CITY OF SEATTLE
COUNCIL BILL __________________
AN ORDINANCE relating to The City of Seattle’s acquisition and use of surveillance technologies; repealing Chapter 14.18 of the Seattle Municipal Code (SMC), consisting of Sections 14.18.10, 14.18.20, 14.18.30, and 14.18.40 SMC; and adding a new Chapter 14.18 to the SMC, consisting of Sections 14.18.010, 14.18.020, 14.18.030, 14.18.040, 14.18.050, 14.18.060, 14.18.070, 14.18.080, and 14.18.090.
WHEREAS, the residents of The City of Seattle can significantly benefit from carefully considered deployments of surveillance technologies, but such technologies can also create risks to civil liberties related to privacy, freedom of speech, or disparate impact on groups through over-surveillance; and
WHEREAS, public review and oversight of surveillance technologies is fundamental to minimizing the risks posed by such technologies; and
WHEREAS, the City should be judicious in its use of surveillance technologies to avoid creating a constant and pervasive surveillance presence in public life; and
WHEREAS, the City has an obligation to take measures to improve public safety when the value of doing so outweighs the impacts on individual privacy;
WHEREAS, all City departments would benefit from clear and transparent processes for City Council approval of the procurement and operation of certain surveillance technologies; and
WHEREAS, the purpose and benefits of surveillance technologies should be clearly articulated in a transparent process in order to protect privacy and anonymity, free speech and association, equal protection, and civil rights; and
WHEREAS, the protocols proposed by City departments for the appropriate use of certain surveillance technologies should include specific steps to mitigate civil liberties concerns and the risks of information sharing with entities such as the federal government, and should incorporate racial equity principles into such protocols to ensure that surveillance technologies do not perpetuate institutionalized racism or race-based disparities; and
WHEREAS, ongoing transparency around the usage, utility, and cost-effectiveness of approved surveillance technologies will enable the City Council and the public to verify that the approved protocols provide cost-effective benefits and protect civil liberties; NOW, THEREFORE,
BE IT ORDAINED BY THE CITY OF SEATTLE AS FOLLOWS:
Section 1. Chapter 14.18 of the Seattle Municipal Code, enacted by Ordinance 124142, is repealed:
((CHAPTER 14.18 ACQUISITION AND USE OF SURVEILLANCE EQUIPMENT
The following definitions apply to this Chapter 14.18
“Data management protocols” generally means procedures governing how data collected by surveillance equipment will be retained, stored, indexed and accessed. Information comprising data management protocols includes, at a minimum, the information required in Section 14.18.30.
“Operational protocols” generally means procedures governing how and when surveillance equipment may be used and by whom. Information comprising operational protocols includes, at a minimum, the information required in Section 14.18.20.
“Surveillance equipment” means equipment capable of capturing or recording data, including images, videos, photographs or audio operated by or at the direction of a City department that may deliberately or inadvertently capture activities of individuals on public or private property, regardless of whether “masking” or other technology might be used to obscure or prevent the equipment from capturing certain views. “Surveillance equipment” includes drones or unmanned aircraft and any attached equipment used to collect data. “Surveillance equipment” does not include a handheld or body-worn device, a camera installed in or on a police vehicle, a camera installed in or on any vehicle or along a public right-of-way intended to record traffic patterns and/or traffic violations, a camera intended to record activity inside or at the entrances to City buildings for security purposes, or a camera installed to monitor and protect the physical integrity of City infrastructure, such as Seattle Public Utilities reservoirs.
14.18.20 Council Approval for City Department Acquisition and Operations of Surveillance Equipment
Any City department intending to acquire surveillance equipment shall obtain City Council approval via ordinance prior to acquisition. Prior to deployment or installation of the surveillance equipment, City departments shall obtain Council approval via ordinance of operational protocols, unless applicable operational protocols were previously approved by ordinance. In requesting approval for acquisition of surveillance equipment, City departments shall include proposed operational protocols containing the following information for the City Council's consideration, along with any other information specifically requested by the City Council:
A. A clear statement describing the purpose and use of the proposed surveillance equipment.
B. The type of surveillance equipment to be acquired and used.
C. The intended specific location of such surveillance equipment if affixed to a building or other structure.
D. How and when a department proposes to use the surveillance equipment, such as whether the equipment will be operated continuously or used only under specific circumstances, and whether the equipment will be installed permanently or temporarily
E. A description of the privacy and anonymity rights affected and a mitigation plan describing how the department's use of the equipment will be regulated to protect privacy, anonymity, and limit the risk of potential abuse.
