42 U.S.C. § 18936 — Biometrics research and testing

**(a) In general** The Secretary, acting through the Director, shall establish a program to support measurement research to inform the development of best practices, benchmarks, methodologies, procedures, and voluntary, consensus-based technical standards for biometric identification systems, including facial recognition systems, to assess and improve the performance of such systems. In carrying out such program, the Director may— (1) conduct measurement research to support efforts to improve the performance of biometric identification systems, including in areas related to conformity assessment, image quality and interoperability, contactless biometric capture technologies, and human-in-the-loop biometric identification systems and processes; (2) convene and engage with relevant stakeholders to establish common definitions and characterizations for biometric identification systems, which may include accuracy, fairness, bias, privacy, consent, and other properties, taking into account definitions in relevant international technical standards and other publications; (3) carry out measurement research and testing on a range of biometric modalities, such as fingerprints, voice, iris, face, vein, behavioral biometrics, genetics, multimodal biometrics, and emerging applications of biometric identification technology; (4) study the use of privacy-enhancing technologies and other technical protective controls to facilitate access, as appropriate, to public data sets for biometric research; (5) conduct outreach and coordination to share technical expertise with relevant industry and nonindustry stakeholders and standards development organizations to assist such entities in the development of best practices and voluntary technical standards; and (6) develop such standard reference artifacts as the Director determines is necessary to further the development of such voluntary technical standards. **(b) Biometrics test program** (1) **In general** — The Secretary, acting through the Director, shall carry out a test program to provide biometrics vendors the opportunity to test biometric identification technologies across a range of modalities. (2) **Activities** — In carrying out the program under this subsection, the Director shall— (A) conduct research and regular testing to improve and benchmark the accuracy, efficacy, and bias of biometric identification technologies, which may include research and testing on demographic variations, capture devices, presentation attack detection, partially occluded or computer generated images, privacy and security designs and controls, template protection, de-identification, and comparison of algorithm, human, and combined algorithm-human recognition capability; (B) develop an approach for testing software and cloud-based biometrics applications, including remote systems, in Institute test facilities; (C) establish reference use cases for biometric identification technologies and performance criteria for assessing each use case, including accuracy, efficacy, and bias metrics; (D) produce public-facing reports of the findings from such testing for a general audience; (E) develop policies and procedures accounting for the legal and social implications of activities under this paragraph when working with a foreign entity of concern (as such term is defined in [section 19221 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section19221&num=0&edition=prelim)); (F) establish procedures to prioritize testing of biometrics identification technologies developed by entities headquartered in the United States; and (G) conduct such other activities as determined necessary by the Director. **(c) GAO report to Congress** Not later than 18 months after August 9, 2022, the Comptroller General of the United States shall submit a detailed report to Congress on the impact of biometric identification technologies on historically marginalized communities, including low-income communities and minority religious, racial, and ethnic groups. Such report should be made publicly available on an internet website.