Ramping up the state’s continued focus on data privacy, on June 8, 2022, Colorado Governor Jared Polis signed legislation aimed at limiting the use of facial recognition technology by government agencies and state institutions of higher education.

The new law, SB 113, requires an agency, defined as “an agency of the state government or of a local government; or a state institution of higher education,” that intends to “develop, procure, use or continue to use facial recognition service” to provide notice of intent to use those services with its “reporting authority” prior to using the technology.

The notice must provide details of the vendor to be used, the capabilities and limitations on the use of the facial recognition technology, the type of data collected by the technology, how data will be collected and processed, the purpose of the use, and the benefits of the proposed use of the technology. In addition, the notice must provide information on how the data will be stored and secured, what policies will govern the information collected, and details regarding testing and reporting of “false matches, potential impacts on protected subpopulations, and how the agency will address error rates that are determined independently to be greater than one percent.”

The law requires agencies and state institutions of higher education to provide an accountability report on how the use of facial recognition impacts civil rights and liberties, “including potential impacts to privacy and potential disparate impacts on marginalized communities, including the specific steps the agency will take to mitigate the potential impacts” and how it will receive feedback on the use of the technology. Agencies are required to submit an accountability report prior to deploying the technology and must allow public review and comment, including three public meetings. The accountability report is required to be published publicly at least 90 days prior to deploying the technology.

The law requires users of facial recognition technology in an agency to be trained on its use and includes certain limitations and prohibitions on the use of the technology by law enforcement. It also prohibits the use of facial recognition services by any public school, charter school, or institute charter school until January 1, 2025.

The law is dense in its requirements and goes into effect on August 10, 2022.