v . 0 03 P a g e | 1
November 1, 2022
ITEM TITLE
Privacy and Technology: Citywide Privacy Protection and Technology Transparency Policy
Report Number: 22-0280
Location: No specific geographic location
Department: City Manager
Environmental Notice: The activity is not a “Project” as defined under Section 15378 of the California Environmental Quality Act State Guidelines; therefore, pursuant to State Guidelines Section 15060(c)(3) no environmental review is required. Notwithstanding the foregoing, the activity qualifies for an Exemption pursuant to Section 15061(b)(3) of the California Environmental Quality Act State Guidelines.
Recommended Action
Adopt a resolution approving a Citywide Privacy Protection and Technology Transparency Policy.
SUMMARY
The City of Chula Vista adopted a Smart City Strategic Action Plan (Action Plan) in September 2017 , establishing itself as a leader in the growing “smart city” movement, earning recogniti on locally, nationally, and internationally for its innovative planning approach to using technology to create a more efficient and effective government. As a smart city, Chula Vista continues to leverage innovative technology and data tools to better serv e and engage citizens, enhance sustainability, improve public safety, and promote local economic development. The Smart City Strategic Action Plan adopted in 2017 aims to help the City of Chula Vista:
Become more responsive by working with our communities , residents, and businesses to improve city operations and services, including public safety and citizen engagement Become more transparent by using data and analytics to improve city services and operations, and ensuring public access to city performance indicators
Lay the groundwork for economic development to attract new businesses, and help grow and support current Chula Vista businesses
On January 18, 2022, as part of the on -going implementation of the Action Plan, City Council approved an agreement for the City of Chula Vista to engage Madaffer Enterprises (Madaffer) to provide support for the development of a Citywide Privacy Protection & Technology Transparency Policy (Policy). A key step in this P a g e | 2
effort was the establishment by the City Manager of a Task Force of Chula Vista residents and stakeholders who worked with the public and City staff over a period of six months to develop policy recommendations for consideration in the development of the citywide policy. This staff report outlines the process of the citywide policy development, including the role of the task force, robust community engagement efforts, the findings of a public opinion survey and observations from six focus groups conducted as part of this effort.
ENVIRONMENTAL REVIEW
The Development Services Director has reviewed the proposed Project for compliance with the California Environmental Quality Act (CEQA) and has determined that the Pro ject qualifies for a Class 8 Categorical Exemption pursuant to Section 15308 (Actions by Regulatory Agencies for Protection of the Environment) of the state CEQA Guidelines. The proposal seeks to help address the local threat of climate change by reducing greenhouse gas (GHG) emissions and lowering vulnerability to anticipated climate change impacts.
Thus, no further environmental review is necessary. In addition, notwithstanding the foregoing, the Development Services Director has also determined that the Project qualifies for an Exemption pursuant to Section 15061(b)(3) of the California Environmental Quality Act State Guidelines.
BOARD/COMMISSION/COMMITTEE RECOMMENDATION
Not applicable.
DISCUSSION
The Smart City Strategic Action Plan was adopted to serve as a roadmap and outline goals, objectives and initiatives that will help the city achieve its smart city vision. The Smart City Strategic Action Plan is built around ten primary objectives that are organized into four overarching goals. Each objective is supported by several initiatives and action steps. City staff continues to work with department heads and key stakeholders on progress toward implementation of the various initiatives. The continued progress and the impacts of initial smart city efforts are enhancing city operations and services, saving taxpayer dollars, improving public safety, and promoting economic development by encouraging business growth and jobs. Chula Vista continues to work with our regional partners, including the Port of San Diego, SDG&E, SANDAG, Caltrans, City of San Diego and Cleantech San Diego to identify opportunities for successful deployment of smart city technologies. The City will continue to ensure that our smart city initiatives are sustained by long -term stakeholder engagement across our region.
