AGENDA REPORT
TO:
Public Safety Committee,
City Administrator Jestin Johnson
FROM:
Privacy Advisory
Commission (PAC)
SUBJECT: 2023-2024 PAC Annual Report DATE: May 2, 2024
____________________________________________________________________________
The following pages contain the PAC Annual Report and encompasses PAC actions performed in 2023. It is formatted in the Council Agenda Report template to make it easier to read and follow.
EXECUTIVE SUMMARY
The objective of this report is to provide City stakeholders with an update on the activities of the Privacy Advisory Commission (PAC), including making recommendations on:
1. Sanctuary City Ordinance (Council approved)
2. Surveillance Technology Ordinance (Council approved)
3. Annual Reports To Date (Council approved)
4. Exigent Circumstances Reports (Council approved)
5. Federal Task Force Transparency Ordinance (Council approved)
6. Sanctuary Contracting Ordinance
(Council approved)
7. Privacy Principles (Council approved)
BACKGROUND / LEGISLATIVE HISTORY
In March 2014, the City Council established an Ad Hoc Advisory Committee to develop a Privacy and Data Retention Policy for the Domain Awareness Center (DAC), a City-Port security project located at the Emergency Operations Center.
This Committee developed a Policy for the DAC and proposed a set of additional recommendations for the City Council to consider. One of the key recommendations that the City Council considered and adopted was the Creation of a Permanent Standing Privacy Advisory Commission to develop and advise on citywide privacy concerns.
On January 19, 2016, the City Council adopted Ordinance No. 13349 C.M.S., which created and defined the duties of the Privacy Advisory Commission. Those duties broadly stated are:
• Provide advice and technical assistance to the City of Oakland on best practices to protect citizen privacy rights in connection with the City’s purchase and use of surveillance equipment and other technology that collects or stores citizen data.
• Draft for City Council consideration, model legislation relevant to privacy and data protection, including a Surveillance Equipment Usage Ordinance. • Submit annual reports and recommendations to the City Council regarding: (1) the City’s use of surveillance equipment, and (2) whether new City surveillance equipment privacy and data retention policies should be developed, or such existing policies be amended. • Provide analyses to the City Council of pending federal, state and local legislation relevant to the City’s purchase and/or use of technology that collects, stores, transmits, handles or processes citizen data.
• Conduct public hearings, make reports, findings and recommendations either to the City Administrator or the City Council, as appropriate including an annual report to be presented in writing to the City Council.
• Review and make recommendations to the City Council regarding any proposed changes to the operations of the Domain Awareness Center (“DAC”) and/or proposed changes to the City’s Policy for Privacy and Data Retention for the Port Domain Awareness Center (“DAC Policy”) as specified in Resolution 85638 C.M.S.
Excerpt From Enabling Ordinance 13349:
Section 2. Duties And Functions
e. Submit annual reports and recommendations to the City Council regarding: (1) the City’s use of surveillance equipment, and (2) whether new City surveillance equipment privacy and data retention policies should be developed or such existing policies be amended.
…
g. The Privacy Commission shall make reports, findings and recommendations either to the City Administrator or the City Council, as appropriate. An annual report will be presented in writing to the City Council…
RECENT ACHIEVEMENTS
1. Surveillance Technology Ordinance Policies – Pursuant to the Surveillance Technology Ordinance, staff must propose a Use Policy, and the policy must receive City Council approval, to continue (for pre-existing equipment) or begin use (for new acquisitions) of surveillance technology. In 2023, the PAC recommended approval of, and the Council did approve, the following:
Department of Violence Prevention (DVP): Apricot 360 Database Use Policy
Department of Public Works (OPW): Amended Use Policy for Illegal Dumping Surveillance Cameras, to include automated
license plate readers (ALPR)
Department of Transportation (OakDOT): Mobile Parking Payment Program Use Policy
Police Department (OPD): Fixed Wing Aircraft High-Definition Camera Use Policy; Cellebrite Data Extraction
Technology Use Policy; Amended ALPR
Use Policy
2. Surveillance Equipment Annual Reports – Due to a 2021 amendment to the surveillance technology ordinance made at the administration’s request, staff may provide the mandated annual report on either a date certain (April 30), or within one year of operation. Historically, the City Council and public should expect to see annual reports beginning as early as March and continuing through June. In 2023, the PAC recommended approval of, and the Council did approve for ongoing use, the following:
OPD: ALPR, Cell-Site Simulator, Biometric Crime Lab, Forensic Logic/Coplink, Starchase/GPS Tracker, ShotSpotter, Live Stream Cameras, Mobile Fingerprint ID, and Unmanned Aerial Vehicle (Drones)
OPW: Illegal Dumping Cameras (pre-ALPR)
In 2023, the PAC did not recommend discontinuation of any covered surveillance technologies, nor did the Council vote to discontinue any surveillance technology.
3. Sanctuary City Contracting and Investment Ordinance – Following an ICE raid that occurred in 2017 in West Oakland, a large community coalition successfully advocated for a true non-cooperation Sanctuary City Ordinance, giving our sanctuary city proclamation the weight of law. As the data mining practices of ICE became more exposed, and as Trump’s policy of family separation dominated the headlines, the PAC recommended a contracting ordinance that followed similar ordinances such as the Border Wall Contractors prohibition, and the Anti-Nuclear Weapons Ordinance, prohibiting the city from entering into contracts with entities that supply federal immigration agencies with data, extreme vetting analytics, or detention facility support. It also prohibits the City from investing in any of those companies. The Council enacted the Sanctuary City Contracting and Investment Ordinance No. 13540 on June 4, 2019.
