Explanation: Capitals indicate matter added to existing law.
[Brackets] indicate matter deleted from existing law.
* Warning: This is an unofficial, introductory copy of the bill.
The official copy considered by the City Council is the first reader copy.
Introductory*
City of Baltimore
Council Bill
Introduced by: Councilmember Burnett
A Bill Entitled
An Ordinance concerning
title
Surveillance Technology - Procurement
For the purpose of creating the Community Advisory Commission on Surveillance; providing for the membership and duties of the Commission; requiring City Council approval for the purchase of certain equipment; requiring City agencies to submit certain reports; defining certain terms; and generally relating to the City’s procurement of surveillance technology.
body
By adding
Article 1 - Mayor, City Council, and Municipal Agencies
Section(s) 56A-1 through 56A-6 to be under the new subtitle designation,
“Subtitle 56A. Community Advisory Commission on Surveillance”
Baltimore City Code
(Edition 2000)
By adding
Article 5 - Finance, Property, and Procurement
Section(s) 42-1 through 42-15 to be under the new subtitle designation,
“Subtitle 42. Surveillance Technology”
Baltimore City Code
(Edition 2000)
Section 1. Be it ordained by the Mayor and City Council of Baltimore, That the Laws of Baltimore City read as follows:
Article 1. Mayor, City Council, and Municipal Agencies
Subtitle 56A. Community Advisory Commission on Surveillance
§ 56A-1. Commission established.
(a) In general.
There is Baltimore City Community Advisory Commission on Surveillance.
(b) Duties.
The Commission on Surveillance shall provide the City Council with broad principles to help guide decisions about if and how surveillance technologies, as defined in § 42-1 {“Definitions”} of the City Finance, Property, and Procurement Article, should be used by the City and its municipal agencies.
§ 56A-2. Commission composition.
(a) In general.
(1) The Commission on Surveillance comprises 11 members to be appointed by the Mayor in accordance with City Charter Article IV, §6.
(2) Of the 11 members:
(i) 2 shall be representatives from an organization that focuses on
reforming urban municipal governments;
(ii) 2 shall be representatives from an organization specializing in civil rights;
(iii) 2 shall be representatives from an organization that focuses on police oversight and accountability;
(iv) 1 shall be a professional with experience in the intersection of technology and ethics;
(v) 2 shall be representatives from a community organization; and
(vi) 2 shall be selected from a group of individuals nominated by the members of the City Council.
(b) Diversity.
The membership of the Commission on Surveillance should reflect the diversity of the City’s residents and special efforts should be made to ensure communities that have historically been disproportionately subjected to government surveillance are represented.
§ 56A-3. Term of members.
(a) In general.
(1) Members of the Commission on Surveillance shall serve for a term of years, concurrent with the terms of the Mayor and City Council.
(2) At the end of a term, a member continues to serve until a successor is appointed and qualifies.
(b) Vacancies.
A member appointed to fill a vacancy in a term:
(1) must meet the same qualifications as those required for the member being succeeded; and
(2) serves only for the rest of the term and until a successor is appointed and qualifies.
(c) Term limits.
No appointed member may serve for more than 2 consecutive full terms.
§ 56A-4. Officers.
Annually, the Commission on Surveillance elect from among its members:
(1) a member to serve as the Commission’s Chair;
(2) a member to serve as the Commission’s Vice-Chair; and
(3) any other officers that the Commission considers necessary or appropriate.
§ 56A-5. Meetings, quorum, etc.
(a) Meetings.
(1) The Commission on Surveillance shall hold public meetings at least once quarterly.
(2) All meetings of the Commission must be conducted in accordance with the State Open Meetings Act, Title 3 of the General Provisions Article of the Maryland Code.
(b) Quorum.
A majority of the Commission’s authorized membership constitutes a quorum for the transaction of business.
(c) Voting.
An affirmative vote by a majority of a quorum is needed for any official action.
(d) Rules of procedure.
The Commission may adopt rules of procedure for the conduct of its meetings.
§ 56A-6. Annual assessment and guidance.
