Council created a City Data and Privacy Office and directed the administration to consolidate responsibility for privacy and data governance. The legal structure is adopted, but staffing, budget, audits, and day-to-day authority determine whether it changes practice.
Portland has earlier rules on open data, privacy principles, face recognition, and surveillance inventories. Council concluded that rapid growth in data brokers, AI, camera networks, license-plate systems, and cross-agency sharing required a central authority.
In February 2026 Council enacted a new code chapter and a companion binding resolution. The office is expected to lead data minimization, vendor controls, privacy reviews, data governance, audits, corrective recommendations, and annual reporting.
The ordinance does not by itself fund every position or eliminate outside access to data. Implementation requires a transition plan, staff and budget choices, technical controls, bureau cooperation, and public reporting.
- Council action
- One ordinance plus one binding implementation resolution
- Core tools
- Data minimization, privacy review, vendor controls, audits, and annual reports
- Sensitive systems
- Surveillance technology, AI, data brokers, geolocation, biometric, and utility data
- Funding boundary
- Initial legislation directs a staffing and resource plan rather than fully funding a new bureau