California: Bills on facial recognition, automated decisions, and medical confidentiality introduced to Assembly
Assembly Bill ('AB') 2261 on facial recognition technology, AB 2269 on automated decision systems, and AB 2280 on digital health feedback systems, were introduced, on 14 February 2020, to the California State Assembly ('the Assembly'). In particular, AB 2261 would amend the the California Consumer Privacy Act of 2018 ('CCPA') and would, among other things, require from processors, defined as 'a natural or legal person that processes personal data on behalf of a controller,' that provide facial recognition services, to make available an application programming interface enabling controllers or third parties to conduct legitimate tests of such facial recognition services for accuracy and unfair performance differences across distinct subpopulations. In addition, AB 2261 would provide different rights to consumers regarding the use of their personal information for facial recognition services.
Furthermore, AB 2269 would enact the Automated Decision Systems Accountability Act of 2020 and would introduce requirements for a person that uses an automated decision system, including ensuring that there are processes in place to continually test for biases during the development and usage of the system, and conduct an impact assessment to determine whether the system has a disproportionate adverse impact on protected classes. Finally, AB 2280 would amend the Confidentiality of Medical Information Act to add definitions for 'personal health record' and 'personal health record information' and would deem, as a provider of health care, any business that offers personal health record software or hardware to a consumer in order to make information available for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition.