,,ii #aafth ,,congress #ast ,session ,s4 #hdg ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #ad1 #bjai,mr4 ,blunt 7for himself and ,mr4 ,schatz7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to prohibit certain entities from using facial recognition technology to identify or track an end user without obtaining the affirmative consent of the end user1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,commercial ,facial ,recognition ,privacy ,act of #bjai4 #b4 ,definitions ,in this ,act3 7#a7 ,affirmative consent ,the term affirmative consent means the consent of an end user that involves an individual1 voluntary1 and explicit agreement to the collection and data use policies of a controller4 7#b7 ,controller ,the term controller means a covered entity that1 alone or jointly with others1 determines the purposes and means of the processing of facial recognition data4 7#c7 ,covered entity ,the term covered entity-- 7,a7 means any person1 including corporate affiliates1 that collects1 stores1 or processes facial recognition data2 and 7,b7 does not include-- 7i7 the ,federal ,government or any ,state or local government2 7ii7 a law enforcement agency2 7iii7 a national security agency2 or 7iv7 an intelligence agency4 7#d7 ,end user ,the term end user means an individual4 7#e7 ,facial recognition technology ,the term facial recognition technology means technology that-- 7,a7 analyzes facial features in still or video images2 and 7,b7 7i7 is used to assign a unique1 persistent identifier2 or 7ii7 is used for the unique personal identification of a specific individual4 7#f7 ,facial recognition data ,the term facial recognition data means any unique attribute or feature of the face of an end user that is used by facial recognition technology to assign a unique1 persistent identifier or for the unique personal identification of a specific individual4 7#g7 ,process ,the term process means any operation that is performed on facial recognition data1 including collection1 creation1 generation1 recording1 organization1 structuring1 storage1 adaptation1 alteration1 retrieval1 consultation1 use1 disclosure1 transfer1 dissemination or otherwise making available1 combination1 erasure1 or destruction4 7#h7 ,processor ,the term processor means a covered entity that processes facial recognition data on behalf of a controller4 7#i7 ,security application ,the term security application means loss prevention and any other application intended to detect or prevent criminal activity1 including shoplifting and fraud4 7#aj7 ,unaffiliated third party ,the term unaffiliated third party means any person other than-- 7,a7 a user of a product or service of a covered entity2 7,b7 an employee of a covered entity2 7,c7 a person under common control or ownership with a covered entity2 or 7,d7 a person to whom-- 7i7 an end user directed a covered entity to disclose information derived from facial recognition technology2 or 7ii7 information derived from facial recognition technology was disclosed with the affirmative consent of an end user4 #c4 ,prohibited conduct 7a7 ,in general ,except as provided in subsection 7e71 it shall be unlawful for a controller to knowingly-- 7#a7 use facial recognition technology to collect facial recognition data1 unless the controller-- 7,a7 obtains from an end user affirmative consent in accordance with subsection 7b72 and 7,b7 to the extent possible1 if facial recognition technology is present1 provides to the end user-- 7i7 a concise notice that facial recognition technology is present1 and1 if contextually appropriate1 where the end user can find more information about the use of facial recognition technology by the controller2 and 7ii7 documentation that includes general information that explains the capabilities and limitations of the facial recognition technology in terms that end users are able to understand2 7#b7 use the facial recognition technology to discriminate against an end user in violation of applicable ,federal or ,state law2 7#c7 repurpose facial recognition data for a purpose that is different from those presented to the end user under paragraph 7#a77;,a72 or 7#d7 share the facial recognition data with an unaffiliated third party without affirmative consent that is separate from the affirmative consent required under paragraph 7#a77;,a74 7b7 ,consent 7#a7 ,in general ,when obtaining affirmative consent1 a controller shall make available to an end user a notice that describes the specific practices of the processor in terms that end users are able to understand regarding the collection1 storage1 and use of facial recognition data1 including-- 7,a7 the reasonably foreseeable purposes1 or examples1 for which the processor collects and shares information derived from facial recognition technology or uses facial recognition technology2 7,b7 the data retention and deidentification practices of the processor2 and 7,c7 if the controller offers the ability to review1 correct1 or delete information derived from facial recognition technology1 the process to accomplish such actions4 7#b7 ,processor requirement ,if the processor and controller are not the same entity1 the processor shall make easily accessible to controllers the information required under paragraph 7#a74 7#c7 ,conditioning service on consent prohibited ,if the use of facial recognition technology is not necessary for a service1 no controller may-- 7,a7 condition the service on consent by an end user to waive privacy rights2 or 7,b7 terminate or refuse the service as a direct consequence of refusal by the end user to provide affirmative consent to the covered entity4 7c7 ,review ,a controller1 and the processor if applicable1 shall employ meaningful human review prior to making any final decision based on the output of facial recognition technology if the final