The Vermont Department of Motor Vehicles' facial recognition program violates state law and should remain suspended, Attorney General T.J. Donovan said Tuesday.
Donovan said the program, which includes 2.7 million images of license applicants and has previously been shared with police, violates a 2004 law barring the DMV from using "biometric identifiers" in granting identification cards.
The DMV should not restart the program unless it gets legislative approval, Donovan said.
"This is about balancing public safety with the privacy rights of Vermonters," Donovan said.
The ACLU said the facial recognition program, launched in December 2012, was "subject to abuse" by law enforcement.
"This is a victory for civil liberties," James Lyall, executive director of the ACLU of Vermont, said in a statement. "We now ask Gov. [Phil] Scott to act consistently with the attorney general's conclusion and we call on the legislature to take all necessary action to permanently protect the privacy and civil liberties of all Vermonters from government abuse."
In an interview Tuesday, DMV Commissioner Robert Ide said he would ask lawmakers to consider crafting a law that would allow the agency to restart the program.
"We would like to work with interested partners in the legislature to see if we can't find the proper language to provide safeguards to see if people will be comfortable turning the system back on," Ide said.
The technology identifies individuals by examining facial features — such as the position of the eyes — that cannot be easily altered and don't change with age.
The DMV initially billed facial recognition, funded with $900,000 in federal grant money, as a fraud prevention program. DMV officials said it would not be shared with law enforcement.
But police have used the database on at least 118 occasions, Seven Days reported.
Since shutting down the program, Ide said the DMV has opened one identity fraud case — two people applied for an identification card using the same name and address — that was slowed because the agency did not have the facial recognition program.
Ide previously told Seven Days that he was unaware of the 2004 law. An attorney who represents the DMV told Seven Days that a "determination was made" that the facial recognition program did not violate the law. But the attorney could not provide a law or legal opinion to support that assertion.