HomeMy WebLinkAbout2024-03-11 PTAC Agenda PacketPrivacy Protection and Technology Advisory Commission
CITY COUNCIL-APPOINTED BOARDS & COMMISSIONS
Date: Monday, March 11, 2024
Time: 5:00 p.m. |
Location: City Hall, Bldg. C, Conference Room B-111
276 Fourth Avenue, Chula Vista
Privacy Protection and Technology Advisory Commission Meeting
Public Comments: Public comments may be submitted to the Privacy Protection & Technology
Advisory Commission in the following ways:
* In-person comments during the meeting. Each person will be allotted three (3) minutes to
address the Commission.
* Submit an eComment. Visit www.chulavistaca.gov/boardmeetings, locate this meeting, and
click the comment bubble icon. Click on the item you wish to comment on, then click "Leave
Comment."
° Submit comments via email to PTAC@chulavistaca.gov.
The commenting period will close at noon the day of the meeting. All comments will be made
available to the Commission and the public.
Accessibility: In compliance with the American Disabilities Act, if you need special assistance to
participate in this meeting, contact us at PTAC@chulavistaca.gov or (619) 691-5041. Providing at
least 48 hours notice will help ensure that reasonable arrangements can be made.
City of Chula Vista Privacy Protection and Technology Advisory Commission
Page
1. CALL TO ORDER
2. ROLL CALL
Commissioners Batson, Chambers, Godinez, Lake, Ruiz, Williams, and Wood.
3. PUBLIC COMMENTS
The public may address the Commission on any subject matter within the
Commission’s jurisdiction that is not listed as an item on the agenda. State law
generally prohibits the Commission from discussing or taking action on any issue
not included on the agenda. The Commission may schedule the topic for future
discussion or refer the matter to staff.
4. PRESENTATIONS
Action on presentation items is typically limited to the Commission receiving the
presentation and providing direction or feedback to staff unless otherwise noticed
on the agenda.
4.1. Overview of the Roles and Responsibilities of the Commission 3
5. ACTION ITEMS
Action items are considered individually by the Commission and are expected to
elicit discussion and deliberation.
5.1. Approval of Meeting Minutes 15
Recommended Action:
Approval of the minutes dated: February 5, 2024.
5.2 Selection of Chair and Vice Chair for Fiscal Year 23/24 19
Recommended Action:
To select a Chair and Vice Chair for the remainder of Fiscal Year 2023/24.
CHAIR'S COMMENTS
COMMISSIONERS' COMMENTS
ADJOURNMENT
to the regular meeting on May 6, 2024, at 5:00 p.m.
Materials provided to the Privacy Protection and Technology Advisory Commission
related to any open-session item on this agenda are available for public review by
contacting Commission staff at PTAC@chulavistaca.gov
March 11, 2024 Agenda Page 2 of 21
DocuSign Envelope ID: 7340E2BD-FB77-4600-A02E-D59382FC7D62_ . . . oy City of Chula Vista Privacy Protection and Technology Advisory Commission
ORDINANCE NO. 3553
ORDINANCE OF THE CITY OF CHULA VISTA ADDING
CHULA VISTA MUNICIPAL CODE CHAPTER 2.65,
“PRIVACY PROTECTION AND TECHNOLOGY ADVISORY
COMMISSION”
WHEREAS, the City of Chula Vista adopted a Smart City Strategic Action Plan “Action
Plan” in September 2017, establishing itself as a leader in the growing “smart city” movement,
earning recognition locally, nationally, and internationally for its innovative planned approach to
using technology to create a more efficient and effective government; and
WHEREAS, the City of Chula Vista continues to leverage innovative technology and data
tools to better serve and engage residents, enhance sustainability, improve .public safety, and
promote local economic development; and
WHEREAS, a key goal of the Action Plan approved by Council in September 2017 is to
continue efforts to become a more open and transparent City; and
WHEREAS, to support this goal, the City has set an objective to maximize the use of data
and analytics to improve services and increase public access to City information; and
WHEREAS, this effort involves ensuring that citywide technology and sensitive personal
information collected is managed and utilized in a secure, transparent, and safe way; and
WHEREAS, in April 2022, the Chula Vista City Manager formed a 12-member
Technology & Privacy Advisory Task Force “Task Force” to provide the City Manager policy
recommendations for consideration in the development of a citywide policy on technology and
privacy issues; and
WHEREAS, over the course of six months, the Task Force held ten public meetings,
received two on-site departmental tours, and held two community meetings resulting in 37 policy
recommendations, including the formation of a Privacy and Technology Advisory Commission; and
WHEREAS, on November |, 2022, based on input from the Task Force, key stakeholders,
and City staff, the City Council of the City of Chula adopted the City of Chula Vista Privacy
Protection and Technology Transparency Policy (Council Policy 112-04) “Policy”; and
WHEREAS, the Policy enhances City operations through a more reliable, secure, and safe
city network and data management process, increased oversight of citywide technology systems,
and improved accountability, transparency, and increased public trust; and
WHEREAS, the Policy provides, in section 2, that City will establish a Privacy and
Technology Advisory Commission responsible for a broad range of advisory duties to help
advance the City Council priorities of improving sensitive personal information management,
security, and privacy; and
March 11, 2024 Agenda Page 3 of 21
DocuSign Envelope ID: 7340E2BD-FB77-4600-A02E-D59382FC7D62_ . . . 4 City of Chula Vista Privacy Protection and Technology Advisory Commission
Ordinance No. 3553
Page No. 2
WHEREAS, City staff now recommends adding Chapter 2.65 to the Chula Vista Municipal
Code, establishing the Privacy Protection and Technology Advisory Commission and its rules and
procedures.
