37608

WHEREAS, on June 19, 2019, City Council Resolution 37437 established Privacy and Information Protection Principles to serve as guidance for how the City of Portland collects, uses, manages, and disposes of data and information, and directed staff at the Bureau of Planning and Sustainability and Office of Equity and Human Rights to identify and develop policies and procedures that promote these Principles; and

WHEREAS, on September 9, 2020, City Council unanimously approved two ordinances, 190113 and 190114, that prohibit the use of face recognition technologies in Portland. These ordinances respond to lack of transparency and accountability in addition to biased technology which include and the collection of sensitive information from Portlanders with little safeguards and public awareness; and

WHEREAS, over the years, various City entities have researched and discussed the benefits, risks and potential harms related to data collection and surveillance technologies, including city audits, internal assessments and looking externally at other municipalities. From those efforts, recommendations for a citywide approach to surveillance have included but are not limited to the following (1) Create procedures that limit access to sensitive information; (2) Adopt a directive that includes Council authorization of surveillance technology by any city bureau and advice from a privacy commission; and (3) Require periodic public reports on city bureau uses of surveillance; and

WHEREAS, Surveillance Technologies mean any electronic or analog device, equipment, software, information and/or associated metadata, automated decision systems, data processing system, or software solution that is designed or primarily intended to be used for the purpose of surveillance; and

WHEREAS, "Surveillance" or "surveil" means to observe, collect, purchase, or analyze information generated from people’s lives and their social, work, and/or physical interactions, including information linked to the identity, movements, culture, linguistic knowledge, nature, and history of an individual or group of individuals. This information can include biometrics, social, behavioral, emotional, or mental states, physical or virtual location, historical data, relationships, and any derivative product from personal information, including metadata, models, and data templates; and

WHEREAS, Automated Decision Systems (ADS) are the processes, set of rules, or tools based on automated processing of data to perform calculations, create new data, or to undertake complex reasoning tasks. This includes advanced methods like artificial intelligence and machine learning, visual perception, speech or facial recognition, and automated translation between languages; and

WHEREAS, the use of smart city technologies, such as sensors, connected devices, and always-on data flows that manage transportation systems, support real-time infrastructure maintenance, automatically administer public services, enable transparent decision making, and open data, and support emergency services in public areas, can provide real benefits to governments and communities; and

WHEREAS, Surveillance Technologies have historically disproportionate negative impacts against marginalized people. Impacted communities include Black and Brown people, those who don't have personal devices, people living with mental health issues, people experiencing houselessness, and those participating in civic engagement activities; and

WHEREAS, the emergence of big data, mass surveillance and automated decision systems, including artificial intelligence, has changed the way in which personal or group information is collected and managed. These new technologies create new privacy risks and impacts, including racial and cultural biases, and equitable access and use of technology; and

WHEREAS, the City has already implemented some protections to private, sensitive, and confidential information; it still needs to update or develop new procedures, training and invest in organizational infrastructure and capacity to implement privacy best practices. Complex privacy rules and modern data management strategies can create unforeseen risks and impacts, in addition to those intrinsic to the technologies and nature of information; and

WHEREAS, a Privacy Impact Assessment (PIA) is a systematic process for evaluating a proposal to procure and use a technology and/or data collection process in terms of its impact upon privacy. The PIA helps a bureau to (a) identify the potential effects that a proposal may have upon individual privacy (b) examine how any detrimental effects upon privacy might be overcome, and (c) ensure that new projects comply with existing information protection regulation, agreements and the City’s Privacy and Information Protection Principles; and

WHEREAS, the Smart City PDX program and the Office of Equity and Human Rights have compiled public input and recommendations on different aspects of municipal use of Surveillance Technologies including inventories, reporting and oversight, governance, public participation, and procurement and privacy services. A compilation of these recommendations is described in Exhibit A; and

WHEREAS, public trust can only be achieved with more transparency and accountability, and by including community in the decision making. Information and technology should aim at the collective goals for enhancing democracy, justice, resiliency, and economic stability. The public and City staff should feel confident that the City uses information and technology responsibly.

NOW, THEREFORE, BE IT RESOLVED that the Bureau of Planning and Sustainability Smart City PDX program will coordinate Citywide privacy and information protection work including preparing an assessment of staff and budget needs for a dedicated program. This will be in partnership with the Bureau of Technology Service’s Information Security Office; and

BE IT FURTHER RESOLVED that the Bureau of Planning and Sustainability Smart City PDX will design and implement a Surveillance Technologies inventory in collaboration with City bureaus. This inventory (technology registry) will describe the type of technology, use and purpose, program, bureau, or third party or subcontractor responsible for it, and methods for assessing effectiveness. Smart City PDX will guide City Bureaus on how to complete an initial inventory of Surveillance Technologies and an annual report back to City Council by March 31, 2024; and

BE IT FURTHER RESOLVED that the Bureau of Planning and Sustainability Smart City PDX and the Office of Equity and Human Rights will design, in public and equitable processes, an accountability and oversight strategies and procedures for the use and acquisition of surveillance technologies; and

BE IT FURTHER RESOLVED that the Bureau of Planning and Sustainability Smart City PDX and the Office of Equity and Human Rights will coordinate with the Bureau of Technology Services to develop policies and procedures required for implementing Privacy Impact Assessments when procuring or planning to use Surveillance Technologies; and

BE IT FURTHER RESOLVED that the Bureau of Planning and Sustainability Smart City PDX and the Office of Equity and Human Rights will conduct an initial assessment of the impacts of Automated Decision Systems on Portlanders, visitors, and City staff to identify additional privacy and information protection policies; and

BE IT FURTHER RESOLVED, this resolution is binding City policy.