F. A description of how and when data will be collected and retained and who will have access to any data captured by the surveillance equipment.
G. The extent to which activity will be monitored in real time as data is being captured and the extent to which monitoring of historically recorded information will occur.
H. A public outreach plan for each community in which the department intends to use the surveillance equipment that includes opportunity for public meetings, a public comment period, and written agency response to these comments.
I. If a department is requesting to acquire or use drones or other unmanned aircraft, it shall propose the specific circumstances under which they may be deployed, along with clearly articulated authorization protocols.
J. If more than one department will have access to the surveillance equipment or the data captured by it, a lead department shall be identified that is responsible for maintaining the equipment and ensuring compliance with all related protocols. If the lead department intends to delegate any related responsibilities to other departments and city personnel, these responsibilities and associated departments and personnel shall be clearly identified.
K. Whether a department intends to share access to the surveillance equipment or the collected data with any other government entity.
L. A description of the training to be provided to operators or users of the surveillance equipment.
Upon review of the information required under this Section 14.18.20, and any other information deemed relevant by the City Council, the City Council may approve the acquisition and operation of surveillance equipment, approve the acquisition of surveillance equipment and require future Council approval for operations, deny the acquisition or use of surveillance equipment for the purpose proposed, or take other actions.
14.18.30 Data Management Protocols for Surveillance Equipment
Prior to operating surveillance equipment acquired after the effective date of this ordinance, City departments shall submit written protocols for managing data collected by surveillance equipment to the City Council. The City Council may require that any or all data management protocols required under this Section 14.18.30 be approved by ordinance. These data management protocols shall address the following:
A. The time period for which any data collected by surveillance equipment will be retained.
B. The methods for storing recorded information, including how the data is to be labeled or indexed. Such methods must allow for the department personnel and the City Auditor's Office to readily search and locate specific data that is collected and determine with certainty that data was properly deleted, consistent with applicable law.
C. How the data may be accessed, including who will be responsible for authorizing access, who will be allowed to request access, and acceptable reasons for requesting access.
D. A viewer’s log or other comparable method to track viewings of any data captured or collected by the surveillance equipment, including the date, time, the individuals involved, and the reason(s) for viewing the records.
E. A description of the individuals who have authority to obtain copies of the records and how the existence and location of copies will be tracked.
F. A general description of the system that will be used to store the data.
G. A description of the unit or individuals responsible for ensuring compliance with Section 14.18.30 and when and how compliance audits will be conducted.
14.18.40 Acquisition and Use of Surveillance Equipment Related to Law Enforcement Investigations
Notwithstanding the provisions of this Chapter, City departments may acquire or use surveillance equipment that is used on a temporary basis for the purpose of a criminal investigation supported by reasonable suspicion, or pursuant to a lawfully issued search warrant, or under exigent circumstances as defined in case law. This exemption from the provisions of this ordinance does not apply to surveillance cameras mounted on drones or other unmanned aircraft.))
Section 2. A new Chapter 14.18, which includes new Sections 14.18.010, 14.18.020, 14.18.030, 14.18.040, 14.18.050, 14.18.060, 14.18.070, 14.18.080, and 14.18.090, is added to the Seattle Municipal Code as follows:
CHAPTER 14.18 ACQUISITION AND USE OF SURVEILLANCE TECHNOLOGIES
The following definitions apply to this Chapter 14.18:
“Acquire” means to obtain, purchase, lease, rent, borrow, or accept a grant, state or federal funds, or in-kind or other donations in connection with such purposes, whether pursuant to a services or subscription arrangement or otherwise.
“Seattle Police Department oversight entity” means the primary entity charged with civilian oversight over the Seattle Police Department Office of Professional Accountability or its successor.
“Surveillance” or “surveil” means to observe or analyze the movements, behavior, or actions of identifiable individuals or groups of individuals on public or private property.
“Surveillance capability” means the ability to collect, capture, transmit, or record data that could be used to surveil individuals or groups of individuals, regardless of whether the data is obscured, de-identified, or anonymized before or after collection and regardless of whether technology might be used to obscure or prevent the capturing of certain views or types of information.
“Surveillance data” shall mean any electronic data collected, captured, recorded, retained, processed, intercepted, analyzed, or shared by surveillance technology.
“Surveillance Impact Report” means the report with content enumerated in Section 14.18.040.B. of this Chapter.
