Seattle and Oakland Take the Lead on Privacy Responsibility, Enact Privacy Commissions

Blog Post
November 19, 2019

San Diego, Calif. - In 2017, Mayor Kevin Faulconer and the City Council approved a $30 million contract with a General Electric (GE) subsidiary for roughly 14,000 new street lights that were marketed to decision-makers and the public as energy-efficient upgrades. The new lights were touted as better for the environment, and were promised to save taxpayers $2.4 million in annual energy costs.

City Attorney Mara Elliott was required by law to review and advise the decision-makers on the ins and outs of the contract. The City's video archives show her on the dais during the two public meetings at which the City Council voted to approve the contract, but instead of speaking out she kept quiet.

What she failed to tell the decision-makers and the public is shocking.

Despite previously heading the City's legal unit with responsibility for information technology and contracting, Elliott neglected to disclose that more than 3,000 of the new street lights would be equipped with cameras, microphones, and other surveillance devices and would be recording members of the public in the streets, on sidewalks, near parks and schools, and anywhere else they might go after leaving their homes. According to the contract, the surveillance devices "can see, hear and feel, providing a connected hub of data collection for endless applications.”

Elliott also neglected to disclose that the contract gave GE's subsidiary the unrestricted right to use and sell all the surveillance data gathered by these devices at no charge and without any control or oversight by the City. Although the devices provide the San Diego Police Department with access to the surveillance data for up to five days, the contract gives the subsidiary the right to use and sell the collected data about San Diegans in perpetuity -- that is, forever.

Even worse, the contract requires the City to pay the GE subsidiary's legal bills and any court judgments if a third party sues for improper use of the data without consent.

Cory Briggs, a candidate for City Attorney, pointed this out at a recent community forum on surveillance. He explained, "the contract explicitly states that if a third party brings a claim, the city will defend GE against any such claim at the city's [taxpayers'] expense and pay all damages and costs and any settlements with the plaintiff."

San Diego Should Look at Seattle and Oakland

San Diego's approach to the complex questions about this new technology stands in stark contrast to the approaches taken by Seattle and Oakland, which addressed the serious concerns of surveillance and data-sharing by creating Privacy Commissions.

The Oakland City Council approved an ordinance in January 2016 to create the Oakland Privacy Advisory Commission. The nine-member panel has been responsible for writing that city's privacy and data-storage law and for helping to guide city policies related to surveillance equipment and new technologies. At the time, Catherine Crump, an assistant clinical professor at UC Berkeley's law school, noted, “It’s an example of a community trying to grasp hold of how technology is changing, and actually exert some control over the degree which people are going to be subject to surveillance and then in what ways."

In 2015, Seattle designed a city-wide Privacy Program to provide guidance and tools to its employees when working with personal information. Seattle convened a group of representatives from across 15 city departments to create policies and practices to define and implement the program to address the city's privacy commitments. To advise these efforts, Seattle convened a Privacy Advisory Committee made up of privacy thought-leaders from academia, local companies, and private legal practice and community activist groups to provide best practices recommendations.

In San Diego, the community is sounding the alarm.

At a recent forum at California Western School of Law, community groups came together to express not only their outrage over the secrecy of San Diego's surveillance effort, but also their concerns over the lack of sophistication in dealing with technology and contracts. Lilly Arani, a professor at UCSD who has interacted with the City Council, said: "In the conversations that I've had with City Council staff I've not met anybody who has the expertise to understand the contract or understand how data ownership and data rights work or what data scientists and the business models of these companies try to do with data. Seattle and Oakland have boards where they make sure privacy experts, engineers, accountants and lawyers at the table to inform these processes, so San Diego has built the incompetence into the way we organize these decisions."

Briggs Offers Solution

On November 6, 2019, Briggs sent the Mayor and City Council a letter outlining the steps they should take to protect the taxpayers in the event of litigation against GE's subsidiary or the City for violating laws against government surveillance and data-sharing.

Briggs wrote: "There will be factors other than liability considerations that your constituents and advisors will ask you to weigh, and of course you should fully consider the views and concerns on all sides of the issue. I am only pointing out some of the obvious liability considerations that any lawyer would be expected to bring to your attention. In sum, the City may terminate the Contract by giving a 30-day notice to GE and paying any unpaid portion of the full price that GE charges for the products and services purchased by the City. If you have any questions or desire additional information, please do not hesitate to let me know."

The City has yet to respond to the letter. To date, a petition from concerned residents has been signed by more than 1,200 voters. Each day that number grows substantially.