No later than September 15 of each year, the Commission on Surveillance shall produce and submit to the City Council a Surveillance Technology Community Equity Impact Assessment and Policy Guidance, which shall address:
(1) which communities and groups in the City, if any, were disproportionately impacted by the use of surveillance technology;
(2) what disparities the communities and groups reference in paragraph 1 of this subsection perceived or experienced;
(3) the adverse impact on the civil liberties of the communities and groups referenced in paragraph 1 of this subsection;
(4) adjustments to laws and policies that the agency must make to address any identified disparities;
(5) additional funding, implementation strategies, and accountability mechanisms that are needed to address any identified disparities; and
(6) new approaches and considerations the City Council should bring to future reviews of requests submitted by agencies pursuant to § 42-2 {“Mandatory City Council approval”} of the City Finance, Property, and Procurement Article.
Baltimore City Code
Article 5. Finance, Property, and Procurement
Subtitle 42. Surveillance Technology
§ 42-1. Definitions.
(a) In general.
In this subtitle the following words have the meanings indicated.
(b) Agency.
“Agency” means a:
(1) department of the City government;
(2) bureau of the City government;
(3) division of the City government; and
(4) unit of the City government.
(c) Discriminatory.
“Discriminatory” means:
(1) disparate treatment of any individual because of any real or perceived trait, characteristic, or status as to which discrimination is prohibited under:
(i) the Constitution or any law of the United States;
(ii) the constitution or any law of the State of Maryland; or
(iii) the Baltimore City Charter or any law of Baltimore City;
(2) disparate treatment of any individual because of any real or perceived association with an individual described in paragraph (1) of this subsection;
(3) disparate impact on any individual having traits, characteristics, or status described in paragraph (1) of this subsection.
(d) Disparate impact.
“Disparate impact” means an adverse effect that is disproportionately experienced by an individual described in subsection (c)(1) of this section, than by a similarly situated individual not having such traits, characteristics, or status.
(e) New surveillance technology.
(1) In general.
“New surveillance technology” means any type of surveillance technology that was not previously approved by the City Council.
(2) Exclusion.
A surveillance technology is not considered new surveillance technology when its capabilities and functionality do not differ in any significant way from a version of an equivalent surveillance technology that was previously approved by the City Council.
(f) Surveillance data.
“Surveillance data” means any electronic data that surveillance technology:
(1) collected;
(2) captured;
(3) recorded;
(4) retained;
(5) processed;
(6) intercepted;
(7) analyzed; or
(8) shared.
(g) Surveillance technology.
(1) In general.
“Surveillance technology” means:
(i) any electronic surveillance device, hardware, or software that is capable of collecting, capturing, recording, retaining, processing, intercepting, analyzing, monitoring, or sharing audio, visual, digital, location, thermal, biometric, behavioral, or similar information or communications specifically associated with, or capable of being associated with, any specific individual or group; and
(ii) any system, device, or vehicle that is equipped with an electronic surveillance device, hardware, or software.
(2) Inclusions.
“Surveillance technology” includes:
(i) international mobile subscriber identity (IMSI) catchers and other cell site simulators;
(ii) automatic license plate readers;
(iii) electronic toll readers;
(iv) closed-circuit television cameras;
(v) biometric surveillance technology, including:
(A) facial-recognition software and databases;
(B) voice-recognition software and databases;
(C) iris-recognition software and databases; and
(D) gait-recognition software and databases;
(vi) mobile DNA capture technology;
(vii) gunshot detection and location hardware and services;
(viii) x-ray vans;
(ix) video and audio monitoring and recording technology, such as:
(A) surveillance cameras;
(B) wide-angle cameras; and
(C) wearable body cameras;
(x) surveillance enabled or capable lightbulbs or light fixtures;
(xi) tools, including software and hardware, used to gain unauthorized access to a computer, computer service, or computer network;
(xii) social media monitoring software;
(xiii) through-the-wall radar or similar imaging technology;
(xiv) passive scanners of radio networks;
(xv) long-range Bluetooth and other wireless-scanning devices;
(xvi) radio-frequency I.D. scanners, and
(xvii) software designed to integrate or analyze data from
surveillance technology, including surveillance target
tracking and predictive policing software.
(2) Exclusions.