NOW, THEREFORE, the City Council of the City of Chula Vista does ordain as follows:
Section I. That Chapter 2.65 is hereby added to the Chula Vista Municipal Code, to read
as follows:
Chapter 2.65
PRIVACY AND TECHNOLOGY ADVISORY COMMISSION
2.65.010 Creation.
There is hereby created a Privacy Protection and Technology Advisory Commission (the
“Commission”). The provisions of Article VI of the City Charter, the general rules governing
boards and commissions set forth in Chapter 2.25 CVMC, and the provisions of this chapter shall
govern the Commission.
2.65.020 Purpose and intent.
It is the purpose and intent of the City Council in establishing the Commission to create an advisory
body to receive public input and serve as a resource to advise and make recommendations to the
City Council to advance the City Council priorities of improving sensitive personal information
management, security, and privacy.
2.65.030 Functions and duties.
The functions and duties of the Commission shall be as follows:
A. Review and advise the City Council on the City’s technology use policies.
B. Review and advise the City Council on City’s Surveillance Technology impact reports and
annual reports, as described in the Privacy Protection and Technology Transparency Policy
(Council Policy 112-04).
C. Review, consider, and provide recommendations to the City Council on the acquisition of
Surveillance Technology, as described in the Privacy Protection and Technology Transparency
Policy (Council Policy 112-04) during the City’s acquisition process.
Dz. Review and advise the City Council on the procurement standards for agreements
involving Sensitive or Surveillance Technology, as described in the Privacy Protection and
Technology Transparency Policy (Council Policy 112-04).
March 11, 2024 Agenda Page 4 of 21
DocuSign Envelope ID: 7340E2BD-FB77-4600-A02E-D59382FC7D62_ City of Chula Vista Privacy Protection and Technology Advisory Commission
Ordinance No. 3553
Page No. 3
2.65.040 Limits on authority.
Per Charter Section 600, the Commission shall have no authority to direct the conduct of any
department. The Commission is advisory in nature, and as such shall have no authority to approve,
disapprove, or prevent any City action.
2.65.050 Membership.
A, The Commission shall consist of seven Voting Members and one Ex Officio member to be
nominated and appointed in accordance with Article VI of the City Charter, Chapter 2.25 CVMC,
and this chapter.
l. District-Based Appointments. Four Voting Members shall be nominated and appointed in
accordance with the district-based appointment process specified in CVMC 2.25.052(C). A
nominee shall not be required to live in the same district as the respective nominating Council member.
ae General Appointments. Following the four district-based appointments, three additional
Voting Members shall be nominated and appointed in accordance with the general appointment
process specified in CVMC 2.25.052(A), with a goal of addressing all areas of expertise identified
in Subsection C.
3. Future Vacancies. Future vacancies of District-Based Appointment seats and General
Appointment seats shall be filled pursuant to subsection A.1. or A.2. above, respectively, with the
aim to preserve the Commission’s subject matter competency as outlined in subsection C.
B. Non-residents of the City of Chula Vista may be appointed and serve as Voting Members
or Ex Officio Members if they own and operate a business and/or property with a physical address
in the City of Chula Vista. Appointment of non-resident members must be passed by at least a
four-fifths vote of the Council, in accordance with Charter section 602(D).
Cc. All Commission members should have expertise and background in at least one of the
fields described in subsections (C)(1) through (5) below. Each of the expertise fields described in
subsections (C)(1) through (5) below should be represented by at least one Voting Member.
Notwithstanding the foregoing, the absence of candidates with expertise in one of the following
areas shall not preclude the appointment of the full Commission.
l. Information Technology & Data Security: Experience and/or expertise in cyber security
and sensitive personal information management and protection.
2. Privacy Protection: Experience and/or academic or legal background related to individual
privacy protection, open government principles and structures, and/or government transparency.
3. Accounting and Finance: Experience and/or professional credentials in contracting,
procurement, public auditing, control, compliance, and/or general oversight professional services.
4. Public Safety: Experience and/or expertise in federal, state, or local government public safety
functions and operations.
March 11, 2024 Agenda Page 5 of 21
DocuSign Ch ID: 7340E2BD-FB77-4600-A02E-D59382FC7D62 City of Chula Vista Privacy Protection and Technology Advisory Commission
Ordinance No. 3553
Page No. 4
5. Equity and Civil Rights: Experience or legal background in the advocacy for marginalized
groups and communities who have traditionally experienced privacy and civil rights concerns
based on sex, gender, disability, socio-economic profile, national origin, culture, or ethnic background.
