Establish a Citywide Surveillance Technology inventory and procedures on privacy, use, and acquisition of Surveillance Technology
WHEREAS, on June 19, 2019, City Council Resolution 37437 established Privacy and Information Protection Principles to serve as guidance for how the City of Portland collects, uses, manages, and disposes of data and information, and directed staff at the Bureau of Planning and Sustainability and Office of Equity and Human Rights to identify and develop policies and procedures that promote these Principles; and
WHEREAS, on September 9, 2020, City Council unanimously approved two ordinances, 190113 and 190114, that prohibit the use of face recognition technologies in Portland. These ordinances respond to lack of transparency and accountability in addition to biased technology which include and the collection of sensitive information from Portlanders with little safeguards and public awareness; and
WHEREAS, over the years, various City entities have researched and discussed the benefits, risks and potential harms related to data collection and surveillance technologies, including city audits, internal assessments and looking externally at other municipalities. From those efforts, recommendations for a citywide approach to surveillance have included but are not limited to the following (1) Create procedures that limit access to sensitive information; (2) Adopt a directive that includes Council authorization of surveillance technology by any city bureau and advice from a privacy commission; and (3) Require periodic public reports on city bureau uses of surveillance; and
WHEREAS, Surveillance Technologies mean any electronic or analog device, equipment, software, information and/or associated metadata, automated decision systems, data processing system, or software solution that is designed or primarily intended to be used for the purpose of surveillance; and
WHEREAS, "Surveillance" or "surveil" means to observe, collect, purchase, or analyze information generated from people’s lives and their social, work, and/or physical interactions, including information linked to the identity, movements, culture, linguistic knowledge, nature, and history of an individual or group of individuals. This information can include biometrics, social, behavioral, emotional, or mental states, physical or virtual location, historical data, relationships, and any derivative product from personal information, including metadata, models, and data templates; and
WHEREAS, Automated Decision Systems (ADS) are the processes, set of rules, or tools based on automated processing of data to perform calculations, create new data, or to undertake complex reasoning tasks. This includes advanced methods like artificial intelligence and machine learning, visual perception, speech or facial recognition, and automated translation between languages; and
WHEREAS, the use of smart city technologies, such as sensors, connected devices, and always-on data flows that manage transportation systems, support real-time infrastructure maintenance, automatically administer public services, enable transparent decision making, and open data, and support emergency services in public areas, can provide real benefits to governments and communities; and
WHEREAS, Surveillance Technologies have historically disproportionate negative impacts against marginalized people. Impacted communities include Black and Brown people, those who don't have personal devices, people living with mental health issues, people experiencing houselessness, and those participating in civic engagement activities; and
WHEREAS, the emergence of big data, mass surveillance and automated decision systems, including artificial intelligence, has changed the way in which personal or group information is collected and managed. These new technologies create new privacy risks and impacts, including racial and cultural biases, and equitable access and use of technology; and
WHEREAS, the City has already implemented some protections to private, sensitive, and confidential information; it still needs to update or develop new procedures, training and invest in organizational infrastructure and capacity to implement privacy best practices. Complex privacy rules and modern data management strategies can create unforeseen risks and impacts, in addition to those intrinsic to the technologies and nature of information; and
WHEREAS, a Privacy Impact Assessment (PIA) is a systematic process for evaluating a proposal to procure and use a technology and/or data collection process in terms of its impact upon privacy. The PIA helps a bureau to (a) identify the potential effects that a proposal may have upon individual privacy (b) examine how any detrimental effects upon privacy might be overcome, and (c) ensure that new projects comply with existing information protection regulation, agreements and the City’s Privacy and Information Protection Principles; and
WHEREAS, the Smart City PDX program and the Office of Equity and Human Rights have compiled public input and recommendations on different aspects of municipal use of Surveillance Technologies including inventories, reporting and oversight, governance, public participation, and procurement and privacy services. A compilation of these recommendations is described in Exhibit A; and
WHEREAS, public trust can only be achieved with more transparency and accountability, and by including community in the decision making. Information and technology should aim at the collective goals for enhancing democracy, justice, resiliency, and economic stability. The public and City staff should feel confident that the City uses information and technology responsibly.
