In this subtitle the following words have the meanings indicated. “Facial recognition technology” means a computer program, a service, or any other technology that analyzes facial features and is used by or at the direction of a law enforcement agency for the identification, verification, or persistent tracking of individuals in still or video images for use in criminal investigations. “Facial recognition technology” does not include technology: used only for the analysis of facial features to grant or deny access to an electronic device; or that uses an automated or semiautomated process only for the purpose of redacting a recording or an image for release or disclosure outside a law enforcement agency to protect the privacy of a subject depicted in the recording or image if the process does not generate or result in the retention of any biometric data or surveillance information. “Law enforcement agency” has the meaning stated in § 2–101 of the Public Safety Article.

Except as otherwise provided in this section, results generated by facial recognition technology may not be introduced in a criminal proceeding or in a delinquency proceeding under Title 3, Subtitle 8A of the Courts Article. Subject to paragraph (2) of this subsection, results generated by facial recognition technology may be considered or introduced as evidence in connection with a criminal proceeding only for the purpose of establishing probable cause or positive identification: in connection with the issuance of a warrant; or at a preliminary hearing. Subject to subparagraph (ii) of this paragraph, results generated by facial recognition technology may not serve as the sole basis to establish probable cause or the positive identification of an individual in a criminal investigation or proceeding. Probable cause or positive identification may be established using facial recognition technology only if the results are supported by additional, independently obtained evidence establishing probable cause or a positive identification.

A police officer or other employee or agent of a law enforcement agency may not, in the furtherance of a criminal investigation: use facial recognition technology to investigate a crime other than the commission of or the attempt to commit: a crime of violence as defined in § 14–101 of the Criminal Law Article; a human trafficking offense under Title 3, Subtitle 11 of the Criminal Law Article; first– or second–degree child abuse under § 3–601 of the Criminal Law Article; a child pornography offense under § 11–207 of the Criminal Law Article; a hate crime under § 10–304 of the Criminal Law Article; a weapon crime under § 4–102, § 4–103, § 4–203(a)(1)(iii) or (iv), § 4–204, or § 4–303(a)(2) of the Criminal Law Article; a weapon crime under § 5–138, § 5–140, § 5–141, § 5–207(c)(16), § 5–406(a)(3), or § 5–703(a) of the Public Safety Article; aggravated cruelty to animals under § 10–606 or § 10–607 of the Criminal Law Article; importation of fentanyl or a fentanyl analogue under § 5–614(a)(1)(xii) of the Criminal Law Article; stalking under § 3–802 of the Criminal Law Article; a criminal act involving circumstances presenting a substantial and ongoing threat to public safety or national security; or a crime under the laws of another state substantially equivalent to a crime listed in items 1 through 10 of this item involving a fugitive from justice charged with a crime in that state and sought under Title 9 of this article; analyze an image or a recording of an individual: engaged in activity protected under the United States Constitution, the Maryland Constitution, or the Maryland Declaration of Rights, unless there is reasonable suspicion to believe that the individual has committed, is in the process of committing, or is about to commit a crime; or who is not intended to be identified; use facial recognition technology to analyze a sketch or manually produced image; disclose to a witness in the criminal investigation, prior to the witness participating in a live identification or photo array identification, that a particular suspect or image of a suspect was identified using facial recognition technology; or use facial recognition technology for the purpose of live or real–time identification of an image or a recording. Except as provided in subparagraph (ii) of this paragraph, an image being evaluated using facial recognition technology may be compared only to images contained in: the database of images of driver’s license and identification card photos maintained by the Motor Vehicle Administration or the department of motor vehicles of another state; or a database of mugshot photos maintained by a local, State, or federal law enforcement agency or a law enforcement agency of another country. An image being evaluated using facial recognition technology may be compared to an image contained in a database other than a database described in subparagraph (i) of this paragraph if: the law enforcement agency conducting the investigation has entered into an agreement with the entity that maintains the database governing the methods by which images in the database are collected; and the agreement provides that the agreement will be terminated in the event that the entity maintaining the database commits a material breach of the provisions governing the methods by which images in the database are collected. Before being used for any purpose in relation to a criminal investigation, a result generated by facial recognition technology shall be independently verified by an individual who has completed training in accordance with § 2–505 of this subtitle. A police officer or other employee or agent of a law enforcement agency may not use facial recognition technology to identify an individual solely based on: the police officer’s, employee’s, or agent’s personal interest not related to legitimate duties or objectives of the law enforcement agency; the individual’s political or social beliefs or activities; the individual’s participation in lawful activities; or the individual’s race, color, religious beliefs, sexual orientation, gender, disability, national origin, or status as being homeless. Except as provided in paragraph (2) of this subsection and subject to paragraph (3) of this subsection, a result generated by facial recognition technology in violation of this section and all other evidence subsequently derived from the result may not be introduced by the State for any purpose in a criminal court proceeding or in a juvenile court proceeding under Title 3, Subtitle 8A of the Courts Article. Evidence derived from a result generated in violation of subsection (a)(1) of this section may be introduced for a purpose described in § 2–502 of this subtitle if the court finds that the evidence would otherwise be subject to a legally valid exception to the exclusionary rule. This subsection may not be construed to allow the use of a result generated using facial recognition technology to be introduced as evidence in a criminal trial or in an adjudicatory hearing held under § 3–8A–18 of the Courts Article.

