September 23, 2016 Clare Garvie Georgetown Univ. L.Rev. Via email: cag104@law.georgetown.edu Re: Working Draft Face Recognition Dear Ms. Garvie: Thank you very much for the opportunity to comment on the working draft of your article on Facial Recognition Technology. I would like to offer the following comments. Your second bullet point states that “Police do not need reasonable suspicion to run a search.” It is true that Ohio’s standard does not require reasonable suspicion for a particular search, but your statement could be read to imply that there is no standard at all. That would be misleading, given the requirements adopted by BCI in its OHLEG Rules and Regulations. I have noticed your partial quote from the standard in the thirdto-last paragraph, so I presume you have the complete statement. You report numbers of police officers and court employees who had access to search facial recognition when the technology was first implemented in 2013. Current numbers reflect more accurately on Ohio’s present approach, which show that 1,429 searches were conducted between January 1 and April 22, 2016 by 104 agencies, with 4,406 individuals having access to facial recognition. These numbers reflect a significant tightening of the facial recognition policy following the initial release. You report that police access to Ohio’s driver’s license database may be in tension with Ohio state law, which permits the disclosure of personal informal other than sensitive personal information to law enforcement. In fact, however, section 4501.27 also provides as follows: 4501.27 Confidentiality. * * * (B) (3) (a) Except as provided in division (B)(3)(b) of this section, the registrar, or an employee or contractor of the bureau of motor vehicles, may disclose sensitive personal information about an individual that the bureau obtained in connection with a motor vehicle record, only if either of the following conditions are satisfied: Ohio AG GeorgetownCPT 016841 FRT (i) The individual whose personal information is requested completes and submits to the registrar or deputy registrar a form prescribed by the registrar by rule giving express consent to such disclosure; (ii) The disclosure is for one or more of the purposes described in division (B)(2)(a), (d), (g), or (j) of this section. * * * (B) (2) (a) For the use of a government agency, including, but not limited to, a court or law enforcement agency, in carrying out its functions, or for the use of a private person or entity acting on behalf of an agency of this state, another state, the United States, or a political subdivision of this state or another state in carrying out its functions…. Further, section 4507.53 expressly permits release of these images to a state agency for criminal justice purposes. 4507.53 Release of digitalized photographic records. Digitalized photographic records of the department of public safety may be released only to state, local, or federal governmental agencies for criminal justice purposes and to any court. These statutes authorize the use of driver’s license photographs for a law enforcement agency in carrying out its functions. You report that the ACLU expressed concerns over a potential negotiation that the FBI is negotiating for access to the OHLEG facial recognition database. In fact, there are no such negotiations. Individual members of law enforcement agencies may be granted access to OHLEG based upon a stated need, to include agents of the FBI; but there is no plan, and there are no negotiations, to merge or link the OHLEG database with the FBI’s investigative database. This type of merge or link has never been requested. Even if it were requested, it would never be considered without being thoroughly vetted through our OHLEG Advisory Committee (see below). In the section on Fourth Amendment, you have graded the states’ access for the use of this technology according to particular legal standards such as probable cause and reasonable suspicion, but without citing to legal authority. I presume these grading standards represent the judgment of the author. You have graded Ohio as “Red” for Accuracy when we only use facial recognition for an investigative tool. While we want the tool to be as accurate as possible, the accuracy concerns are diminished when it is only used as a lead and not to positively identify a suspect. Ohio AG GeorgetownCPT 016842 FRT You graded Ohio as “Red” for Public Transparency. In fact, the Attorney General created the OHLEG Advisory Board specifically to address the concerns of facial recognition, though the scope of the Board’s review is not limited to that topic. This Board provides opinion and input to the OHLEG Steering Committee, the Superintendent of BCI and the Attorney General. Members include representatives from Ohio law schools, the ACLU, the business community and members of the defense bar in addition to law enforcement and prosecutors at various community levels. Meetings are subject to public notification, the minutes are published and the media has frequently attended. The group has discussed and participated in negotiations of BCI’s Rules and Regulations governing facial recognition. I submit that this is a transparent process. Ohio was graded with a “Red” score for Internal Audits. In fact, we regularly conduct audits of the agencies that use facial recognition. I am attaching an excerpt from the OHLEG Rules and Regulations, as most recently amended, which prescribe sanctions for misuse of the data and audits to evaluate compliance with the Rules and Regulations. I am also including copies of a blank audit face sheet and the log sheet form to be completed by an agency, which form part of the audit data. Thank you for considering our recommended corrections, which we believe more accurately reflect the true nature and use of Ohio’s facial recognition system. Sincerely, Gregory Trout Chief Counsel Bureau of Criminal Investigation Ohio AG GeorgetownCPT 016843 FRT