Loading...
HomeMy WebLinkAboutReport on City Privacy Advisory Groups1 Report on City Privacy Advisory Groups January 31, 2022 Introduction In January 2022, the City of Chula Vista established a new Technology and Privacy Oversight Task Force. Members of this group are charged with developing recommendations for a comprehensive technology and privacy oversight policy to the City Council by the end of 2022. This report is intended to provide guidance and perspective from other cities across the U.S. that have appointed similar community advisory groups. In the past five years, a handful of cities have asked citizens to join task forces and commissions to advise city officials on technology, innovation, and privacy in local government. Each of these cities has implemented or considered a variety of new “smart city” technologies and encountered significant interest among community members about how such powerful technologies are being used and managed. Most of the task forces, boards and committees dedicated to reviewing city technology have been established in California, but a few examples can be found in other states as well. This report focuses on advisory groups in the following California cities: Long Beach, San Jose, Foster City, San Ramon, Vallejo, Oakland, and Berkeley; as well as out-of-state groups in Seattle, Washington; and Portland, Oregon. Each group is borne out of city officials’ desire to craft policy and provide oversight with the assistance of community members who have expertise and perspectives on the complex and evolving nature of new technologies. The approach in each jurisdiction, however, has varied significantly in terms of the exact purpose of the committee, its format, its membership, its powers, and whether it is permanent or temporary. Examples from other cities can be divided into three categories: privacy advisory bodies, which provide policy recommendations specific to privacy policies; general advisory bodies, which provide a broad range of advice and ideas to city officials; and surveillance oversight bodies, which focus on determining policies for specific technologies and reviewing compliance with these policies. Privacy advisory bodies The cities of San Jose and Oakland have each hosted advisory committees or task forces intended to provide specific feedback on the development of privacy-related policies. The City of San Jose took a similar approach to the City of Chula Vista when it established a Digital Privacy Advisory Taskforce in November 2018. The taskforce acts as a community advisory body to the City’s Privacy Working Group, a group of key City staff with subject matter expertise on technology and privacy. The taskforce is charged with validating and providing input on the City’s privacy policy and on specific technological use cases. The taskforce is composed of up to 10 members, including three members representing non-profit advocacy groups such as ACLU and NAACP, two members representing the technology industry (such as Cisco), two members from academia, two members with a law enforcement background, and one member from another agency with an established and effective privacy program. The San Jose taskforce originally met quarterly, but since the City Council adopted a privacy policy in 2020, the Taskforce’s meeting frequency has slowed to one to two meetings per year. 2 Similarly, the City of Oakland in 2014 established an ad hoc advisory committee for the specific purpose of developing a privacy policy to govern the Domain Awareness Center, a security project that would gather and share information between the City of Oakland and the Port of Oakland. The ad hoc advisory committee completed its work of developing a policy for the Domain Awareness Center and also developed a set of additional recommendations to the City Council, which included a recommendation that the City Council create a permanent commission to advise the City on privacy-related issues. The resulting permanent Privacy Advisory Commission was established in 2016; its role and function is discussed later in this report. General advisory bodies The cities of Long Beach, San Ramon, and Foster City all have or had community groups dedicated to providing general advice and feedback on the City’s use of technology. In Long Beach, the Technology and Innovation Commission was established by ordinance in 2014. The commission comprises seven members, with at least five members being residents of the City of Long Beach. The commission includes one member with experience with technology startups/innovation; one member with experience with mobile/app technology; one member with experience in technology and education; and one member with experience in networking, servers or databases. The commission also includes three at-large members. Members are limited to four consecutive two-year terms. In San Ramon, the Innovation and Technology Advisory Committee was established by City Council resolution in 2019. The committee is charged with providing recommendations and policy guidance on smart city issues such as digital inclusion, mobility, economic growth and public safety. Committee members include four representatives who work in the technology industry and three at-large members, as well as two alternates. All members must either reside or work in the City of S an Ramon. In Foster City, the Information Technology Advisory Committee met from 2017 to 2019 and provided a general forum for the discussion of the role of