access the individual's own personal or employer issued communication and electronic devices"
• "In automatic face detection services in social media applications"

There is no blanket exception for consent, so it is unclear whether the ordinance will be interpreted to prohibit private entities from using face recognition technology in Portland even with the consent of people subject to the technology. Such a broad prohibition would likely be controversial, especially if the ordinance were also interpreted to extend to the online context, where Portland consumers may want the option to use technologies that incorporate face recognition technology.

What Should I Do Now?

All companies that use face recognition or face detection technology and that do business in Portland should consult with experienced counsel to determine how the ordinance applies to them and, if it does, whether they should change their practices. Similarly, any company that receives a complaint or demand under the ordinance should reach out to counsel immediately to explore available defenses.

Perkins Coie's experienced team of biometric law attorneys have deep experience advising clients on facial recognition technologies and litigating cases relating to biometric data and biometric privacy. If you would like further information, do not hesitate to reach out to biometrics@perkinscoie.com or contact one of the authors.

© 2020 Perkins Coie LLP