In 2023, the PAC received the annual report mandated by the Sanctuary Contracting Ordinance, which confirmed that no contracts were improperly awarded to any vendor participating in immigration enforcement, and no improper investments were made. The 2024 report is forthcoming.
UPCOMING PROJECTS
9. Surveillance Equipment Policies – The PAC will continue to work with staff on Use Policies for existing surveillance technology used by the City, and on new proposals to come.
10. Privacy Principles Rollout – On March 3, 2020, the City Council approved a set of Privacy Principles crafted with help from UC Berkeley Law’s Samuelson Law, Technology, & Public Policy clinic.
The PAC, with support from UC Berkeley’s Goldman School of Public Policy, contemplated that the PAC and relevant city staff would undertake an estimated 2-3- year rollout across all city departments beginning later that same year, to review existing data collection and retention practices, create boilerplate language to be used with the
public, vendors, permits and contracts, and to conduct community outreach. Just weeks after the vote, the Covid pandemic shutdown prevented such a rollout from occurring.
In no small part because of the ransomware attack suffered in the early part of 2023, the PAC intends to pursue fulfilling the above goals and will begin such actions later this year.
FISCAL IMPACT
11. Request For Funding.
A. Staffing: Since the PAC’s inception in March 2016, no funding or dedicated staff have been provided to the PAC to help support its mission. The PAC’s website has no posted minutes beyond 2017, and only a fraction of the approved use policies are published. There are no annual reports published for public review.
As the PAC continues to be studied by researchers and municipalities across the country continue to request our policies for their own similar work, the burden imposed upon Chair Hofer to supply these documents to third parties is increasingly significant, and he will term out in March 2025.
There is significant misperception by the public about what the PAC has and has not acted on, and a large volume of questions are constantly submitted to Chair Hofer (and possibly his colleagues) because the PAC’s minutes, policies and annual reports are not publicly posted. As the City of Oakland continues to lead in this space and serve as inspiration for municipalities across the country, it is important that the public be able to find the work product created by this groundbreaking body. It is also important that as the City grapples with violent crime, that the public be able to find answers to surveillance technology matters.
The PAC requests that sufficient staffing be provided to support the PAC’s mission, by either providing 1 FT staff, or directing the Administration to provide greater PT staff time than is currently provided.
B. Inspector General (IG) – Although disagreements between the PAC and staff have been rare, the dispute between the PAC and OPD pertaining to mobile ALPR, which resulted in litigation, showed the need for an inspector general to audit surveillance technologies. Having to rely on self-reported and unverified statements by proponents of a technology does not meet the letter or spirit of the law that mandates a cost-benefit analysis be conducted. The ordinance includes a separate legal obligation to conduct audits. The PAC recognizes that the significant budget deficit the City is facing may preclude the PAC from having its own IG.
The PAC requests that the City Council direct the Administration to 1) study how the PAC and Police Commission might share an IG, 2) explore grant funding opportunities for an IG position exclusive to the PAC.
C. Internship Stipends: the PAC has again been approached by UC Berkeley’s Goldman School of Public Policy (“GSPP”) about possible student help available during the summer to support the PAC. Prior GSPP projects have included creating an implementation roadmap to help with the rollout and adherence to the City of
Oakland’s adopted Privacy Principles. The students are available for up to 40 hours a week for 10 weeks, and per GSPP are typically paid between $25-30/hour. The PAC is requesting $20,000 be set aside during the mid-cycle budget adjustment for this purpose.
The PAC has identified a couple potential projects to propose to the students to gauge their interest: A) Complete the prior Privacy Principles rollout, which was interrupted by the pandemic shutdown, B) Craft an audit protocol that would enable departments subject to the Surveillance Technology Ordinance to audit their respective surveillance technologies. The lack of audits (and instructions on how and what to audit) has been a multi-year concern for both the PAC and City departments, examine the reporting process to make it more efficient and effective including possibly creating reporting templates and model reports, C) Craft a set of guidelines for the City’s use of Artificial Intelligence/Generative Artificial Intelligence, which could include vendor assessment and procurement checklists; identify departmental needs where AI and automation could reduce the administrative burden and/or reduce costs, while identifying risks of such use and how to implement appropriate guardrails.
SPECIAL RECOGNITION
The PAC continues to be an internationally recognized and studied civilian oversight body, inspiring similar commissions in San Diego, Chula Vista, and Boston. The PAC has been featured in at least seven books (including 2 from the UK), twelve law review articles, and is routinely observed by a rotating cast of PhD candidates and other grad students.
The PAC wants to publicly recognize and thank Chief Privacy Officer Joe DeVries for helping build this first-of-its-kind civilian oversight model and wish him well as he transfers to other duties within the city. The institutional knowledge possessed by Mr. DeVries will not be easily replaced, and his inter-departmental relationships made navigating this framework easier for administrative staff unfamiliar with its many nuances and moving pieces. He was a great factor in the overall success of this model.
PUBLIC OUTREACH/INTEREST
This report was published and discussed at the PAC’s regular May 2, 2024 meeting. The PAC’s outreach has primarily been internal, including discussions with multiple departments as to how to streamline the surveillance technology vetting framework, and identifying methods to provide better data to the public, PAC, and City Council.
ACTION REQUESTED OF THE CITY COUNCIL
The PAC requests that funding be provided as requested above, in #11 A-C. Recognizing the City’s financial difficulties this year, the PAC believes that the request in #11 C for intern stipends would provide the most utility under the circumstances.
For questions regarding this report, please contact Brian Hofer, PAC Chair, at 510-303-2871.
Respectfully submitted,
Brian Hofer
Privacy Advisory Commission, Chair
Reviewed by:
Privacy Advisory Commission
Joe DeVries, Deputy City Administrator
Prepared by:
Brian Hofer
PAC Chair