Nation’s Strongest Regulations for Law Enforcement Use of Facial Recognition Technology Go Into Effect: Key Provisions of Maryland’s New Law

The only U.S. state to pass legislation specifically addressing facial recognition technology this year, Maryland’s new law was signed by Gov. Wes Moore on May 26, 2024, and went into effect on Oct. 1. The measure establishes uniform statewide standards applicable to any state or local agency that uses facial recognition technology in criminal investigations.

National Context

Maryland becomes the 13th state to enact legislation that restricts or conditions use of facial recognition technology by law enforcement in some form, and it is by far the most comprehensive. Fulfilling a key requirement of the law, the Maryland State Police has published a model policy to assist agencies incorporating these new requirements into their policies and procedures.

For over a decade, Maryland law enforcement agencies have used this software for comparing and matching facial images, as a post-incident investigative tool to aid identification by generating leads from available databases (with many documented successes). In addition to aiding other types of criminal investigations, the technology has also become an essential tool in fighting child sexual exploitation and human trafficking.

There is growing consensus among law enforcement professionals nationwide on the necessity and effectiveness of facial recognition software in generating investigative leads (explained here), as well as appropriate processes and rules surrounding its use. At the same time, public concerns have surfaced over questions about accuracy and potential for misuse.

While interest in establishing more robust use policies is growing, states are increasingly reluctant to legislate, with most existing measures enacted from 2020 to 2022. Several states and localities that briefly experimented with sweeping bans on the technology – notably the state of Virginia and the city of New Orleans – have since quickly reversed course once the impact to criminal investigations became clear.

Maryland lawmakers rejected a ban in favor of regulations, and as SIA reported earlier this year the state’s measure garnered broad support following agreement from a diverse group of stakeholders across law enforcement, industry and civil rights organizations on a carefully crafted compromise achieved over several legislative sessions.

Summary of Key Provisions

The new law establishes statewide requirements for state and local agencies utilizing facial recogntion technology, covering five key areas: authorized uses, prohibitions, training, transparency and accountability.

Approved Uses

The new law authorizes use of the technology for specific investigatory and public welfare purposes:

• To assist in the investigation of the following enumerated crimes (see model policy and statutory text for references/definitions):
  • Crimes of violence
• • Human trafficking
• • Child abuse
• • Hate crimes
• • Child pornography
• • Felony weapons crimes
• • Aggravated cruelty to animals
• • Offenses involving importation of fentanyl
• • Stalking
• • Criminal acts involving a substantial and ongoing threat to public safety or national security
  • Violations laws equivalent to those above in other states, when the investigation involves seeking fugitives from justice
• For the following additional purposes (which are specifically excluded from the requirements):
  • Identifying a missing or deceased person or a person who is incapacitated and unable to otherwise provide the person’s own identity
  • Redacting a recording or an image for release or disclosure to protect the privacy of an individual depicted
  • Forensic analysis of electronic media seized by law enforcement in relation to a specific investigation if the person identified in the electronic media is not the subject of criminal charges (such as electronic media evidence involving child sexual abuse material)
  • Enhancing security systems for preventing unauthorized access to information, goods, materials, areas or other properties under the custody or care of a law enforcement agency
  • Conducting otherwise legitimate activity unrelated to a criminal investigation

Prohibitions:

• Not sole basis for probable cause: Results generated by facial recogntion technology may not serve as the sole basis to establish probable cause (for an arrest or search warrant, for example) or the positive identification of an individual. Probable cause or positive identification must be supported by additional, independently obtained evidence. 
• No use as evidence: Software results indicating a potential match cannot be used as evidence against a defendant.
• No surveillance: Use facial recognition technology for “live or real-time” identification is prohibited. Also prohibited is use of facial recognition technology to identify an individual engaged in activity protected under the United States Constitution, the Maryland Constitution or the Maryland Declaration of Rights, unless there is reasonable suspicion to believe that the individual has committed, is in the process of committing, or is about to commit a crime.
• No personal use: Use of facial recognition technology based on the personal interest of personnel, unrelated to legitimate duties.
• Nondiscrimination: Use of facial recognition technology solely based on an individual’s political or social believes or activities, participation in lawful activities, or an individual’s race, color, religious beliefs, sexual orientation, gender, disability, national origin or status as being homeless.
• Lineup disclosure: It is prohibited to disclose toa witness participating in a live identification or photo array identification, that a particular suspect or image was selected using facial recognition technology.
• No immigration enforcement: Use of facial recogntion technology is prohibited to assist federal immigration enforcement, pursuant to Maryland General Provisions, Section 4-320(g)(2).

