Portland Becomes First Jurisdiction to Ban Certain Uses of Facial Recognition by Private Businesses

In an effort to ameliorate the potential discriminatory impact of facial recognition technologies on people of color, women, and other groups, Portland, Ore., recently joined a growing number of jurisdictions limiting the use of facial recognition technology.

The ordinance, which went into effect on January 1, 2021, is the first in the country to prohibit certain uses of these technologies by private businesses. Another ordinance banning the use and acquisition of face recognition technologies by all City of Portland bureaus and offices went into effect last September.

Businesses that use facial recognition technologies within Portland need to evaluate and potentially cease their use of these technologies.

Scope of the Ban

The ban prohibits private entities from using facial recognition technologies in places of "public accommodation" within the city of Portland. Key definitions in the ordinance include:

• Face Recognition Technologies: "Automated or semi-automated processes" using "facial recognition" to identify, verify, detect, or characterize "facial features of an individual" or capture "information about an individual based on" his or her face.
• Facial Recognition: "Automated searching for a reference image in an image repository by comparing the facial features of a probe image with the features of images in the repository (one-to-many search)."
• Places of Public Accommodation: "Places or services offering to the public accommodations, advantages, facilities, or privileges," including hotels, restaurants, retail stores, recreation sites, and public gathering locations. The definition is more sweeping than the 12 enumerated categories of public accommodations under Title III of the Americans with Disabilities Act but does not include commercial facilities.
  
  Like the ADA, the statute does not include operated by private entities, private clubs and religious organizations, private residences, or places of accommodation that are distinctly private in nature. However, businesses and organizations should exercise caution in relying solely on the defense that a place of accommodation is distinctly private in nature, as that concept is not further defined in the ordinance nor are any guiding examples provided.

Although the ban is broad, there are notable exceptions, even for use in places of public accommodation. The ordinance permits the use of Face Recognition Technologies:

• As necessary to comply with federal, state, or local law;
• When used by an individual for "user verification purposes" on the individual's personal or employer-issued "communication and electronic devices"; and
• In automatic face detection in social media applications.

Penalties for non-compliance are potentially significant. The ordinance contains a private right of action enabling individuals to sue, with statutory damages of $1,000 per day, and provides for reasonable attorney fees for prevailing plaintiffs.

Considerations for Employers and Businesses

Employers and businesses using Face Recognition Technologies should promptly consider where and how they deploy the technology. Since the ordinance applies to both "place[s]" and "service[s]," the scope of the ordinance may extend beyond physical business and to further apply to online services and websites available to individuals in Portland.

Likewise, employers and businesses must understand the underlying Face Recognition Technologies that they use, as the ordinance applies to technologies that rely on searching reference images in an image repository. It is not yet clear how the ordinance applies to Face Recognition Technologies that do not involve comparisons between probe images and reference images, such as "occupancy counting" tools.

Employers should also consider their attendance and timekeeping systems. Although the ordinance exempts employer-issued communication and electronic devices that use Face Recognition Technologies, such as phones that unlock using facial recognition, it is possible that the ordinance applies to back-of-house technologies or systems used in relation to a business's employees, rather than the public.

Implementing regulations, enforcement, litigation, and further action from the Portland City Council may clarify these issues. Portland could take an approach similar to Illinois, where employees have sued employers under that state's Biometric Information Privacy Act based on use of face recognition technology in workplace time clocks.

All employers are wise to consult with legal counsel to explore the scope and effect of this ordinance as it may apply to their policies and technologies. The Portland City Council's stated goal to protect Portlanders' sensitive information foreshadows more regulation on the horizon.