Data Dive

Throughout the month of March, states continued to introduce new privacy laws of their own as Congress focused on enacting President Biden’s $1.9 trillion COVID-19 relief plan—H.R. 1319, the American Rescue Plan Act of 2021—which President Biden signed into law on March 11.

Throughout the month of February, states continued to introduce new privacy laws of their own as Congress remained preoccupied with enacting an additional COVID-19 relief package. Virginia emerged as the primary highlight of the month, as the state’s enactment of the Consumer Data Protection Act (CDPA) on March 2 makes Virginia the second state to enact a comprehensive state data privacy law in the U.S., after the California Consumer Privacy Act of 2018 (CCPA). In addition to Virginia’s enactment of the law, lawmakers in California and other states have continued to unveil a slate of sector-specific legislative proposals. Below, please find a high-level overview of states’ recent legislative efforts in this space.

In an unusual departure from prior settlements, the Federal Trade Commission (FTC) has required a company to delete the facial recognition algorithm that was allegedly developed using improperly obtained user consent. Reinforcing its stance against the alleged improper harvesting of user content for facial recognition software, the FTC announced its January 2021 administrative complaint and proposed consent order against California company EverAlbum, Inc. The FTC alleged the company used its Ever App users’ photos to develop facial recognition technology for its business line, Paravision, which develops and markets facial recognition software. In essence, one commissioner explained, “The company enhanced their facial recognition technology by allegedly baiting consumers into using Ever, a ‘free’ app that allowed users to store and modify photos.” Thus, in response, the FTC has taken the exceptional step of requiring the company not only delete wrongly obtained user content but also delete the algorithms and models derived from that content.

The City Council of Portland, Oregon unanimously passed a ban on facial recognition, set to take effect in January 2021.  The Portland ban is currently the strongest in the United States, preventing not only government agencies, but also private businesses from using facial recognition technology.  The ban also applies to facial recognition used by airlines at airports.  Starting in January, local government agencies, including the police, as well as stores and businesses, will be banned from using facial recognition technology.