technology in the city government. In a report summarizing the committee’s first year of work, members noted that they struggled to establish a direction for the committee because the City Council had not provided a clear mandate for the committee. “Having a clearer direction or purpose in the beginning would have likely helped here,” the committee wrote. The City of Portland, Oregon, established a Technology Oversight Committee in 2011 that serves in an advisory capacity to the city’s Chief Administrative Officer. This independent committee includes five members, each appointed by one member of the City Council. City departments are required to report technology projects to the committee in the early conceptual and design phases if the project is likely to have a widespread impact and present significant risk to the City’s financial and operational practices. The committee is charged with making recommendations to City staff regarding potential issues of proprietary data, copyright, security measures, business records, and other matters that may arise as a result of a given technology project. The City of Seattle, Washington established the Community Technology Advisory Board by ordinance in 2015. The board reviews and makes recommendations to City officials. The 10-member board includes one member representing public access to information technology, one member representing education, one young adult member, and seven at-large members. Members must live or work in the City of Seattle. The board includes a Privacy & Cybersecurity Committee whose mission is to ensure that residents’ personal data is protected by “sensible information security policies” and that residents are “free from unchecked surveillance.” 3 Surveillance oversight bodies The cities of Oakland, Berkeley, and Vallejo each have a body with formal duties delineated in the City Charter or City Municipal Code. Each of these bodies is specifically focused on surveillance technology, and each body has a formal role in approving the use of surveillance technology. In the City of Berkeley, the Police Accountability Board is responsible for overseeing and approving the City’s use of surveillance technology as defined in the Municipal Code. The City Council in 2018 adopted an ordinance governing the City’s acquisition and use of surveillance technology that requires the City Council to approve any use, acquisition, data sharing or policy related to surveillance technology as defined in the ordinance. Prior to City Council consideration, City staff must present a Surveillance Acquisition Report and Surveillance Use Policy for each type of surveillance technology to the Police Accountability Board. The role and function of the Police Accountability Board were modified by a City Charter Amendment in 2020. The board includes nine members selected by the Mayor and City Council; each member must be a resident of the City, may not be an employee of the City, and may not be a sworn police officer of any agency. Board members serve four-year terms. The City of Vallejo is in the process of establishing a new Surveillance Advisory Board. The board will comprise seven members, each appointed by a member of the City Council and residing in that councilmember’s district. The board member’s term will coincide with the term of the appointing councilmember. The Surveillance Advisory Board is charged with reviewing surveillance technology as defined in the Municipal Code, gathering public input on the use of technology, consulting with experts in the field, and providing recommendations to the City Council on the purchase, borrowing, or use of the technology. City departments are required to seek review by the Surveillance Advisory Board at least 45 days prior to finalizing the decision to acquire, borrow, or adopt a policy relating to the use of surveillance technology, except in emergency situations. The City of Oakland established the Privacy Advisory Commission in 2016. The commission is charged with submitting reports and recommendations to the City Council regarding the City’s surveillance ordinance, the City’s use of surveillance equipment, and the need for new or modified privacy and data retention policies for new surveillance equipment. The commission consists of nine members, at least six of whom must be Oakland residents. Members are appointed by the Mayor and confirmed by a vote of at least five members of the City Council. Members must demonstrate an interest in privacy rights through work experience, civic participation, or political advocacy. Members should meet at least one of the following criteria: attorney or activist; law enforcement; auditor or CPA; hardware, software or encryption security professional; membership in an organization advocating government transparency and openness. Members serve three-year terms. In 2018, the Oakland City Council passed a surveillance oversight ordinance that requires City staff to provide annual reports, impact reports, and use policies to the Privacy Advisory Commission and City Council regarding new and existing surveillance technologies. The ordinance requires City staff to notify the commission and obtain City Council approval prior to accepting state or federal funds or in-kind donations for surveillance technology, prior to acquiring surveillance technology, prior to using new or existing surveillance technology that has not previously been approved, and prior to sharing surveillance data outside of the city government.