SANTA CLARA COUNTY AND SURVEILLANCE TECHNOLOGY 5 YEARS – 5 LESSONS

Surveillance by government actors has long been a complex area to navigate.  It is often thought of in the context of striking a balance between two opposing values.  On the one hand, the government has a duty to protect its constituents, and it often uses surveillance tools such as video cameras, GPS trackers, and similar forms of technology to gather information.  On the other hand, examples abound of governments using information obtained through surveillance (or even the act of surveillance itself) in ways that cause harm to individuals and society as a whole.

Recognizing this complexity, the Board of Supervisors (Board) of the County of Santa Clara (County)voted unanimously on June 7, 2016 to become one of the first local jurisdictions to adopt an ordinance governing the acquisition and, use of surveillance technologies. The Surveillance-Technology and Community-Safety Ordinance(Ordinance) explicitly acknowledges the need for balance between surveillance and privacy, noting that “the Board finds that any decision to use surveillance technology must be judiciously balanced with an assessment of the costs to theCounty and the protection of privacy, civil liberties and civil rights.”  June 7, 2021 marked the five-year anniversary of this historic vote, and we are now able to share five lessons learned from a half decade of implementing the Ordinance.

1.    Collaboration is key – The Ordinance establishes a number of internal stakeholders in the process, including: County departments that want to use surveillance technology; the Privacy Office and County Counsel(legal department) who vet Surveillance Use Policies; and the Board, who reviews and approves requests from departments to use surveillance technology at Board meetings.  Collaboration among these stakeholders is critical to the success of the Ordinance and helps to ensure that appropriate expectations are in place.  The Privacy Office and County Counsel work with departments to find appropriate solutions to strike that balance to use surveillance technology responsibly and with appropriate controls.

2.    Public participation can be a challenge – One of the goals of the Ordinance is to discuss surveillance technology in an open and transparent way prior to its acquisition. Technically, this goal is met because Surveillance Use Policies are always reviewed by the Board at public meetings, and departments report annually to the Board at public meetings as well regarding their use of surveillance technology.  Additionally, the documentation required by the Ordinance is public.  In practice, however, given the lengthy agendas at Board meetings and the unpredictability of when any particular agenda item will be heard, members of the public tend not to comment as much for most surveillance technology discussion. Other jurisdictions seeking to foster public participation in surveillance technology discussions may consider developing processes and venues dedicated specifically to that purpose should the community want to have that deeper discussion.

3.    Organization-wide policies can streamline and promote efficiency –In most instances, Surveillance Use Policies required by the Ordinance are specific to a department and type of surveillance technology.  This makes sense because only certain roles will be authorized to view surveillance data, and the purposes and uses of different technologies vary.  However, technologies that are used across an organization and that represent a relatively low risk to privacy and civil liberties may lend themselves to apply across the entire organization, rather than a single department/entity, which reduces staff and Board time.  In the County, for example, Countywide policies exist for mobile devices with audiovisual recording capability, badge printer use, and for facility access control.  

4.    Dedicated staff time – Operationalizing the Ordinance takes time.  Department staff must draft documents required by the Ordinance and report annually to the Board on their use of surveillance technology. The Privacy Office and County Counsel must review and vet documents and advise departments on the processes for satisfying the Ordinance’s requirements.  And the Board must set aside time at meetings to discuss departmental requests to acquire and use surveillance technologies.  Other governments interested in adopting similar regulations should be prepared to support the use of staff time in order to meaningfully implement the requirements established by such regulations.

5·    The effort is worth it – Since 2016, departments have drafted and received approval for over 100 different Surveillance Use Policies.  These policies have all been discussed at public Board meetings, and departments have also provided public annual reports on their use of surveillance technology to theBoard, including reporting on whether any community complaints were received.  Privacy Office involvement has elevated the controls and policy restrictions on use to better protect privacy.  In sum, transparency has been brought to the process of acquiring and using surveillance technology at the County.  The County has amended the Ordinance once and is looking to do so again to make the process run better, provide clearer direction, and remain dedicated to continuous improvement for our constituency.  All of these activities support the overall goal of striking that balance between utility and privacy to make sure that the benefits of implementing surveillance technology continue to outweigh its costs.

As Chief Privacy Officer for Santa Clara County, Mr. Shapiro brings a wide range of experience across the information privacy life cycle.  In the consulting world, he excelled in leading government and industry professional teams advising clients on the most pressing privacy matters from new program development and data breach preparedness to privacy training and compliance.  He has now brought that experience to directly lead initiatives designed to strike the balance between the drive to share information with the responsibility to protect it.

With approximately 2 million residents and 22,000 County government employees in the heart of Silicon Valley, he is developing an enterprise privacy program in support of constituent and employee privacy alike.  Building upon the County’s exceptional growth in technology and economic development, he also looks forward to creating the public-private partnerships necessary to establish a Privacy Center of Excellence (COE). Mr. Shapiro has previously participated in panel discussions and projects involving elections privacy and security, modern contact tracing in public health pandemics, consumer privacy, surveillance technology, NIST Privacy Framework, and privacy program development.