D. The City Manager or designee with expertise in the fields described in subsection (C)(1)
through (5), above, shall have the opportunity to review applications and provide input on the
applicant’s qualifications, which shall be considered by the Mayor or City Councilmember before
a nomination is made.
E. The Ex Officio Member shall be nominated by the City Manager and appointed in
accordance with the Designated Member Appointment Process specified in CVMC 2.25.052(D).
For purposes of CVMC 2.25.052(D), the City Manager is the Nominating Authority.
2.65.060 Meeting frequency and schedule.
In accordance with CVMC 2.25.200, the Commission shall set the date, time, and location of its
regular meetings by written resolution and may change its regular meeting day, time, or location
by written resolution. The Commission’s meeting schedule shall include at least one regular
meeting every other month through December 31, 2024, and then one regular meeting quarterly thereafter.
Section II. Severability
If any portion of this Ordinance, or its application to any person or circumstance, is for any reason
held to be invalid, unenforceable or unconstitutional, by a court of competent jurisdiction, that
portion shall be deemed severable, and such invalidity, unenforceability or unconstitutionality
shall not affect the validity or enforceability of the remaining portions of the Ordinance, or its
application to any other person or circumstance. The City Council of the City of Chula Vista
hereby declares that it would have adopted each section, sentence, clause or phrase of this
Ordinance, irrespective of the fact that any one or more other sections, sentences, clauses or
phrases of the Ordinance be declared invalid, unenforceable or unconstitutional.
Section I. Construction
The City Council of the City of Chula Vista intends this Ordinance to supplement, not to duplicate
or contradict, applicable state and federal law and this Ordinance shall be construed in light of that intent.
Section IV. Effective Date
This Ordinance shall take effect and be in force on the thirtieth day after its final passage.
Section V. Publication
The City Clerk shall certify to the passage and adoption of this Ordinance and shall cause the same
to be published or posted according to law.
March 11, 2024 Agenda Page 6 of 21
DocuSign Envelope ID: 7340E2BD-FB77-4600-A02E-D59382FC7D62_ | ; ; — City of Chula Vista Privacy Protection and Technology Advisory Commission
Ordinance No. 3553
Page No. 5
Presented by Approved as to form by
DocuSigned by: DocuSigned by:
Maria bachadoorian, Jil B.S. Maland
F4BB5CABC5014C0.. EFB949DC9B5747E...
Maria V. Kachadoorian Jill D.S. Maland
City Manager Lounsbery Ferguson Altona & Peak
Acting City Attorney
PASSED, APPROVED, and ADOPTED by the City Council of the City of Chula Vista,
California, this 25th day of July 2023, by the following vote:
AYES: Councilmembers: Cardenas, Chavez, Gonzalez, and Preciado
NAYS: Councilmembers: McCann
DocuSigned by:
i \i # | tla [Wel hee
7804EC23B90B473...
John McCann, Mayor
ABSENT: Councilmembers: None
ATTEST:
DocuSigned by:
heecaspbrysy
3074D104EAF342E...
Kerry K. Bigelow, MMC, City Clerk
STATE OF CALIFORNIA )
COUNTY OF SAN DIEGO )
CITY OF CHULA VISTA )
I, Kerry K. Bigelow, City Clerk of Chula Vista, California, do hereby certify that the foregoing
Ordinance No. 3553 had its first reading at a regular meeting held on the 11th day of July 2023,
and its second reading and adoption at a regular meeting of said City Council held on the 25th day
of July 2023 and was duly published in summary form in accordance with the requirements of
state law and the City Charter.
DocuSigned bys
7/31/2023 [dee bbin
3074D104EAF342E.
Dated Kerry K. Bigelow, MMC, City Clerk
March 11, 2024 Agenda Page 7 of 21
c
City of Chula Vista Privacy Protection and Technology Advisory
‘Commission
COUNCIL POLICY
CITY OF CHULA VISTA
SUBJECT: PRIVACY PROTECTION AND POLICY | EFFECTIVE TECHNOLOGY TRANSPARENCY NUMBER DATE PAGE POLICY OHC 112-04 11/1/2022 1 OF7
2 en es
| ADOPTED BY: 2022-238 DATED: 11/1/2022
AMENDED BY: N/A | | | [BACKGROUND
The City of Chula Vista uses many technology systems to effectively and efficiently deliver public
services. Technology available to the City has expanded from more simple tools, such as email and
spreadsheets, to more complex systems that involve the automated collection and analysis of a broad
range of data, including Sensitive Personal Information. Emerging technologies tend to involve the
collection or generation of large amounts of data that can later be processed or analyzed. As the scope
of City use of data and technology has grown, risks to individual privacy have become more apparent.
As the City continues to explore new ways to use technology, the community has expressed a desire
for greater levels of transparency and public engagement in decision-making around City acquisition
and use of certain technologies impacting privacy.