Citywide Privacy Protection & Technology Transparency Policy
A key goal of the Smart City Strategic Action Plan is to continue efforts to become a more open and transparent City. To support this goal, the City has set an objective to maximize the use of data and analytics to improve services and increase public access to City information. This effort also involves ensuring that technology, including public data and infor mation collected is stored, managed, and utilized in a secure, transparent, and safe way. The development of a Privacy Protection & Technology Transparency (Policy) is a tool for the City to enhance the safe and effective use of technologies and improve protection of public data.
The Policy also will help to advance City Council priorities to improve City policies for adoption of new technologies, public data management, security, and privacy.
As part of our deeper commitment to good data practices and data stewardship, the City has developed this Policy to serve as a guide for all City departments. The development of this Policy was guided by the policy recommendations adopted by the Technology and Privacy Advisory Task Force (Task Force) on September 26, 2022. The policy will govern privacy protection and data management processes, as well as the use of P a g e | 3
technology in City operations and services, including public safety, traffic management, community services, economic development, and other service areas of the City.
Why is it important for Chula Vista to adopt a Privacy Protection & Technology Transparency Policy?
The Policy will:
Establish guidelines and standards to effectively protect the confidentiality, integrity, and availability of City of Chula Vista data, digital information, and technology systems. Increase public trust and confidence by making City data management policies and processes more transparent and easily accessible to City residents so they can better understand how the City protects their data.
Establish a commission of diverse stakeholders focused on technology privacy and innovation that will help guide Policy implementation.
Improve the dialogue between residents and the City by allowing for a better understanding of data collection, data use and management services the City provides, while addressing input on what matters most to Chula Vista residents.
Develop effective meas ures to protect the City of Chula Vista and its residents, businesses, and other stakeholders from illicit use of City of Chula Vista technology systems and related data.
Summary on Project Scope and Deliverables:
On January 18, 2022, City Council directed staff to develop a privacy protection and technology transparency policy and approved an agreement for the City of Chula Vista to engage Madaffer Enterprises (Madaffer) to provide support for the development of this policy. Below is a summary of the services Madaffer Enterprises provided to the City of Chula Vista under the scope of this project:
Assisted in the establishment and facilitated the work of the task force on technology and privacy. Assisted in communicating the work of the task force to Chula Vista residents and the public. Conducted a round of consultations with department heads and managers to understand existing or planned technologies or policies that may be within the scope of the task force. Coordinated with a public opinion research consultant to conduct scientific, non -biased public opinion polling and focus groups to gather input from Chula Vista residents regarding technology privacy and innovation and potential privacy guidelines. Organized and coordinated a series of community meetings and interviews with community-based organizations, privacy experts, academics, and City staff. Provided project management and coordination, including weekly calls and monthly meetings with department heads to share progress reports and solicit input from senior City staff.
Technology & Privacy Advisory Task Force:
In April 2022, the Chula Vista City Manager appointed 12 individuals to the Chula Vista Technology & Privacy Advisory Task Force (Task Force) , including residents with expertise in technology, education, law enforcement, small business, and civil rights. The Task Force was charged with providing to the City Manager policy recommendations for consideration in the development of a policy on technology and privacy issues.
P a g e | 4
Selection of Task Force Members:
Beginning February 2022, City staff implemented outreach efforts to announce that the City was seeking individuals who were interested in serving on a technology and privacy advisory task force. An online application was posted on the City website and was made available for 30 days. The City received 57 applications. The pool of applicants was narrowed down to 21 by the City Manager and a selection committee which included three current or former leaders of important organizations in Chula Vista: Beatrice Zamora, Arnulfo Manriquez, and Dr. Francisco Escobedo.
The final 21 applicants were interviewed by the City Manager and based on those interviews, the City Manager selected 12 candidates to serve on the Task Force. Each member appointed to the Task Force was chosen because they represented a diverse and important perspective and were determined to be fair and reasonable in their approach to the issues of privacy and technology in local government. On April 25, 2022, the Task Force convened its first meeting in the City Council chambers.
Goals & Objectives of the Task Force:
The Task Force studied City technology, worked with key stakeholders in the community, and city staff to develop informed policy recommendations designed to help the City protect individual privacy and enhance technology oversight while delivering excellent public service. The Task Force received presentations from City staff and other experts on how the City is using technology, how other cities are using technology, existing laws regulating privacy and the use of technology and information security. Task Force members also participated in two community meetings in Chula Vista.