“Surveillance technology” means any: electronic device; software program or hosted software solution; or services provided by a third party; that is or are designed or primarily intended by the vendor to be used for the purpose of surveillance. Surveillance technology does not include: (a) technology used to collect data from individuals who knowingly and voluntarily consent to provide, or who do not avail themselves of an opportunity to opt out of providing, such data for use by a City department; (b) social media sites or news monitoring and news alert services; (c) a body-worn camera; (d) a camera installed in or on a police vehicle; (e) a camera installed in or on any vehicle or along a public right-of-way used to record traffic patterns or traffic violations or to otherwise operate the transportation system safely and efficiently, including in any public right-of-way; (f) a camera installed on City property for security purposes; (g) a camera installed solely to protect the physical integrity of City infrastructure, such as Seattle Public Utilities reservoirs; and (h) routine patches, firmware and software updates, and hardware lifecycle replacements.
“Use” means to operate, including operation by any other entity on the City’s behalf.
14.18.020 Council approval for acquisition of surveillance technologies
A. Any City department intending to acquire surveillance technology or surveillance data shall obtain Council approval of the acquisition by ordinance, including approval for an accompanying Surveillance Impact Report, prior to acquisition.
B. If the Chief Technology Officer, in reviewing information technology resources under the process for mitigating privacy risk under subsection 3.23.030.P, determines that technology or data for which a department is requesting authorization for acquisition meets the definition of surveillance technology or surveillance data as defined in SMC 14.18.010, the department shall also be required to follow the Council approval process set forth in this Chapter 14.18. Upon making such determination, the Chief Technology Officer shall inform the City department in writing of its obligation to comply with the provisions of this Chapter 14.18 and may provide technical assistance to the department for such compliance purposes.
C. Prior to approving or rejecting a Surveillance Impact Report, the Council may request revisions to be made by the submitting City department.
D. Following Council approval of the acquisition, including the Surveillance Impact Report, the department may acquire and use the approved surveillance technology or surveillance data only in accordance with the procedures and protocols set forth in the Surveillance Impact Report, and will not enter into any agreement to acquire the same technology or data that would violate the Surveillance Impact Report.
14.18.030 Scope of acquisition approval
Notwithstanding the provisions of this Chapter 14.18, the approvals required by Section 14.18.020 also apply to: (1) acquisition of technology upgrades that materially alter the surveillance capabilities previously disclosed in the approval processes required by this Chapter 14.18; or (2) using surveillance technology or surveillance data for a purpose or in a manner not previously approved in accordance with this Chapter 14.18.
14.18.040 Surveillance impact report requirements
A. Any City department requesting Council approval for surveillance technology or surveillance data acquisition under Section 14.18.030 must include a Surveillance Impact Report (“SIR”) with the request. Reporting under this section must be sufficient to provide information to allow the City Council to make informed decisions and foster public understanding, but should not compromise public safety by providing information that would render the proposed technology or data vulnerable.
B. Each SIR will include clear and understandable statements of the following:
1. A description of the surveillance technology or surveillance data to be acquired and a description of the general capabilities and functionality, including reasonably foreseeable surveillance capabilities outside the scope of the City department’s proposed use.
2. A description of the purpose and proposed use of the surveillance technology or surveillance data, including, if available, the intended benefits of the applicable surveillance technology or surveillance data and any data or research demonstrating those benefits.
3. A clear use and data management policy, including protocols for the following:
a. How and when the surveillance technology or surveillance data will be deployed or used and by whom, including but not limited to: the factors that will be used to determine where, when, and how the technology is deployed; and other relevant information, such as whether the equipment will be operated continuously or used only under specific circumstances, and whether the equipment will be installed permanently or temporarily.
b. Any additional rules that will govern use of the surveillance technology or surveillance data and what processes will be required prior to each use of the surveillance technology or surveillance data, including but not limited to what legal standard, if any, must be met before the technology or data are used, such as for the purposes of a criminal investigation supported by reasonable suspicion.
c. How surveillance data will be securely stored. Such methods must allow for the department personnel and any oversight entity with lawful access to search and locate specific data that are collected and determine with certainty that data were properly deleted, consistent with applicable law.
d. How surveillance data will be retained and deleted, including the retention period; process for regular deletion after the retention period elapses; what auditing procedures will be implemented to ensure data are not improperly retained beyond the retention period; what measures will be taken to minimize the inadvertent or otherwise improper collection of data; and how any surveillance data, if identified as improperly collected, will be expeditiously destroyed. The SIR shall identify a specific departmental unit that is responsible for ensuring compliance with data retention requirements.