PURPOSE
| This policy has multiple purposes:
e To respond to valid community concerns regarding sharing of personal information through the use
of technology that has the potential for adverse impacts on civil liberties
| e To safeguard the security, accuracy, and control of access to City data and technology systems
To protect the civil rights and civil liberties of Chula Vista community members and visitors,
including rights to privacy
e To ensure that expert advice and community input is included as part of City decision-making
involving the acquisition and use of privacy-impacting technology
To protect against the waste of taxpayer funds
To promote transparency in the acquisition and use of privacy-impacting technology by the City
e To build and maintain public trust in the City and its use of technology to deliver public services
POLICY
1. Definitions:
1.1. Acquire: to obtain, purchase, lease, rent, borrow, create, develop, or accept in donation
1.2. Exigent Circumstances: Circumstances where, based upon a good faith belief, one or more of
the following conditions exists: an emergency involving danger of death or serious physical
injury to any individual, or imminent danger of significant property damage or monetary loss
to any individual or organization, or an imminent threat to an individuals’ civil liberties or
rights.
1.3. General Technology: Any electronic device, software program, or hosted software solution
that does not meet the definition of Sensitive Technology or Surveillance Technology.
1.4. Sensitive Personal Information: Information that reveals a person’s social security number,
driver’s license information, state identification card, passport number, military identification
number, financial account numbers, debit card number, credit card number, account log-in
credentials, IP address, email address, phone number, home address, precise geolocation at a
|
City of Chula Vista Privacy Protection and Technology Advisory
Commission
COUNCIL POLICY CITY OF CHULA VISTA 2
SUBJECT: PRIVACY PROTECTION AND POLICY | EFFECTIVE ; TECHNOLOGY TRANSPARENCY NUMBER DATE PAGE
POLI 112-04 11/1/2022 20F7
ADOPTED BY: 2022-238 DATED: 11/1/2022 |
AMENDED BY: N/A
given time, biometric information, contents of email, contents of mail, contents of text
messages, ethnic origin, racial origin, genetic data, medical information, health information,
immigration status, philosophical beliefs, political opinions, religious beliefs, sexual
orientation, union membership, or membership in any other private organization, in each case
to which a person has a reasonable expectation of confidentiality or privacy. For purposes of
this definition and this policy, Sensitive Personal Information does not include information
recorded, obtained or disclosed as a part of an active criminal investigation, a lawful judicial
hearing or process, or in accordance with other legal or statutory requirements.
1.5. Sensitive Technology: Any electronic device, software program, or hosted software solution
owned or operated by the City that generates or collects Sensitive Personal Information, but
which is not designed or intended to be used for surveillance.
For the purposes of this definition and this policy, Sensitive Technology does not include the
| following:
e Standard office technology such as email systems, copy machines, telephone networking
systems, or broadly available consumer software such as Microsoft Office applications S)
e IT infrastructure only intended to manage backend or operational data. |
e Technology solely intended to manage the Sensitive Personal Information of City
employees, such as payroll, employment applications, health and retirement benefits.
e Technology solely intended to manage the internal administrative functions of the City,
such as case management systems and revenue collection and billing systems.
1.6. Surveillance or surveil: To observe the movements, behavior, or actions of identifiable
individuals, or to gather information that can readily be connected to identifiable individuals
(for example, an automated license plate reader program), for purposes of analysis in
accordance with a program or plan, without the knowledge and consent of the observed
individuals. Observations that are incidental or part of a focused, ongoing investigation shall
not be considered surveillance for the purposes of this definition and this policy.
1.7. Surveillance Technology: Any electronic device, software program, or hosted software
solution owned or operated by the City that is designed or primarily intended to be used for the
purpose of Surveillance.
For the purposes of this definition and this policy, Surveillance Technology does not include
the following:
e Cameras installed on City property solely for the purpose of maintaining the security of
that property.
e Cameras installed solely to protect the physical integrity of City infrastructure, such as
sewers and storm drains.
e Technology that monitors only City employees in the performance of their City
functions.
e Public safety officer body-worn cameras.
ee socom 0 carpe ae = — = RE ———
City of Chula Vista Privacy Protection and Technology Advisory
Commission
COUNCIL POLICY
CITY OF CHULA VISTA
SUBJECT: PRIVACY PROTECTION AND POLICY | EFFECTIVE | TECHNOLOGY TRANSPARENCY NUMBER DATE PAGE POLICY OLE 112-04 11/1/2022 3OF7
ADOPTED BY: 2022-238 | DATED: 11/1/2022
AMENDED BY: N/A iI
2. Privacy and Technology Advisory Commission
2.1. The City will establish a City Council advisory commission referred to herein as the Privacy
and Technology Advisory Commission (“PTAC”) responsible for carrying out a broad range
of advisory duties described in this policy. In general, PTAC duties shall include (a) reviewing
and advising on City technology use policies, Surveillance Technology impact reports, annual
reports, procurement standards for agreements involving Sensitive or Surveillance Technology,
and (b) facilitating public discussion of important issues related to privacy and City technology.