“Surveillance technology” does not include the following devices or hardware, unless they have been equipped with, or are modified to become or include, a surveillance technology as defined in paragraph (1) of this subsection:
(i) routine office hardware, such as televisions, computers, and
printers, that is in widespread public use and will not be used for any surveillance or surveillance-related functions;
(ii) Parking Ticket Device;
(iii) manually-operated, non-wearable, handheld digital cameras,
audio recorders, and video recorders that are not designed to be used surreptitiously and whose functionality is limited to manually capturing and manually downloading video or audio recordings;
(iv) surveillance devices that cannot record or transmit audio or
video or be remotely accessed, such as image stabilizing binoculars or night vision goggles;
(v) municipal agency databases that do not and will not contain any
data or other information that surveillance technology:
(A) collected;
(B) captured;
(C) recorded;
(D) retained;
(E) processed;
(F) intercepted; or
(G) analyzed; and
(vi) manually-operated technological devices that are used primarily
for internal municipal entity communications and are not designed to surreptitiously collect surveillance data, such as radios and email systems.
(h) Viewpoint-based.
“Viewpoint-based” means targeted at any community or group or its members because of their exercise of rights protected under the First Amendment of the United States Constitution.
§ 42-2. Mandatory City Council approval.
Following the approval by the Board of Estimates as described in Article VI of the City Charter, an agency must obtain the approval of a simple majority of the quorum of the City Council prior to:
(1) seeking funds for new surveillance technology, including:
(i) applying for a grant;
(ii) accepting State or federal funds; and
(iii) accepting in-kind or other donations;
(2) acquiring or borrowing new surveillance technology, whether or not that acquisition is made through the exchange of money;
(3) using new or existing surveillance technology for a purpose or in a manner not previously approved by the City Council in accordance with this Act, including the sharing of surveillance data; or
(4) soliciting proposals for or entering into an agreement with any other person or entity to acquire, share, or otherwise use surveillance technology or surveillance data.
§ 42-3. Public hearing required.
Before approving an agency’s request to use surveillance technology, as described in § 42-2 {“Mandatory City Council approval”}, the City Council must hold a public meeting consistent with Title 3 of the State General Provisions Article {“Open Meetings Act”} to allow stakeholders and members of the public to voice their opinions of the proposed action.
§ 42-4. Required submission.
(a) In general.
An agency seeking City Council approval to use surveillance technology must submit to the City Council and make publicly available:
(1) a Surveillance Impact Report; and
(2) a Surveillance Use Policy.
(b) Approval.
An agency may not use surveillance technology without the City Council’s express approval of the agency’s:
(1) Surveillance Impact Report; and
(2) Surveillance Use Policy.
(c) Revisions.
Prior to approving or rejecting an agency’s Surveillance Impact Report or Surveillance Use Policy, the City Council may request revisions be made to the documents by the agency.
§ 42-5. Surveillance Impact Report.
The Surveillance Impact Report shall be a publicly-released, legally
enforceable written report regarding the proposed use of surveillance technology that includes:
(1) a description of the surveillance technology and how it works;
(2) the proposed purpose or purposes of the use of the surveillance technology;
(3) if the surveillance technology will not be uniformly deployed or targeted throughout the City, the factors that the agency will use to determine where the technology is deployed or targeted;
(4) the fiscal impact of the use of surveillance technology; and
(5) a legal assessment specifying:
(i) any potential adverse impacts the surveillance technology, if deployed, might have on civil liberties and civil rights; and
(ii) the specific, affirmative measures the agency will implement to safeguard the public from potential adverse impacts on civil liberties and civil rights.
§ 42-6. Surveillance Use Policy.
(a) In general.