e. How surveillance data will be accessed, including who will be responsible for authorizing access, who will be allowed to request access, and acceptable reasons for requesting access; and what safeguards will be used to protect surveillance data from unauthorized access, such as viewer logging or encryption and access control mechanisms.
f. Whether a department intends to share access to the surveillance technologies or the surveillance data with any other government entity, and if so, which governmental entities and how such sharing is necessary for the purpose or purposes for which Council approval is requested; and what restrictions, if any, the department will place upon the receiving governmental entities’ use of such surveillance technologies or surveillance data. If applicable, the SIR shall include a copy of the department’s procedures for ensuring third party compliance with this provision.
g. How the department will ensure that all personnel who operate surveillance technology or access surveillance data are knowledgeable about and able to ensure compliance with the use and data management policy prior to use of the technology or data.
4. A description of how the potential impact of the surveillance on civil rights, including privacy; anonymity; and freedom of speech, religion, assembly, protest, and expression; as well as potential disparate impacts on communities of color and other marginalized communities have been taken into account; and a mitigation plan describing how the department’s acquisition will be regulated to limit such impacts.
5. A description of the fiscal impact of the surveillance technology, including initial acquisition costs; ongoing operating costs such as maintenance, licensing, personnel, legal compliance, use auditing, data retention, and security costs; any cost savings that would be achieved through the use of the technology; and any current or potential sources of funding, including any subsidies or free products being offered by vendors or governmental entities.
C. The City shall make the final SIR available to the public on its website.
14.18.050 Third party use
A. If access to the surveillance technology and surveillance data by a third party contract exists or is anticipated to exist, the City department shall enter into a written agreement requiring that such entity will be bound by any restrictions specified in the Surveillance Impact Report pursuant to SMC 14.18.030.B.3.f. with regard to such surveillance technology.
B. The City department providing such access shall have written procedures in place for determining how the department will ensure the receiving individual or entity’s compliance with any restrictions identified in the Surveillance Impact Report.
14.18.060 Acquisition and use exemptions
A. Notwithstanding the provisions of this Chapter 14.18, in the event of an emergency situation that poses an imminent and serious risk of death or substantial bodily harm, a City department may acquire and use or share surveillance technology or surveillance data for the sole purpose of preventing or mitigating such risk, if the department reasonably believes the acquisition and use of such surveillance technology or surveillance data will result in reduction of the risk. The department’s acquisition and use of the surveillance technology or surveillance data must end when such risk no longer exists and the emergency situation has ended, and any future acquisition or use of such surveillance technology or surveillance data must be approved by the City Council as set forth in this Chapter 14.18.
B. Notwithstanding the provisions of this Chapter 14.18, a City department may acquire, use or share surveillance data collected by a third party, when: (1) the data are collected by the third party for the third party’s own use; and (2) the third party’s acquisition and use are not pursuant to any purchase, subscription, or ongoing agreement with the department or City; and (3) the City’s collection is for the purpose of (i) a criminal investigation supported by reasonable suspicion or pursuant to a lawfully issued search warrant, including any subsequent criminal prosecution; or (ii) an investigation of an alleged violation of departmental policies or administrative internal investigation.
C. Notwithstanding the provisions of this Chapter 14.18, a City department may share surveillance technology or surveillance data to the extent required by court order, subpoena, or as otherwise required by law.
D. Notwithstanding the provisions of this Chapter 14.18, a technical patch or upgrade that is necessary to mitigate threats to the City’s environment may be applied without Council approval. If the patch or upgrade materially alters the surveillance capabilities of the technology, the department will not use the new surveillance capabilities of the technology to the extent possible until Council approval is obtained, and the department shall request Council approval as soon as practicably possible. The request shall include a report to Council of how the altered surveillance capabilities were used between the time of the upgrade and the report to Council.
14.18.070 Surveillance technology oversight
A. The Seattle Police Department oversight entity shall have primary responsibility for overseeing the impacts of City acquisition and use of surveillance technology and surveillance data under this Chapter 14.18. That entity shall conduct oversight in consultation with the Chief Technology Officer.
B. The Council may direct the Chief Technology Officer to prepare a privacy and civil liberties impact assessment of any technology proposed to be acquired by a City department.