2.2. The PTAC should include (but not be limited to) members who have the following
perspectives:
e Experts in emerging technologies and systems
| e Financial auditors and certified public accountants
e Attorneys, legal scholars, and recognized academics with expertise in privacy and/or civil
i} rights
Members of organizations that focus on government transparency or individual privacy
Representatives from equity-focused organizations |
Public safety professionals
Individuals with experience or expertise in the functions of local government
3. Support from Privacy and Technology Experts
3.1. The City Manager shall seek the advice of one or more City staff members or consultants with
privacy and technology expertise (“PT Advisor’), as appropriate, for the following purposes:
e Provide training and guidance to City staff on privacy issues
Serve as an advisor or liaison to the PTAC
e Perform internal audits and monitor compliance with City privacy and technology use
policies;
e Coordinate with external privacy auditors when applicable;
e Assist in the evaluation of new technology acquisitions for potential privacy issues
4. Use policies:
4.1. The City Manager shall establish a process for determining whether a particular technology is
classified as General Technology, Sensitive Technology, or Surveillance Technology. Such
process may include review by an internal group of designated City staff and/or the PT Advisor.
4.2. The City Manager shall create one written use policy that applies to all General Technology.
The City Manager shall also create use policies covering each Sensitive Technology or
Surveillance Technology. Where City Council approval of any technology acquisition is
required, the related use policy shall be presented to the City Council for its consideration at
the time of the requested approval as provided in Section 6, below.
4.3. Every use policy for a Sensitive Technology or Surveillance Technology shall include the
following information: (a) City purpose and objectives for acquiring and deploying the
b) range of authorized uses and users, (c rotocols for data collection, access,
City of Chula Vista Privacy Protection and Technology Advisory
Commission
COUNCIL POLICY
CITY OF CHULA VISTA
SUBJECT: PRIVACY PROTECTION AND POLICY | EFFECTIVE TECHNOLOGY TRANSPARENCY NUMBER DATE PAGE
ieee 112-04 11/1/2022 4OF7
[ ADOPTED BY: 2022-238 DATED: 11/1/2022 |
| AMENDED BY: N/A
protection, retention, management, and sharing (including sharing among City departments),
(d) technology maintenance protocols, (e) training requirements, and (f) provisions for auditing
and oversight.
. Use policies shall be reviewed and updated by the City Manager from time to time, as
appropriate, with input from the PT Advisor. Use policy reviews, and updates as necessary,
should occur at any time there is a significant change in the function or purpose of the subject
technology, or there are material changes in applicable laws or best practices.
. The order in which use policies are created or updated for existing Sensitive or Surveillance
Technologies shall be determined by the City Manager, with input from the PT Advisor. Such
| | determinations shall be made based on a consideration of the technology’s potential data
security risks and adverse impacts on individual privacy.
4.6. All use policies must be consistent with federal, state, and local laws and shall be reviewed by |
the City Attorney for legal compliance.
5. Surveillance Technology impact reports (STIR) »)
5.1. Prior to acquiring a Surveillance Technology, the acquiring City Department shall draft a
Surveillance Technology impact report (STIR) for that technology subject to the review and
approval of the City Manager. Departments should solicit input from the PT Advisor for
assistance in developing such reports. Where City Council approval of any technology
acquisition is required, the related STIR report shall be presented to the City Council for its |
consideration at the time of the requested approval as provided in Section 6, below.
5.2. Surveillance Technology impact reports should, at a minimum, (a) evaluate the potential for
| disproportionate adverse impacts on certain groups or parts of the community, (b) where such
a
a
impacts exist, identify, where feasible, specific measures to mitigate those impacts; (c) evaluate
the potential for adverse impacts on the security of data storage and access controls within city
systems, particularly with respect to Sensitive Personal Information; (d) where such impacts
exist, identify, where feasible, specific measures to mitigate those impacts; (e) evaluate the
potential financial impacts on the City budget, including current or potential sources of funding;
(f) describe potential alternatives to the technology and explain why those alternatives were not
chosen.
5.3. The City should update a STIR as appropriate, any time there is a significant change in the
function or purpose of the subject technology, any time there are material changes in applicable
laws or best practices, or in the event of any other material change that could have an impact
on data security or privacy interests.
6. Surveillance Technology acquisition process: |
6.1. Any City Department intending to acquire Surveillance Technology shall, prior to acquisition,
obtain City Council approval of the acquisition, along with the associated use policy and STIR.
City departments shall include a summary of comments and recommendations from the PTAC oS)
in their report to the City Council.
City of Chula Vista Privacy Protection and Technology Advisory
Commission
| COUNCIL POLICY CITY OF CHULA VISTA
SUBJECT: PRIVACY PROTECTION AND POLICY | EFFECTIVE | | TECHNOLOGY TRANSPARENCY NUMBER DATE PAGE
BOLE 112-04 11/1/2022 5 OF7
ADOPTED BY: 2022-238 | DATED: 11/1/2022
AMENDED BY: N/A
| 6.2. City Departments shall, prior to seeking City Council approval for the acquisition of
Surveillance Technology, present the applicable use policy and STIR to the PTAC for their
input and recommendations. If the PTAC does not act within 60 days of receiving the
acquisition proposal from a City Department, the department may proceed to City Council
without their recommendation.
| 6.3. When soliciting proposals for Surveillance Technology, the City shall require respondents to
provide information regarding any previous security breaches.