To ensure openness and transparency of the entire process, the City published all task force meeting agendas 72 hours in advance. In addition, all task force meetings were broadcast live on the City website and are available in the meeting archive. The City publicized Task Force meetings inviting public comments via social media, City newsletter and press releases.
Task Force Subcommittees:
Over the course of the six-month period, ten Task Force meetings were conducted, two departmental on-site tours were convened, and two community meetings were held. On August 1, 2022, in order to begin the process of deliberation and fu rther review of policy recommendations, the Task Force establis hed the following six subcommittees:
• Procurement
• Data Retention
• Use Policies
• Policy Oversight & Transparency
• Privacy Advisory Board
• Information Security
Each subcommittee was composed of a minimum of two Task Force members and these subcommittees provided initial draft policy recommendations.
P a g e | 5
Opportunities for Public Input & Community Engagement:
The City of Chula Vista is committed to openness and transparency as outlined in the goals of our smart city strategic plan adopted in 2017. Ensuring opennesss and transparency of the Task Force meetings and processes was critical. To ensure that all Chula Vista residents and community members would be able to participate in this process and with the Task Force, the City established the following channels of communication:
• The City established a dedicated website for public access to all task force meeting agendas, meeting minutes, e-comments and live streaming at www.chulavistaca.gov/privacytaskforce. • The City established a d edicated Task Force email to easily receive public comment and feed back from the public - [email protected].
• The City made a commitment to l ive stream and record all ten Task Force meetings for the public . All meeting recordings are available on the City website.
• All Task Force meetings were open to the public and meeting agendas were posted at least 72 hours in advance. All members of the public were encouraged to p rovide in-person and electronic public comments at all meetings, totaling 36 hours.
• The City hosted interactive community meetings on July 27 and July 28 , 2022. These meetings were conducted at the South Chula Vista Branch Library and Otay Ranch Branch Library (total of 4 hours). • E-comment portal available for 72 hours before any task force meeting. • The C ity issued mulitple p ress releases to inform the public on the privacy task force and related initiatives.
• Social media posts to over 58,000 Followers.
• Articles and updates featured in monthly City newsletter (February -November) distributed to over 28,000 subscribers per month.
• Outreach to a Task Force Subscriber list (75) and to all Board and Commission members (174).
City Department Briefings and Onsite Tours:
The Task Force received presentations from City staff and other experts on how the City is using technology, how other cities are using technology, existing laws regulating privacy and the use of technology and information security. City staff provided ten department briefings and two onsite tours on technologies and privacy protections within the respective service areas.
June 2 - Chula Vista Police Department headquarters. Task Force received presentations on the Drone as First Responder (DFR) program, Automated License Plate Reader (ALPR) program, 911 Dispatch and the RTOC (Real-Time Operations Center).
June 23 - Traffic Engineering Department tour. Task Force received presentation on the Traffic Management Center.
June 23 – Task Force received demonstrations from the Information Technology Department and City Clerk.
June 27 and July 18 - Task Force received department briefings from Community Services, Library, Finance, Procurement, Fire, Human Resources, Development Services, and Housing departments and divisions.
P a g e | 6
Public Opinion Survey Poll:
The City engaged Competitive Edge Research & Communication (CERC), a San Diego-based public opinion research firm, in February 2022 to begin planning a scientific public opinion survey of Chula Vista residents.
The survey was not used to develop the Policy but rather to provide City staff and Task Force members with a baseline understanding of resident opinions on privacy and specific technologies the City already uses. The survey gathered responses from a random sample of 607 Chula Vista residents, including registered voters and residents who are not registered to vote, from March 21 to March 30, 2022. Respondents were reached by telephone, text message, and email. Respondents were given the opportunity to answer survey questions in English, Spanish, or Tagalog.
