Privacy & Cybersecurity Law Blog

On June 15, 2016, the U.S. Department of Commerce’s National Telecommunications and Information Administration (“NTIA”) announced that its multistakeholder process to develop a code of conduct regarding the commercial use of facial recognition technology had concluded with the group reaching a consensus on a best practices document. As we previously reported, the NTIA announced the multistakeholder process in December 2013 in response to the White House’s February 2012 privacy framework, which directed the NTIA to oversee the development of codes of conduct that specify how the Consumer Privacy Bill of Rights applies in specific business contexts.

The best practices, which are voluntary, encourage “Covered Entities” (defined as any person, including corporate affiliates, that collects, stores or processes facial template data, but excluding government and law enforcement agencies) to take certain measures including:

• Make available to consumers, in a reasonable manner and location, policies or disclosures describing Covered Entities’ practices regarding collecting, storing and using personal data;
• Consider various factors when developing facial template data management practices, including the types of non-facial recognition sensitive data being captured and stored, how that data will be stored and used and reasonable consumer expectations with respect to the use of data;
• Provide individuals the opportunity to control the sharing of their facial template data with unaffiliated third parties;
• Take measures to protect covered data by implementing a program that contains reasonable administrative, technical and physical safeguards appropriate to the Covered Entity’s size and complexity, the nature and scope of its activities and the sensitivity of the facial template data;
• Take reasonable steps to maintain the integrity of the facial template data they collect; and
• Provide a process consumers can follow to contact the Covered Entity regarding its use of facial template data.

The document also notes that “the best practices are intended to provide a flexible and evolving approach to the use of facial recognition technology, designed to keep pace with the dynamic marketplace surrounding these technologies.”