LEHI — When it comes to how Utahns’ personal information is being used when government agencies adopt new high-tech tools, the policy protocols have mostly followed the old adage about forgiveness being an easier request than permission.
Residents only found out in the last year that the state was, for example, making a database of Utah driver’s license photos, including those of minors, available for years without warrants to local and federal law enforcement agencies to perform dragnet-like searches using advanced facial recognition software programs.
Streaming videocamera technology has become increasingly ubiquitous, including finding homes on the chests of law enforcement officers and where doorbells useds to be. While these devices can play a role in bolstering safety and accountability, they are also unblinking monitors of the public square and creating enormous video databases that are often controlled by unregulated third parties, like Ring doorbell owner Amazon. In Utah, multiple law enforcement agencies have contracts with companies like Ring to use doorbell camera footage in criminal investigations. And some police departments are testing new bodycams that can be controlled remotely and capable of streaming live footage.
And state leaders struck a $21 million contract last summer with a private contractor that got access to public and private surveillance camera feeds as well as 911 call center traffic and emergency vehicle tracking information in the name of performing early detection for first responders. The artificial intelligence-driven system, provided by Park City-based Banjo, rang alarm bells for local and national civil rights advocates right up to the time it was revealed that founder and CEO Damien Patton had past ties with the Ku Klux Klan and was involved in a drive-by shooting of a Nashville Jewish synagogue. The contract is currently on hold as an audit looking for both privacy breaches and any evidence of racial or religious bias in the service gets under way.
“Government typically tends to be reactive rather than proactive,” said Libertas President Connor Boyack. “This creates a process to ensure that any new technology or process that might affect privacy gets reviewed before an acquisition is made.”
The Privacy Protection Act proposes to create a designated privacy protection officer within the office of the state auditor and also a team of topic experts to act as a review and vetting committee tasked with taking a hard look at new tools before they’re considered for adoption.
The responsibilities of the state privacy officer would include developing standards for use by the officer and a Personal Privacy Oversight Committee regarding privacy law, technology and data security. The officer and panel would also provide information to private citizens, civic groups, government entities and other interested parties about government use of technology, privacy concerns and data security standards.
Boyack said the new privacy staff would backstop Utah’s part-time Legislature, which lacks both the time and expertise to keep up with a world of technological advancement that is churning out new tools and techniques at a record clip.
“This is a way for us to empower the Legislature with information from people with deeper awareness of technology and privacy issues,” Boyack said. “It’s also a way to spend more time on these topics … and give people the opportunity to thinking about it and assessing new technology. It’s time we lack in a very short and rushed legislative session.”
Boyack noted the findings of the officer and panel would not be binding, but would provide valuable information and the benefit of expert scrutiny of potentially invasive new tools.
American Civil Liberties Union of Utah legislative and policy counsel Marina Lowe said her organization supports the plan and sees it as a way to elevate personal privacy protections for Utah residents.
“We think this is a good idea,” Lowe said. “Keeping up with new technology, and how it’s put to work by government, is a constant battle. It makes sense to have a body like this focused on privacy considerations.”
Lowe said the process of walking back the use of tech tools after they’re identified as intrusive is a lot more difficult than employing a better vetting process before they’re ever in front of lawmakers, city councils or other public officials for consideration.
The Privacy Protection Act also proposes a near-future omnibus legislative reform package that would seek to enact “necessary reforms, restricting government use of private information to better protect privacy and ensure information is used consistent with the purposes for which it was created (so as to prevent “scope creep” and surveillance.)”
While the proposal was just released, Boyack said he’s received positive feedback from a number of legislators on both sides of the political aisle and is aiming to have a refined version of the Act ready for legislative consideration by next January.
The full text of the Privacy Protection Act is posted on the Libertas website at https://libertasutah.org/limited-and-open-government/proposal-the-privacy-protection-act/.