decision-- 7#a7 may result in a reasonably foreseeable and material physical or financial harm to an end user2 or 7#b7 may be unexpected or highly offensive to a reasonable end user4 7d7 ,application programming interface ,a covered entity that makes a facial recognition technology available as an online service shall make available an application programming interface to enable at least #a third party that is legitimately engaged in independent testing to conduct reasonable tests of the facial recognition technology for accuracy and bias4 7e7 ,exceptions 7#a7 ,in general ,except as provided in paragraph 7#b71 subsections 7a77#a7 and 7b7 shall not apply to controllers that use-- 7,a7 an application that-- 7i7 is a product or service designed for personal file management or photo or video sorting or storage if the facial recognition technology is not used for unique personal identification of a specific individual2 7ii7 involves identification of public figures for journalistic media created for public interest2 7iii7 involves identification of public figures in copyrighted material for theatrical release2 or 7iv7 is used if there is an emergency involving imminent danger or risk of death or serious physical injury to an individual2 or 7,b7 facial recognition data to determine whether an end user has given affirmative consent if the controller immediately and permanently destroys the facial recognition data after determining that the end user has not given affirmative consent4 7#b7 ,security applications ,subsections 7a77#a77;,a7 and 7b7 shall not apply to controllers that use an application that is a security application4 7#c7 ,rule of construction ,nothing in paragraph 7#a77;,b7 may be construed to authorize the mass scanning of faces in spaces where end users do not have a reasonable expectation that facial recognition technology is being used on them4 #d4 ,enforcement 7a7 ,unfair or deceptive act or practice ,a violation of section #c shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7b7 ,powers of ,commission 7#a7 ,in general ,the ,federal ,trade ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7#b7 ,privileges and immunities ,any person who violates section #c shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7c7 ,enforcement by ,states 7#a7 ,in general ,if the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is being threatened or adversely affected by a practice that violates section #c1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to obtain appropriate relief4 7#b7 ,rights of ,commission 7,a7 ,notice to ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state1 before initiating a civil action under paragraph 7#a71 shall provide written notification to the ,commission that the attorney general intends to bring such civil action4 7ii7 ,contents ,the notification required under clause 7i7 shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required under clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7#c7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#d7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in-- 7i7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7ii7 another court of competent jurisdiction4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which-- 7i7 the defendant is an inhabitant1 may be found1 or transacts business2 or 7ii7 venue is proper under section #acia of title #bh1 ,united ,states ,code4 7#e7 ,actions by other ,state officials 7,a7 ,in general ,in addition to a civil action brought by an attorney general under paragraph 7#a71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7,b7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 #e4 ,regulations 7a7 ,regulations ,not later than #ahj days after the date of enactment of this ,act1 the ,federal ,trade ,commission1 in consultation with the ,national ,institute of ,standards and ,technology1 shall promulgate regulations1 in accordance with section #eec of title #e1 ,united ,states ,code-- 7#a7 describing data security1 minimization1 and retention standards to be met at a minimum by processors2 7#b7 defining what is harmful and highly offensive under paragraphs 7#a7 and 7#b7 of section #c7;c72 and 7#c7 expanding the list of exceptions described in section #c7;e7 in cases where it is impossible for a controller to obtain affirmative consent from1 or provide notice to1 end users4 7b7 ,considerations ,in promulgating regulations under subsection 7a71 the ,commission shall consider1 among other factors-- 7#a7 the size of the processor2 7#b7 the complexity of the offerings of the processor2 and 7#c7 the nature and scope of the activities of the processor4 #f4 ,relation to ,state laws 7a7 ,in general ,this ,act shall not be construed as superseding1 altering1 or affecting any statute1 regulation1 order1 or interpretation in effect in any ,state1 except to the extent that such statute1 regulation1 order1 or interpretation is inconsistent with the provisions of this ,act1 and then only to the extent of the inconsistency4 7b7 ,greater protection under ,state law ,for purposes of this ,act1 a ,state statute1 regulation1 order1 or interpretation is not inconsistent with the provisions of this subtitle if the protection such statute1 regulation1 order1 or interpretation affords any person is greater than the protection provided under this ,act1 as determined by the ,federal ,trade ,commission4 #g4 ,relation to other privacy and security laws ,nothing in this ,act may be construed to-- 7#a7 modify1 limit1 or supersede the operation of any privacy or security provision in any other ,federal or ,state law 7including regulations72 or 7#b7 limit the authority of the ,commission under any other provision of law4 #h4 ,effective date ,this ,act shall take effect on the date that is #ahj days after the date of enactment of this ,act4