The results of the public opinion survey were presented to the Privacy Task Force at a public meeting on April 25, 2022 . A complete report of the public opinion survey is attached under Attachment 5. Some key findings of the survey include the following :
Nearly 70 percent of residents say it is “extremely important” or “very important” that the City adopt a new privacy protection policy in an effort to make the City’s use of new technologies transparent and efficient.
Residents are significantly more co nfident in City efforts to keep their personal information safe and private compared to the federal government or online businesses such as Facebook and Amazon. Nearly 72 percent of residents say they trust the Chula Vista Police Department “a lot” or “so mewhat” when it comes to implementing policies in the best interest of the public. About 25 percent of residents say they trust the Police Department “not much” or “not at all.” There is a high level of awareness of the drone program among residents, and nearly 79 percent of residents say they approve “strongly” or “somewhat” of the drone program. Awareness of the Police Department’s use of automated license plate readers (ALPR) is lower than awareness of the drone program, and about 66 percent of residen ts say they approve “strongly” or “somewhat” of ALPR.
Trust in the Police Department is a strong predictor of how much a resident approves of the ALPR program. More than 77 percent of residents say they approve “strongly” or “somewhat” of the City’s use of traffic signal cameras to improve traffic flow and safety.
Focus Groups:
As a follow -up to the public opinion survey, the City engaged CERC to conduct a series of focus groups to provide a deeper understanding of resident concerns and preferences on privacy and City technology. CERC recruited residents from a random sample to participate in one of six focus groups held in June and July 2022.
Four of the focus groups were conducted in English and two of the focus groups were conducted in Spanish.
A total of 43 residents participated in these 90 -minute sessions . The results of the focus groups were presented to the Privacy Task Force at a public meeting on August 1, 2022. A complete report on the focus groups is attached under Attachment 6. Notable findings are summarized here. Housing affordability, crime and public safety, and homeless are the top issues for most residents. Generally, residents’ noted their trust in the City to properly protect their privacy is because they have not heard any reports that the City has had a data breach or other problems with privacy. Residents feel that they lack awareness of what the City is doing to protect their data. Residents rated a series of potential policy ideas, with the most popular ideas being the following:
P a g e | 7
o Hiring a Chief Privacy Officer
o Providing enhanced training to City staff
o Establishing a privacy oversight board
o Requiring more City Council oversight of privacy-related expenditures o Anonymizing data
Technology & Privacy Advisory Task Force Policy Recommendations:
In August 2022, the Task Force shared an initial draft of the policy recommendations and made them available to the public for comments and feedback. City staff coordinated with Madaffer Enterprises to provide all public comment and feedback to the task force before their final deliberation and adoption . In addition, at the Task Force’s request, City staff conducted a review of the draft recommendations an d provided written comments. Attached to this staff report under A ttachment 2 is the list of task force policy recommendations. On September 26,, 2022 the Task Force conducted its final meeting and adopted 37 policy recommendations for the City Manager to consider in the development of a citywide policy. Below is a brief summary of the Task Force policy recommendations:
• Establish a Privacy Oversight Board
• Hire a Chief Privacy Officer
• Create written Use Polices to govern use of technology • Prohibit the sale of City data by third parties with certain exceptions • Enhance data retention, sharing and management controls, including anonimization of personal data, shortening of data retention periods where possible, approval of external data sharing with third parties • Provide Annual Technology Reports on the use of proposed or existing technologies • Provide enhanced privacy training for City staff
• Institute additional City Council oversight of privacy-related contracts • Establish an Information Security Policy that addresses procedures for maintaining and controlling access to data, including roles and responsibilities of data stewards and custodians
City of Chula Vista Privacy Protection & Technology Transparency Policy:
The City has developed a Privacy Protection and Technology Transparency Policy (Policy) to serve as a guide for all City department privacy protection and data management processes, as well as the use of technology in City operations and services. The purpose of the Policy is summarized as follows:
To safeguard the security, accuracy, and control of access to City data and technology systems To protect the civil rights and civil liberties of Chula Vista community members, including rights to privacy
To ensure that expert advice and community input is included as part of City decision-making involving the acquisition and use of privacy-impacting technology To protect against the waste of taxpayer funds