Training

• Independent trained review: A new training program will be developed by the U.S. Department of Public Safety and Correctional Services by June 30, 2026. Once it is administered, results generated by facial recognition technology must be independently reviewed by an individual that has completed this training before further use in an investigation. Training will cover the use of facial recognition technology during criminal investigations, in addition to training on cultural diversity and implicit bias.

Transparency and Accountability Measures

• Public transparency: Each agency utilizing facial recogntion technology is required to post on its website:
  • A copy of its use policy
  • The name of its facial recognition systems
  • The names of all nongovernmental facial recognition systems used and descriptions of any nongovernmental databases searched
• Disclosure to defendants: In cases where use of the software led to further investigative action (i.e., generated a lead that was acted upon), discovery reports will contain the names of each facial recognition system used, a description and the names of the databases searched and results generated from the use of the facial recognition technology that led to further investigative action.
• Designated coordinator: Agencies are required to appoint a program coordinator responsible for policy adherence, reports and audits.
• Agency reports: Agencies using facial recogntion technology are required to publish an annual report that includes:
  • the name of each facial recognition system/database used.
  • the number of facial recognition searches used for each system and the purpose (type of crime investigated or other authorized use) for each search.
  • the total number of possible matches that led to further investigative action for each search, including the age, race, and gender of the individuals connected to the possible matches returned, if such information is available from government records searched.
  • any  data breaches or unauthorized uses of facial recognition technology under the agency’s control.
• State report: Annual agency reports are sent to the Governor’s Office of Crime Prevention and Policy, which will publish an aggregated statewide report.
• Agency audits: Agencies are required to annually conduct a comprehensive audit to determine compliance with Maryland law and policy.
• Enforcement: In additional to internal agency policy enforcement measures, a person may bring a civil action against a law enforcement agency to compel compliance. 

Specific Software and Data Sources

The new law preserves the ability of investigators use platforms analyzing open-source information and data held by other agencies, in additional to state government data; however, it also requires complete transparency regarding software and data sources, whether government or nongovernment, through public disclosure, disclosure to defendants and annual reporting.

This is critically important, as investigators routinely query open-source information and records held by other agencies to help identify victims, witnesses or suspects that may have no prior criminal history or records in Maryland or are from outside the state, especially when other methods result in dead ends. For example, the Spotlight platform used extensively in the state for investigating human trafficking and child sex crimes, analyzes online information (including photos) typically found on escort and pornographic websites that facilitate prostitution.

Our View

While Security Industry Association (SIA) supported the core provisions of Maryland’s new law as consistent with the SIA Principles for the Responsible and Effective Use of Facial Recognition, there are some requirements that go beyond this. The key rubric for evaluating policy on law enforcement use of facial recognition technology should be whether it provides guardrails that effectively address concerns without significant impact to public safety from elimination or degradation of proven investigative tools. 

The limitation under this measure on the types of crime that can be investigated with the aid of facial recognition software will needlessly limit sources of leads for solving other types of crime. There is little justification as to why the benefits of using the technology (such as reducing eyewitness misidentification, eliminating innocent persons as potential suspects, cracking cold cases) should be limited to “serious” crimes or why some crime victims deserve more limited investigative resources to find justice. Without the technology investigators are left with less efficient and less accurate manual methods of performing image comparison (which must still occur), providing more potential for human bias and unnecessary interactions with police.

A very significant compromise on the part of Maryland’s law enforcement agencies, such a limitation was nevertheless crucial to moving the measure forward to get uniform, workable rules in place that fully address concerns about the technology. Ultimately, the new law will bolster confidence that Maryland law enforcement agencies are leveraging facial recognition software in a lawful, effective, accurate and nondiscriminatory manner that benefits communities.