6.4. All Surveillance Technology acquisitions shall be procured by written agreement, approved as
to form by the City Attorney, containing in substantial form the data security and privacy
| provisions described in this policy.
7. Transparency in the use of Sensitive and Surveillance Technology:
7.1. City Manager’s Report to the PTAC. The City Manager shall provide a report at least once
every two years to the PTAC regarding the status of City use of Surveillance Technology. To
the extent feasible and applicable, the report shall include, at a minimum, the following
information for the applicable time period: (a) how Surveillance Technologies have been used,
(b) how frequently have the technologies been deployed, including material usage patterns
changes (if any) over time; (c) if and how often has data from Surveillance Technology been
shared with other entities, and whether any of that data included Sensitive Personal
I Information; (d) an evaluation of whether Surveillance Technology is having a disproportionate
adverse impact on certain groups or geographic areas of the City; (e) an evaluation of the
effectiveness of any identified mitigation measures; (f) a summary of the total annual costs for
| the use of Surveillance Technology; and (g) a summary of any incidents involving unauthorized
| releases of Sensitive Personal Information. |
7.2. Public Space Signage. Where feasible, signs should be posted to notify and disclose the use
of Sensitive or Surveillance Technology at public facilities or within City rights of way. For
example, if surveillance cameras are added to a park, signs should be posted near the
entrance(s) to the park notifying visitors that they are under video surveillance.
7.3. City Website. The City shall post to the City website, in a manner that is easy to find and
understand, the following information:
e A list of Sensitive and Surveillance Technologies that have been acquired within the last
fiscal year
A list of Sensitive and Surveillance Technologies the City currently uses
Use policies for all Sensitive and Surveillance Technologies
STIRs for all Surveillance Technologies
The City Records Retention Schedule
. Data Collection, Retention, Sharing, Management
8.1. The City shall not sell or allow unauthorized third-party access to Sensitive Personal
Information.
City of Chula Vista Privacy Protection and Technology Advisory
Commission
COUNCIL POLICY CITY OF CHULA VISTA
SUBJECT: PRIVACY PROTECTION AND POLICY | EFFECTIVE TECHNOLOGY TRANSPARENCY NUMBER DATE PAGE I POLICY 112-04 11/1/2022 6 OF7
ADOPTED BY: 2022-238 DATED: 11/1/2022
| AMENDED BY: N/A | |
8.2. The City shall ensure that all technology agreements involving the collection or storage of data
that may include Sensitive Personal Information contain appropriate provisions, approved by
the City Attorney, with input from the PT Advisor, that prohibit vendors from sharing data that
includes Sensitive Personal Information owned or accessible by the City or a vendor except as
necessary to provide the contracted service to the City.
8.3. The City shall ensure that agreements related to the acquisition or use of Sensitive or
Surveillance Technology include a clause that allows the City to terminate the agreement for
cause in the event the vendor violates any restriction on the sale or sharing of data or otherwise
violates individual privacy protections.
8.4. The City shall seek to minimize the amount of Sensitive Personal Information departments
| collect when providing services so that the only data collected is the data necessary to provide
| the service.
8.5. The City Clerk shall ensure that the Records Retention Schedule reflects where Sensitive
Personal Information is held by the City and how long that information is retained.
8.6. The requirements of this section do not apply to (a) any disclosure of data that is required by
law, including without limitation the Public Records Act and Political Reform Act; or (b) in
| the discretion of the City Manager, the sharing of information necessary to support routine and
necessary government operations or administration. Examples include: transferring 9-1-1 calls,
transferring criminal records, transferring public health data to county or state public health
agencies, sharing medical data with external parties for billing purposes, sharing employment
information for verification or compliance purposes, and sharing data required for grant
program compliance.
9. Information security
9.1. The City shall establish a cyber roadmap that protects Sensitive Personal Information from |
being exploited by unauthorized sources.
9.2. The City shall disclose unauthorized releases of Sensitive Personal Information to affected
individuals as soon as practicable, subject to all applicable state and federal laws.
10. Exceptions
ID.1, Interagency Task Force Activities. City staff assigned to interagency task force activities
are exempt from the requirements related to acquisition and use of Sensitive and Surveillance
Technology solely to the extent of their duties and work related to their assignment to the
interagency task force.