To promote transparency in the acquisition and use of privacy-impacting technology by the City To build and maintain public trust in the City and its use of technology to deliver public services P a g e | 8
Sections of the Policy:
City staff very much appreciates the work of the Task Force and found their input and recommendations very valuable in the development of this policy. The majority of the Task Force policy recommendations submitted to the City Manager on September 26, 2022 are incorporated into the proposed Policy in some manner. There are some policy recommendations that require further analysis before they can be incorporated into the Policy. The Policy contains the ten sections listed below:
Privacy and Technology Advisory Commission
Support from Privacy and Technology Experts
Use Policies
Surveillance Technology impact reports (STIR)
Surveillance Technology acquisition process
Transparency in the use of Sensitive and Surveillance Technology Data Collection, Retention, Sharing and Management
Information security
Exceptions
Training, Compliance and Enforcement of the Policy and Compliance with Laws
City staf f worked with all City departments including the City Attorney to ensure that the policy recommendations included in the Policy were written in a way that ensures that the City adheres to all Federal, State and local laws and regulations regarding data privacy and proctection. As a result, some of the policy recommendations incorporated into the Policy required some modificat ion in order to be fully applicable to the operations of the City of Chula Vista. Attached to this staff report under Attachment1 is the proposed Privacy Protection & Technology Transparency Policy.
Types of Technologies Used by the City
The City of Chula Vista uses many technology systems to effectively deliver public services and will continue to responsibly explore new ways to use technology to better serve our communities, residents, and businesses. The following are the two types of technologies that the City of Chula Vista uses based on the type of data they generate or collect. These two categories are the basis for developing enhanced controls and oversight of the Privacy Protection & Technology Transparency Policy:
Sensitive Technology : Any electronic device, software program, or hosted software solution owned or operated by the City that generates or collects Sensitive Personal Information, but which is not designed or intended to be used for surveillance. For the purposes of this Policy, Sensitive Technology does not include the following:
Standard office technology such as email systems, copy machines, telephone networking systems, or broadly available consumer software such as Microsoft Office applications IT infrastructure only intended to manage backend or operational data. Technology solely intended to manage the Sensitive Personal Information of City employees, such as payroll, employment applications, health, and retirement benefits.
P a g e | 9
Technology solely intended to manage the i nternal administrative functions of the City, such as case management systems and revenue collection and billing systems.
Surveillance Technology: Any electronic device, software program, or hosted software solution that is designed or primarily intended to be used for the purpose of surveillance. For the purposes of th e Policy, Surveillance Technology does not include the following:
Cameras installed on City property solely for the purpose of maintaining the security of that property. Cameras installed solely to protect the physical integrity of City infrastructure, such as sewers and storm drains.
Technology that monitors only City employees in the performance of their City functions. Body-worn cameras.
Key Provisions in the Policy:
Enhanced Privacy Protection & Technology Transparency Oversight: The City will establish an advisory commission referred to herein as the Privacy and Technology Advisory Commission (PTAC) , consisting of Chula Vista residents, responsible for carrying out a broad range of advisory duties, including reviewing and advising on City technology use policies, Surveillance Technology impact reports, annual reports, procurement standards for agreements involving Sensitive or Surveillance Technology, and facilitatin g public discussion of important issues related to privacy and City technology. Qualification requirements and criteria for PTAC candidates are also outlined in the policy. The City also will seek the advice of a privacy expert to serve as a liaison to the PTAC, help lead and coordinate privacy protection and technology transparency oversight initiatives. The roles of this position will include coordination with the PTAC for reporting and complaince review.
Use policies for sensitive technology and surveillance technology: The City will establish a process for determining whether a particular technology is classified as surveillance technology or sensitive technology.
Written use policies will be developed for all technologies that are classified under these two categories.
Departments may rely on the City privacy advisor for assistance in developing use policies. The policy also requires that the City Departments review and update use policies any time there is a significant change in the function or purpose of the technology.