C. Every year, by no later than September 15, the Chief Technology Officer shall, in consultation with the Seattle Police Department oversight entity, produce and submit to the City Council a Surveillance Technology Community Equity Impact Assessment and Policy Guidance Report. The report shall be presented annually in the Gender Equity, Safe Communities, and New Americans Committee, or its successor. The report shall address, at a minimum, the following:
1. Whether this Chapter 14.18 is effectively meeting the goals of the Race and Social Justice Initiative, including whether any communities and groups in the City are disproportionately impacted by the use of surveillance technologies;
2. What adjustments to laws and policies should be made to remedy any disproportionate impacts so as to achieve a more equitable outcome in the future; and
3. Any new approaches and considerations the City Council should bring to future reviews of requests for Council approval submitted pursuant to Section 14.18.030.
14.18.080 Annual surveillance reports
A. Each year by March 31, any City department that acquires or uses surveillance technology or surveillance data must submit to the Seattle Police Department oversight entity and Chief Technology Officer an Annual Surveillance Report which shall, at a minimum, include the following information for the previous calendar year. Reporting under this section should give sufficient information for the Council to make informed decisions and foster public understanding, but should not compromise public safety by providing information that would render the proposed technology or data vulnerable.
1. A summary of how the surveillance technology or surveillance data were used;
2. Whether the scope of usage has increased in any material way, compared to the last approved Surveillance Impact Report and compared to the last annual surveillance report if there has been one;
3. Whether and how often access to surveillance technology was granted to any other government entity, and identifying which entities;
4. A public disclosure request log, identifying whether public disclosure requests were made, by what type of entity, and whether they were granted;
5. How many deployments of the technology were pursuant to a warrant, pursuant to a non-warrant form of court authorization, or without any form of judicial authorization;
6. Where applicable, a description of whether the surveillance technology was used to investigate potential or actual: (1) criminal activity; (2) civil infractions; (3) activities or patterns considered to be indicators of potential future involvement in criminal activity; or (4) perceived or actual gang or other group affiliations;
7. A summary of any complaints or concerns received by or known by the department about the surveillance technology and/or surveillance data;
8. The results of any internal audits; any information about non-compliance with uses specified in the Surveillance Impact Report; an analysis of any discriminatory, disparate, and other adverse impacts the use of the surveillance technology may have had on the public’s civil rights and civil liberties; and any actions taken in response; and
9. Total annual costs for the use of the surveillance technology, including personnel and other ongoing costs.
B. The report shall be submitted by filing a copy with the City Clerk, with an electronic copy to the Seattle Police Department oversight entity, all Councilmembers, the Director of Central Staff, and the Chief Technology Officer.
Any person injured by a violation of this Chapter may institute proceedings against the City for injunctive relief, declaratory relief, writ of mandate, or evidence suppression in any court of competent jurisdiction to enforce this Chapter 14.18.
Section 3. Notwithstanding the provisions of Chapter 14.18 of the Seattle Municipal Code, each City department may use surveillance technology and surveillance data in its possession as of the effective date of this ordinance that has not received prior Council approval under Chapter 14.18; provided, that the department complies with the procedures set forth in this section for Council approval.
A. Each City department shall compile a list of all surveillance technology and surveillance data that it controls as of the effective date of this ordinance. The list shall be organized in order of greatest privacy impacts to least, identify whether the technology has received prior Council approval under Chapter 14.18, and if so, the ordinance number. The list, or an affirmative statement that there are no such technologies or data, shall be filed within 30 days of the effective date of this ordinance with the City Clerk, with an electronic copy to all Councilmembers, the Director of Central Staff, and the Chief Technology Officer. The City department shall, for any technology on its list for which an ordinance number is not identified, request approval consistent with Chapter 14.18 of the Seattle Municipal Code at a rate of at least one per month, in list order, beginning no later than 60 days following the effective date of this ordinance.
B. The Chief Technology Officer will conduct a status review of compliance with this section within one year of the effective date of the ordinance.
Section 4. This ordinance shall take effect and be in force 30 days after its approval by the Mayor, but if not approved and returned by the Mayor within ten days after presentation, it shall take effect as provided by Seattle Municipal Code Section 1.04.020.
Passed by the City Council the ________ day of _________________________, 2017, and signed by me in open session in authentication of its passage this _____ day of _________________________, 2017.
President ____________ of the City Council
Approved by me this ________ day of _________________________, 2017.
Edward B. Murray, Mayor
Filed by me this ________ day of _________________________, 2017.
Monica Martinez Simmons, City Clerk