QUESTION
What are the processes and policies for agencies using facial recognition technology?
0:39:22
·
63 sec
The Chief Information Security Officer explains that there are processes in place for security review of technology systems.
- If an agency wants to use a provider leveraging facial recognition, it may go through security review
- The review process depends on factors like cloud connectivity, on-premises systems, data nature, and use classification
- There are citywide policies that govern these security review procedures
Jennifer Gutiérrez
0:39:22
Is that something that would fall in any of, like, agreements between agency to agency.
0:39:28
If an agency is utilizing facial recognition technology, is that something that OTI should be made aware of?
Kelly Moan
0:39:35
So we have we have processes in place for security review of technology.
0:39:40
Right?
0:39:40
So if a provider was excuse me, an agency was looking to leverage a provider that leverage facial recognition.
0:39:49
While we it it may come across our desk because of the nature of the system.
0:39:55
Right?
0:39:55
So it potentially it's a cloud system or a system that's connected to cloud infrastructure or they're building something on premises depending on what that system makeup would look like, then it might be in front of us for security review, and for that purpose, we would run them through our typical processes and procedures depending on the nature of the data and use, the classification of the them as well.
0:40:19
And we have policies citywide that instantiate that.