10.2. Exigent Circumstances. City departments may temporarily acquire or use Surveillance
Technology and the data derived from that use in a manner not expressly allowed by an existing
use policy only in a situation involving exigent circumstances and only with prior authorization
from the City Manager or designee. If City departments acquire or use Surveillance Technology |}
in a situation involving exigent circumstances, the City Manager shall report the use of the
technology and the justifications for using the technology to the City Council at the conclusion
City of Chula Vista Privacy Protection and Technology Advisory
Commission
cece — —a $$$ — ee ||
COUNCIL POLICY CITY OF CHULA VISTA
SUBJECT: PRIVACY PROTECTION AND POLICY | EFFECTIVE | TECHNOLOGY TRANSPARENCY NUMBER DATE PAGE POLICY 112-04 11/1/2022 70F7 |
—_—— — — ———
ADOPTED BY: 2022-238
AMENDED BY: N/A
DATED: 11/1/2022
of the exigent circumstances. When the exigent circumstances end, the department will
immediately cease using the technology and dispose of any data not directly relevant to an
| ongoing investigation or the exigent circumstances. If the department intends to continue using
the technology after the end of the exigent circumstances, they must seek approval as outlined
in Section 6 of this policy. The exigent circumstance does not exempt disclosure as outlined in
Section 7 of this policy.
| 10.3. City Access to Private Video Feeds. The City will work with the PTAC to further
develop this policy as it pertains to privately owned video feeds provided to the City by private
individuals or organizations.
10.4. Waivers. The City Manager or City Council as appropriate may waive elements of this
policy in the event of exigent circumstances or other circumstances that make compliance
impossible or infeasible.
11. Training, Compliance, and Enforcement of the Policy and Compliance with Laws.
11.1. The City Manager, with input from the City Attorney and the PT Advisor, will be
responsible for interpreting and overseeing City compliance with the terms of this policy.
Oversight shall include (a) requiring City employee compliance with the policy as a condition
of employment; and (b) assuring that City employees or individuals who report the suspected
improper use of Sensitive Technology or Surveillance Technology shall be protected from
retaliation in employment.
112. The City does not intend by adopting this policy to grant any third party the right to
enforce this policy against the City or any individual City employee and there shall be no
private right of action created hereby.
11.3, All City activities conducted pursuant to the terms of this policy, including, without
limitation, all data collection, retention, sharing, and management activities, shall be conducted
in a manner that is consistent with all applicable federal, state, and local laws, including,
without limitation, laws governing the collection, storage and disclosure of Sensitive Personal
Information, and the protection of individual civil rights and liberties. In the event that there is
a conflict between this policy and applicable laws, the applicable laws shall govern.
11.4. Where necessary or appropriate, with the input of the PT Advisor, the City shall provide
training to key City departments and staff to ensure they are equipped to recognize and manage
otential data privacy issues and perform their role and function.
City of Chula Vista Privacy Protection and Technology Advisory Commission
Win
aS
CITY OF CHULA VISTA
SPECIAL MEETING OF THE PRIVACY PROTECTION AND TECHNOLOGY ADVISORY COMMISSION
Meeting Minutes
February 5, 2024, 5:00 p.m.
City Hall, Bldg. C, Conference Room B-111
276 Fourth Avenue, Chula Vista
Present: Commissioner Batson, Commissioner Chambers, Commissioner
Godinez, Commissioner Gonzales, Commissioner Lake,
Commissioner Ruiz, Commissioner Williams, Commissioner
Wood
Also Present: Director of Information Technology Services Cisneros, Deputy
City Clerk Zepeda, City Clerk Bigelow, Jill Maland representing
Lounsbery Ferguson Altona & Peak LLP, Interim Acting City
Attorney
1. CALL TO ORDER
The meeting was called to order at 5:04 p.m.
2. ROLL CALL
City Clerk Bigelow called the roll.
Commissioner Williams joined the meeting at 5:05 p.m.
3. INTRODUCTIONS
3.1.‘ Introductions of Commissioners and Staff
Commissioners and staff gave introductions.
March 11, 2024 Agenda Page 15 of 21
City of Chula Vista Privacy Protection and Technology Advisory Commission
2024/02/05 Privacy Protection and Technology Advisory Commission Special Meeting Minutes
4. PRESENTATIONS
4.1 Presentation by Staff on City of Chula Vista Commission Roles,
Duties, and Procedures
City Clerk Bigelow and Acting City Attorney Maland gave a presentation
and responded to questions from the commission.
Robert Johnson spoke regarding the commission and submitted written
comments.
5. ACTION ITEMS
5.1 Discussion of a Selection Process of a Chair and Vice Chair
City Clerk Bigelow provided options for selecting the commission Chair
and Vice Chair.
Moved by Adolfo Gonzales
Seconded by Guy Chambers
To adopt the sample selection process for appointing a chair/vice chair, as
proposed by staff, to select the initial chair and vice chair.
Yes (7): Commissioners Chambers, Godinez, Gonzales, Lake, Ruiz,
Williams, and Eric Wood
Result, Carried (7 to 0)
5.2. Initial Classification of Appointees to Determine the Expiration of
Each Commissioner's Term
City Clerk Bigelow spoke regarding the item.
Deputy City Clerk Zepeda drew names by lot to determine the expiration
date of each commissioner.
Moved by Adolfo Gonzales
Seconded by Devon Williams
To determine term expiration dates for each commissioner by lot, in
accordance with Chula Vista Charter § 602(B), with the assistance of the
City Clerk and City Attorney.
