California’s newest privacy law may soon protect more than just our personal information. If a proposed amendment to the California Consumer Privacy Act ends up passing, the legislature will add new protections to the CCPA that restrict the use of facial recognition technology by California companies.
Proposed amendment AB 1281 would make it mandatory for all businesses that use facial recognition technology to post “clear and conspicuous” signs at the entrance of every location that uses such technology.
The bill defines facial recognition technology as “a software application that analyzes facial features from a digital image or video for the purpose of automatically identifying a specific individual.”
The “clear and conspicuous” requirement is defined as “larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols and other marks that call attention to the language.” The signage must also be in such a location where consumers can read the sign, understand what it means, and decide whether to proceed or not before entering a location where the facial recognition technology is in use.
Damages under this section are set at $75 per violation, capped at $7,500 per year, with an additional penalty of up to $5,000 in the case of a “knowing or willful” violation.
According to the Senate Judiciary Committee’s July 1, 2019 comments, AB 1281 is an attempt to further protect Californians’ constitutional right to privacy:
Article I, Section 1 of the California Constitution provides: “All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.” Privacy is therefore not just a policy goal; it is a constitutional right of every Californian. However, it has been under increasing assault. The increasing use of various forms of surveillance, while providing myriad benefits, raises troubling concerns about the systematic invasion of Californian’s privacy.
Still, how much AB 1281 actually protects privacy remains to be seen. The most interesting part of AB 1281 is not what is in the text, but what is not.
When AB 1281 was first introduced, it specifically set out that violation of this section would constitute “unfair competition” under section 17200, et seq., of the California Business & Professions Code. This would have essentially created a private right of action, allowing any victim of wrongful use of facial recognition technology to sue on their own behalf. This was subsequently removed, and now enforcement can only come from the government at the state, county, or city level. This is not the first time a private right of action under the CCPA was killed in committee.
Similarly, in the April 2, 2019 amendment, the damages cap was set at $7,500 (plus $5,000 for willful violations) or up to 1% of the business’s net income, whichever is higher. This was then stripped out, setting a hard cap at $7,500 (plus $5,000 for willful violations). Serendipitously, the California Retailers Association pulled its opposition to AB 1281 shortly thereafter.
With these protections stripped out, AB 1281 now has some strong opponents: the ACLU, the Electronic Frontier Foundation, and Privacy Rights Clearinghouse. The Senate Judiciary Committee quotes the three organizations, who warn against a potential future where facial recognition has gone too far, in which shop owners require potential patrons to allow their faces to be scanned and may refuse to open the doors of their store if something negative pops up. They also warn that the sections stripped out of AB 1281 render it effectively toothless:
Your bill permits businesses in California to use facial recognition technology so long as they merely disclose the usage of facial recognition technology in a physical sign at the entrance of every location that uses facial recognition technology. Moreover, violation of even this negligible requirement could not be remedied by the person whose biometric information was taken; compliance could be enforced only if a public prosecutor had the willingness and wherewithal to seek a civil penalty. Even then, no recovery would go to the person whose rights were violated, contrary to the custom and tradition of every meaningful privacy and consumer protection law.
Posting a sign is little or no protection against the use of this powerful and intrusive technology. Such signs would likely become as ubiquitous and ignored as Prop. 65 notices are now, particularly when consumers have no effective way to guard against the dangers. A physical sign – no matter how prominent – is no substitute for consent.
Maybe the ACLU, EFF, and PRC will succeed in adding teeth to the bill, or maybe we end up in a world where Californians ignore facial recognition notices just like we all ignore Prop 65 notices. Where AB 1281 ends up remains to be seen.
Disclaimer: This information is given for legal education only. This post is not legal advice and does not create an attorney-client relationship. Please contact an attorney for legal advice.
Daniel Zarchy is a civil litigator and privacy attorney in San Francisco, California. Daniel is also a Certified Information Privacy Professional (CIPP/US). The views and opinions expressed herein are solely those of the author and do not necessarily reflect the views or opinions of any other party or law firm.
Latest posts by Daniel J. Zarchy
(see all)Like this:
Like Loading...