Surveillance technology impact reports: The City shall require the creation of a surveillance technology impact report (STIR) for acquisition of surveillance technology. The STIR reports will include information on potential disproportionate impacts of the technology to certain communities or groups , financial impacts, impacts to city data systems and mitigation measures to these potential impacts.
Surveillance technology acquisition process: The City shall require City Council approval and development of associated use policies and surveillance technology impact reports (STIR) for the acquisition of surveillance technology. The use policies and STIR reports will need to be presented to the PTAC for their recommendation as outlined in the Policy. In addition, respondents to City solicitations for new surveillance technology will be required to provide security reports and detail any associated risks.
Transparency in the use of sensitive and surveillance technology: The City will provide a report at least every two years to the PTAC. The reports will describe the usage of surveillance technology within the City, detail related data sharing, usage and ma nagement and annual costs for the use of the technology . The reports also will detail any known impacts of the use of the technology and mitigation measures. In addition, the City also will provide a list of sensitive and surveillance technologies used by the City on the City website.
P a g e | 10
Data Collection, Retention, Sharing & Management: The City will enhance internal controls on data collection, retention and management related to sensitive and surveilance technologies. In addition, the City shall restrict the unauthorized use and sale of sensitive personal information and data except for specific exceptions. City departments shall ensure that agreements prohibit vendors from using data owned by the City except as necessary to provide the contracted service to the City.
Information Security: The City shall establish a cyber roadmap that protects Sensitive Personal Information from being exploited by unauthorized sources, including procedures for maintaining and controlling access to sensitive city data and technology systems.
Exceptions: The Policy outlines specific circumstances where limited exceptions to the Policy would apply.
The City Manager or City Council as appropriate ma y waive elements of the policy in the event of exigent circumstances or other circumstances that make compliance impossible or infeasible.
Training, Compliance and Enforcement of the Policy and Compliance with Laws: The Policy outlines that the City Manager will be responsible for interpretation and oversight of City compliance with the Policy, this includes relevant City staff training. The Policy also specifies that all provisions must comply with applicable federal, state, and local laws governing the collection, storage and disclosure of Sensitive Personal Information, and protection of individual civil rights and liberties.
Considerations for Policy implementation:
Formation of a Technology Governance Committee: Once the Policy is adopted, and as part of the implementation, a key consideration will be the formation of a Technology Governance Committee (TGC).
The role of the TGC will be to review and approve new technology that the City wants to acquire. The TGC will report to the Director of Information Technology (IT) under the direction of the City Manager. The TGC will consist of representatives from multiple departments including the Police Department, IT, Finance, and Engineering.
DECISION-MAKER CONFLICT
Staff has reviewed the decision contemplated by this action and has determined that it is not site-specific and consequently, the real property holdings of the City Council members do not create a disqualifying real property-related financial conflict of interest under the Political Reform Act (Cal. Gov't Code § 87100, et seq.).
Staff is not independently aware and has not been informed by any City Council member, of any other fact that may constitute a basis for a decision-maker conflict of interest in this matter.
CURRENT-YEAR FISCAL IMPACT
N/A
ONGOING FISCAL IMPACT
It is anticipated that administering and implementing this Policy will have significant budgetary impacts.
One such position that has currently been identified is the addition of one Records Manager which will be added to the City Clerk personnel budget as part of the City Manager’s Fiscal Year 2024 Proposed Budget.
The fiscal impact of a Records Manager will be $122,314.
In addition, City staff will return to seek City Council approval of a privacy expert consultant or advisor as contemplated in the Policy.
P a g e | 11
ATTACHMENTS
1. Privacy Protection & Technology Transparency Policy
2. Privacy Advisory Taskforce Policy Recommendations
3. Privacy Advisory Taskforce Supplementary Documents for Policy Recommendations
4. Privacy Advisory Taskforce Meetings Public Comments
5. Public Opinion Survey Report
6. Focus groups Report
Staff Contact: Dennis Gakunga, Chief Sustainability Officer, Economic Development Department Anne Steinberger, Marketing and Communications Manager, City Manager’s Office Adrianna Hernandez, Special Projects Manager, City Manager’s Office