Microsoft calls governments in 2019 to start adopting laws to regulate the facial recognition technology, since this technology brings exciting societal benefits but also can be easily used for abuse.

Unless action is taken, we risk waking up five years from now to find that facial recognition services have spread in ways that exacerbate societal issues, Microsoft's Brad Smith wrote in a blog post.

In its current state of development, certain uses of facial recognition technology increase the risk of decisions and, more generally, outcomes that are biased and, in some cases, in violation of laws prohibiting discrimination. Recent research has demonstrated, for example, that some facial recognition technologies have encountered higher error rates when seeking to determine the gender of women and people of color.

Microsoft says that new laws are needed in this area, for two reasons. First, market forces will work well only if potential customers are well-informed and able to test facial recognition technology for accuracy and risks of unfair bias, including biases that arise in the context of specific applications and environments. Microsoft says that legislation that will put impartial testing groups like Consumer Reports and their counterparts in a position where they can test facial recognition services for accuracy and unfair bias in a transparent and even-handed manner is needed.

According to Microsoft, legislation should require tech, companies that offer facial recognition services to provide documentation that explains the capabilities and limitations of the technology in terms that customers and consumers can understand.

New laws should also require that providers of commercial facial recognition services enable third parties engaged in independent testing to conduct and publish reasonable tests of their facial recognition services for accuracy and unfair bias. A sensible approach is to require tech companies that make their facial recognition services accessible using the internet also make available an application programming interface or other technical capability suitable for this purpose.

New legislation should also require that entities that deploy facial recognition undertake meaningful human review of facial recognition results prior to making final decisions for what the law deems to be “consequential use cases” that affect consumers, Microsoft says.

In adition, Microsoft says that the widespread use of this technology can lead to new intrusions into people’s privacy. For example, every public establishment could install cameras connected to the cloud with real-time facial recognition services.

Beyond information collected by a single camera in a single session, longer-term histories can be pieced together over time from multiple cameras at different locations. "A mall owner could choose to share this information with every store. Stores could know immediately when you visited them last and what you looked at or purchased, and by sharing this data with other stores, they could predict what you’re looking to buy on your current visit," Smith exxplains.

Microsoft's point is not that the law should deprive commercial establishments of this new technology. To the contrary, Microsoft is among the companies working to help stores responsibly use this and other digital technology to improve shopping and other consumer experiences.

Microsoft proposes that the law should require that entities that use facial recognition to identify consumers place conspicuous notice that clearly conveys that these services are being used.

The law should also specify that consumers consent to the use of facial recognition services when they enter premises or proceed to use online services that have this type of clear notice.

In addition, the use of facial recognition technology by a government for mass surveillance can encroach on democratic freedoms.

When combined with ubiquitous cameras and massive computing power and storage in the cloud, a government could use facial recognition technology to enable continuous surveillance of specific individuals.

To protect against the use of facial recognition to encroach on democratic freedoms, Microsoft says that legislation should permit law enforcement agencies to use facial recognition to engage in ongoing surveillance of specified individuals in public spaces only when:

• a court order has been obtained to permit the use of facial recognition services for this monitoring; or
• where there is an emergency involving imminent danger or risk of death or serious physical injury to a person.

List of Microsoft facial recognition principles

Microsoft has decided to adopt six principles that address the concerns:

• Fairness. The company will work to develop and deploy facial recognition technology in a manner that "strives to treat all people fairly."
• Transparency. Microsoft will document and clearly communicate the capabilities and limitations of facial recognition technology.
• Accountability. The company will encourage and help its customers to deploy facial recognition technology in a manner that "ensures an appropriate level of human control" for uses that may affect people in consequential ways.
• Nondiscrimination. Microsoft will prohibit in its terms of service the use of facial recognition technology to engage in unlawful discrimination.
• Notice and consent. The company will encourage private sector customers to provide notice and secure consent for the deployment of facial recognition technologies.
• Lawful surveillance. Microsoft will advocate for safeguards for people’s democratic freedoms in law enforcement surveillance scenarios, and will not deploy facial recognition technology in scenarios that we believe will put these freedoms at risk.

Next week Microsoft will publish a document detailing these principles. The company will formally launch these principles, together with this supporting framework, before the end of March 2019.