The State shall disclose, in accordance with the Maryland Rules regarding discovery, whether facial recognition technology has been used in an investigation relevant to a criminal court proceeding or juvenile court proceeding under Title 3, Subtitle 8A of the Courts Article, the name of each facial recognition system used, a description and the names of the databases searched, and all results generated from the use of the facial recognition technology that led to further investigative action for each facial recognition system and for each database searched.

A law enforcement agency that uses or contracts for the use of facial recognition technology shall designate an employee of the law enforcement agency to be responsible for overseeing and administering the use of facial recognition technology in compliance with this subtitle as well as applicable local laws, regulations, and policies. On or before October 1 each year, a law enforcement agency that uses or contracts for the use of facial recognition technology shall complete an audit to determine compliance with this subtitle as well as applicable local laws, regulations, and policies. The results of the audit conducted under this subsection, including any records, data, papers, or materials evaluated as part of the audit, shall be: maintained by the law enforcement agency for at least 3 years after completion of the audit, after which the law enforcement agency may destroy all audit materials; and unless all audit materials have been destroyed in accordance with item (i) of this paragraph, disclosed if requested by: the Attorney General; the public defender; a State’s Attorney; a United States Attorney; or a designee of an individual described in items 1 through 4 of this item. A police officer or other employee or agent of a law enforcement agency authorized to use facial recognition technology in the course of criminal investigations shall annually complete training administered by the Department of Public Safety and Correctional Services under § 2–506 of this subtitle.

The Department of State Police, in consultation with any other relevant State agency, shall adopt and publish a model statewide policy regarding the use of facial recognition technology. A law enforcement agency may not use or contract for the use of facial recognition technology for use in criminal investigations unless the use is in accordance with the model statewide policy regarding the use of facial recognition technology adopted and published under subsection (a) of this section. On or before June 30, 2026, the Department of Public Safety and Correctional Services shall develop and administer a training program regarding the use of facial recognition technology in the course of criminal investigations, including training on cultural diversity and implicit bias. In developing the training program required under paragraph (1) of this subsection, the Department shall evaluate the availability and relevance of any proficiency testing regarding the use of facial recognition technology in the course of criminal investigations.

This subtitle may not be construed to restrict the use of facial recognition technology for the purpose of: identifying a missing or deceased person or a person who is incapacitated and unable to otherwise provide the person’s own identity; redacting a recording or an image for release or disclosure to protect the privacy of an individual depicted in a recording or an image; forensic analysis of electronic media seized by law enforcement in relation to a specific investigation if the person identified in the electronic media is not the subject of criminal charges resulting from the forensic analysis; enhancing security systems for preventing unauthorized access to information, goods, materials, areas, or other properties under the custody or care of a law enforcement agency; or conducting otherwise legitimate activity unrelated to a criminal investigation.

A law enforcement agency that uses facial recognition technology shall adopt and maintain a use and data management policy. A law enforcement agency that develops a policy under subsection (a) of this section shall post a copy of the policy on the agency’s public website. A law enforcement agency that contracts for use of a nongovernment facial recognition system shall disclose on its public website the name of the system and the names and a description of the databases searched.

A person may bring a civil action against a law enforcement agency to compel compliance with this subtitle.

On or before February 1 each year, a law enforcement agency using or contracting for the use of facial recognition technology shall prepare and publish an annual report that discloses information for the prior calendar year, including: the name of each facial recognition system and the names and a description of the databases searched; for each facial recognition system, the total number of facial recognition searches performed by the law enforcement agency and the type of crime or incident associated with each use; the total number of possible matches returned that led to further investigative action for each facial recognition system and for each database searched including the age, race, and gender of individuals connected to the possible matches returned if the information is available from the government records searched; and any data breaches or unauthorized uses of facial recognition technology under the law enforcement agency’s control. On or before May 1 each year, a law enforcement agency required to prepare a report under subsection (a) of this section shall submit the report to the Governor’s Office of Crime Prevention, Youth, and Victim Services. On or before October 1 each year, the Governor’s Office of Crime Prevention, Youth, and Victim Services shall submit to the Governor and, in accordance with § 2–1257 of the State Government Article, the General Assembly a report consisting of the information reported by law enforcement agencies under subsection (b) of this section, disaggregated by agency.