Should Portland direct the City Administrator to establish a City Data and Privacy Office to advance privacy protections, steward data assets, and minimize risks from…

WHEREAS, the City of Portland has built a legacy of privacy protections through prior Council actions, including Resolution 37437 (adopted June 19, 2019) establishing Privacy and Information Protection Principles; Ordinances 190113 and 190114 (adopted September 9, 2020) prohibiting the use of face recognition technologies by City bureaus and in public accommodations; and Resolution 37608 (adopted February 1, 2023) establishing a Citywide Surveillance Technology Inventory and privacy review processes; andWHEREAS, the City of Portland has a core value of transparency to support accountability and democracy and has adopted the Open Data Resolution 36735 (adopted 2009) and established an Open Data Policy (Ordinance 188356, adopted May 2017), which, alongside the work of the Data Governance Planning and Analysis Team, led to the Citywide Data Governance Committee coordinated by BPS; and WHEREAS, since these policies were adopted, new generations of surveillance technologies, artificial intelligence (AI)-enabled camera networks, automated license plate reader (ALPR) systems connected to nationwide sharing platforms and interconnected "smart city" sensors embedded in traffic systems and public spaces, have expanded the scope and precision of government and commercial monitoring. These systems generate continuous streams of data, often analyzed in real time, and combine disparate data, from geolocation and license plate scans to facial recognition, enabling the creation of detailed patterns of movement, association, and identity across entire communities; andWHEREAS, data brokers play a central role in this evolving surveillance ecosystem by aggregating and selling personal information from multiple sources, including public records and state and local data streams. Data brokers increasingly provide services to federal law enforcement agencies and other entities seeking to circumvent local privacy and Sanctuary safeguards, allowing sensitive data originally collected for municipal purposes to be repurposed for unrelated enforcement or profiling activities; andWHEREAS, federal law enforcement agencies exploit brokered datasets and access state and national information sharing systems, creating indirect pathways to City originating data that bypass local oversight and frustrate the intent of Portland's privacy principles and Sanctuary policy; andWHEREAS, sensitive data most at risk, including but not limited to categories defined by the Oregon Consumer Privacy Act, personally identifiable information, biometric identifiers, and geolocation or utility data, upon aggregation or deanonymization, enable comprehensive surveillance of individuals and households well beyond the original context of collection; andWHEREAS, such risks fall disproportionately on marginalized communities, including Black, Indigenous, and other people of color; immigrants; unhoused Portlanders; people living with mental health conditions; and individuals engaged in protest or civic activity, exacerbating inequities and eroding public trust in government; andWHEREAS, enterprise data governance enables organizations to make decisions about data and hold those that work with data accountable to data and privacy policies, including ordinances, resolutions, and City values; and WHEREAS, effective data governance requires knowledge and experience with business needs and strategy, data collection and analysis, data management, data culture change management; and WHEREAS, to address these emerging threats and close gaps in current protections, Council seeks to enable data minimization, strengthen contractual controls, improve data security and advance data governance maturity, while enhancing public transparency and community oversight to prevent the misuse of City originating data and reaffirm Portland's Sanctuary and privacy commitments.NOW, THEREFORE, BE IT RESOLVED the City Council directs the City Administrator to establish a City Data and Privacy Office as shown in Exhibit A.BE IT FURTHER RESOLVED, this Resolution is binding City policy.