NOW, THEREFORE, BE IT RESOLVED that the Bureau of Planning and Sustainability Smart City PDX program will coordinate Citywide privacy and information protection work including preparing an assessment of staff and budget needs for a dedicated program. This will be in partnership with the Bureau of Technology Service’s Information Security Office; and
BE IT FURTHER RESOLVED that the Bureau of Planning and Sustainability Smart City PDX will design and implement a Surveillance Technologies inventory in collaboration with City bureaus. This inventory (technology registry) will describe the type of technology, use and purpose, program, bureau, or third party or subcontractor responsible for it, and methods for assessing effectiveness. Smart City PDX will guide City Bureaus on how to complete an initial inventory of Surveillance Technologies and an annual report back to City Council by March 31, 2024; and
BE IT FURTHER RESOLVED that the Bureau of Planning and Sustainability Smart City PDX and the Office of Equity and Human Rights will design, in public and equitable processes, an accountability and oversight strategies and procedures for the use and acquisition of surveillance technologies; and
BE IT FURTHER RESOLVED that the Bureau of Planning and Sustainability Smart City PDX and the Office of Equity and Human Rights will coordinate with the Bureau of Technology Services to develop policies and procedures required for implementing Privacy Impact Assessments when procuring or planning to use Surveillance Technologies; and
BE IT FURTHER RESOLVED that the Bureau of Planning and Sustainability Smart City PDX and the Office of Equity and Human Rights will conduct an initial assessment of the impacts of Automated Decision Systems on Portlanders, visitors, and City staff to identify additional privacy and information protection policies; and
BE IT FURTHER RESOLVED, this resolution is binding City policy.
Purpose of Proposed Legislation and Background Information
This resolution responds to the need to create guidelines and infrastructure to support City Bureaus managing surveillance technologies following the City’s Privacy and Information Protection Principles and best practices around surveillance technologies.
- This policy directs BPSs’ Smart City PDX program to coordinate a citywide privacy and information protection program in partnership with BTS’ Information Security Office.
- BPS’s Smart City PDX program to coordinate a citywide inventory of surveillance technologies owned or used by City Bureaus.
- BPS’s Smart City PDX program and the Office of Equity and Human Rights will design accountability and oversight strategies and procedures for the use and acquisition of surveillance technologies.
- BPS’s Smart City PDX program and the Office of Equity and Human Rights will coordinate with the Bureau of Technology Services to develop policies and procedures required for implementing Privacy Impact Assessments when procuring or planning to use Surveillance Technologies.
- BPS’s Smart City PDX program and the Office of Equity and Human Rights will conduct an initial assessment of the impacts of Automated Decision Systems.
This policy will support the City bureaus’ evaluation, acquisition, operations, and management of surveillance technologies.
Two City Council work sessions were presented around the content of this policy. The first one on January 11, 2022, on Municipal Privacy Services, and the second on September 27, 2022, on Surveillance technologies and impact assessment processes.
This Policy will also improve public transparency of the use of surveillance technologies and allow the Portland Community to understand better how the City uses technology and collected information from Portlanders and visitors.
The proposed policy has been also the result of deep and comprehensive public participation process and input from a diverse set of communities, representing different demographic groups. Exhibit A compiles all the comments and notes received in this public process of public education and input.
Financial and Budgetary Impacts
This resolution does not have current budgetary impacts. However, the directives described in the policy may result on future budget recommendations to support a permanent Citywide privacy program.
This resolution does not impact any current or future sources of revenue or any existing financial agreement.
Community Impacts and Community Involvement
The development of this policy included a comprehensive public participation in virtual and physical spaces open to the public. It also included the release of information about surveillance technologies, privacy, public participation, digital rights, and digital justice. This information was released at the BPS’s Smart City PDX program website (https://www.smartcitypdx.com/, as visited on November 2022).
A compilation of the public comments is included in Exhibit A of the policy.
Public outreach also included presentations to different community groups. These presentations included Black, Indigenous, and People of Color groups, local business associations, local technology groups, local advocacy groups on privacy and surveillance technologies, and academic institutions.
The outreach was citywide and not focused on a specific geographic area.
The input received was diverse. These are some core aspects of the policy identified through the outreach process:
- More transparency and accountability of surveillance technologies.
- Creation of transparent processes to assess impacts of surveillance technologies.
- Meaningful public participation in the decision making for using surveillance technologies, particularly from those directly impacted by them.
- And improved mechanisms created by the City to minimize harm of emergent information technologies like artificial intelligence.
This policy is expected to create the initial City infrastructure and guide bureaus in the use of surveillance technologies. The Privacy Program will work with the community to develop the involvement and transparency mechanisms identified as being of high importance to the community.
The general expectation is that this policy will contribute to enhance public trust on how the City uses technology and information solutions, particularly surveillance technologies.
The Bureau of Planning and Sustainability is investing more resources to assess the needs derived from using technology and information solutions. As well as what is the panorama of future impacts in implementing emerging technology in Portland, particularly in those socially stressed neighborhoods.
Also, the Bureau of Planning and Sustainability will keep collaborating with the Office of Equity and Human Rights and the Bureau of Technology Services on implementing this policy.
100% Renewable Goal
This policy does not impact the City’s total energy use, nor the amount of renewable energy used by City Bureaus.
106 Time Certain in February 1-2, 2023 Council Agenda
Adopted As Amended
- Commissioner Carmen Rubio Yea
- Commissioner Dan Ryan Yea
- Commissioner Rene Gonzalez Yea
- Commissioner Mingus Mapps Yea
- Mayor Ted Wheeler Yea