Page 2
March 11, 2024 Agenda Page 16 of 21
City of Chula Vista Privacy Protection and Technology Advisory Commission
2024/02/05 Privacy Protection and Technology Advisory Commission Special Meeting Minutes
Term expirations were carried by the following hat draw and the motion
was Carried by the following vote:
June 30, 2024 - Term No. 0*: Godinez, Chambers
June 30, 2025 - Term No. 0*: Batson, Gonzalez
June 30, 2026 - Term No. 1: Williams, Ruiz
June 30, 2027 - Term No. 1: Wood, Lake
“Initial terms of less than 2 years do not count as a term of the purposes of
term limits.
Yes (7): Commissioners Chambers, Godinez, Gonzales, Lake, Ruiz,
Williams, and Eric Wood
Result, Carried (7 to 0)
5.3 Discussion and Selection of the Date and Time for Regular Privacy.
Protection and Technology Advisory Commission Meetings
City Clerk Bigelow spoke regarding the item.
Moved by Adolfo Gonzales
Seconded by Guy Chambers
To adopt Resolution No. 2024-001 to set the regular meeting day, time,
and location for 2024 as March 11, May 6, July 1, August 5, October 7 and
December 2, with meetings commencing at 5:00 p.m. at City Hall, Building
C, Room 111/112.
Yes (7): Commissioners Chambers, Godinez, Gonzales, Lake, Ruiz,
Williams, and Eric Wood
Result, Carried (7 to 0)
6. STAFF COMMENTS
There were none.
7. COMMISSIONERS' COMMENTS
There were none.
Page 3
March 11, 2024 Agenda Page 17 of 21
City of Chula Vista Privacy Protection and Technology Advisory Commission
2024/02/05 Privacy Protection and Technology Advisory Commission Special Meeting Minutes
8. ADJOURNMENT
The meeting was adjourned at 6:27 p.m.
Minutes prepared by: Tyshar L. Turner, Deputy Director City Clerk Services
Commission Secretary
Page 4
March 11, 2024 Agenda Page 18 of 21
== == CHULA VISTA Staff Report
Privacy Protection & Technolgy
Advisory Commission: ¥
March 11, 2024
ITEM TITLE: Selection of Chair and Vice Chair for Fiscal Year 23/24
TECHNOLOGY CLASSIFICATION: N/A
DEPARTMENT: Information Technology Services (ITS)
RECOMMENDATION
To select a Chair and Vice Chair for the remainder of Fiscal Year 23/24.
DISCUSSION
The intention is to conduct the selection process for Chair and Vice Chair in accordance with the
process (Attachment 1) adopted at the February 5, 2024, Special Privacy Protection & Technology
Commission Meeting. However, the adopted process required members interested in serving as
Chair/Vice Chair to submit a statement of qualifications by the February 26, 2024, deadline. Staff did
not receive any statements of qualifications by that deadline and extended the deadline to March 6,
2024. Staff did not receive any statements of qualifications by the extended deadline.
Since no interest has been shown in serving as Chair/Vice Chair, staff will ask the Commission
members to volunteer as Chair/Vice Chair. Should this process be unsuccessful, staff recommends
the name of each Commissioner be placed into a computer list generator which will randomly select
an individual name. One name will be drawn for the Chair and one for the Vice Chair. The selected
members will serve for the remainder of Fiscal Year 23/24. At the beginning of Fiscal Year 24/25, a
new Chair and Vice Chair can be selected, or the Commission can choose to extend terms.
It should be noted that the seat held by the ex officio member of the Commission cannot serve as the
Chair/Vice Chair.
CURRENT- YEAR FISCAL IMPACT: N/A
ONGOING FISCAL IMPACT: N/A
ATTACHMENT(S)
1. Adopted Process for the Selection of Chair and Vice Chair/Voting Tally Sheet
STAFF CONTACT
Jacey Kinnaird, IT Project Manager
Jose Cisneros, Director of Information Technology Services
Page 1 of 1
March 11, 2024 Agenda Page 19 of 21
City of Chula Vista Privacy Protection and Technology Advisory Commission
Attachment 1
Process for Appointing a Chair/Vice Chair
1. Commissioners interested in serving as Chair or Vice Chair submit their
names and a brief statement of qualifications (maximum % page) to the
City Clerk (ptac@chulavistaca.gov) no later than Monday, February 26.
2. The City Clerk will attach the statements to an item on the next
Commission agenda.
3. At the next meeting, each Commissioner who submitted a statement will
be given one minute to speak about their qualifications.
4. The secretary distributes blank tally sheets. Note: All tally sheets are public
documents and are part of the public record.
5. Using the tally sheet, each Commissioner select the name of one nominee.
Commissioners may vote for themselves.
6. The secretary tallies the nominations and announces the results.
7. The Commission makes a motion and second to appoint the top vote-getter
as chair and the 2™ runner-up as vice chair. Commission votes on the
motion.
Options if there is a tie for chair/vice chair:
- Secretary could determine winner by random draw
- Commissioners could complete a new tally sheet and vote among the
tied commissioners
Approved and Adopted 2/5/2024
March 11, 2024 Agenda Page 20 of 21