The Surveillance Use Policy shall be a publicly-released, legally enforceable written policy governing the agency’s use of the surveillance technology that includes and addresses the following:
(1) the specific purpose the surveillance technology is intended to advance;
(2) the specific capabilities and uses of the surveillance technology for which the agency is seeking approval;
(3) the legal and procedural rules the agency will use to govern each authorized used of the surveillance technology;
(4) the potential uses of the surveillance technology that will be prohibited, such as warrantless surveillance of public events and gatherings;
(5) how and under what circumstances surveillance data that was collected, captured, recorded, or intercepted by the surveillance technology will be analyzed and reviewed;
(6) the types of surveillance data that the surveillance technology will:
(i) collect:
(ii) capture;
(iii) record;
(iv) intercept; or
(v) retain;
(7) the data that may be inadvertently collected during authorized uses of the surveillance technology and the measures that will be taken to minimize such inadvertent collection of data;
(8) how the agency will expeditiously identify and delete data that was inadvertently collected during an authorized use of the surveillance technology;
(9) the safeguards the agency will use to protect surveillance data from unauthorized access, including:
(i) encryption;
(ii) access control mechanisms; and
(iii) any other necessary security measures;
(10) the rules and procedures the agency will use to govern the retention
of surveillance data, including:
(i) the time period the data will be retained and a statement explaining why the designated retention period is no greater than that which is absolutely necessary to achieve the specific purpose stated pursuant to paragraph (1) of this subsection;
(ii) the specific conditions that must be met to retain surveillance data beyond the retention period stated pursuant to subparagraph (10)(I) of this subsection; and
(iii) the process by which surveillance data will be regularly
deleted after the retention period and the auditing procedures that will be implemented to ensure the data is not improperly retained; and
(11) the legal standard a government entity or third party must meet to
access surveillance data;
(12) the mechanisms the agency will implement to ensure the Surveillance
Use Policy is followed, including:
(i) independent persons or entities that will be given oversight authority; and
(ii) sanctions that the agency will put into place for violations of
the Policy; and
(13) the procedures that the agency will put into place to ensure that:
(i) members of the public have the ability to register complaints,
concerns, and questions about the deployment or use of specific surveillance technology; and
(ii) the agency responds to each question and complaint in a timely manner.
(b) Data sharing.
If the agency requesting approval of a surveillance action is also seeking authorization to share access to surveillance technology or surveillance data with any other governmental agency, department, bureau, division, or unit, the agency will detail the following in the Surveillance Use Policy:
(1) how the agency will require that the collection, retention, and storage of surveillance data will be conducted in compliance with the principles set forth in 27 C.F.R. Part 23 {“Criminal intelligence systems operating policy”};
(2) which governmental agencies, departments, bureaus, divisions, or units will be approved for:
(i) surveillance technology sharing; and
(ii) surveillance data sharing;
(3) how such sharing is necessary for the stated purpose and use of the surveillance technology;
(4) how the agency will ensure any entity that has access to the surveillance technology or surveillance data complies with the applicable Surveillance Use Policy and does not further disclose the surveillance data to unauthorized persons and entities; and
(5) the processes the agency will use to seek the City Council and City’s approval of future surveillance technology or surveillance data agreements.
§ 42-7. Identification of lead agency.
(a) In general.
If more than 1 agency will have access to the surveillance technology or surveillance data, a lead agency shall be identified.
(b) Responsibility of lead agency.
The lead agency shall be responsible for:
(1) maintaining the surveillance technology; and
(2) ensuring compliance with all related laws, regulations, and protocols.
§ 42-8. Approval criteria.
(a) In general.
The City Council shall approve a request to fund, acquire, or use a surveillance technology if the Council determines that:
(1) the benefits of the surveillance technology outweigh its costs;
(2) the proposal will safeguard civil liberties and civil rights; and
(3) the uses and deployments of the surveillance technology will not be based upon discriminatory or viewpoint-based factors or have a disparate impact on any community or group.
(b) Documents to be made public.
All Surveillance Impact Reports and Surveillance Use Policies must be made available to the public on a designated page on the City Council’s website for as long as the related surveillance technology is in use.
(c) Acknowledgment of risk.
The City Council’s approval of funding, acquisition, or use of a surveillance technology where the risk of potential adverse impacts on civil rights or civil liberties has been identified in the Surveillance Impact Report is not an acquiescence to such impacts, but is an acknowledgment that a risk of such impacts exists and must be proactively avoided.
§ 42-9. Annual surveillance report.
(a) In general.
An agency that obtains approval for the use of a surveillance technology must:
(1) submit an annual surveillance report for each specific surveillance technology used by the agency to the City Council;
(2) make the report available to the public on its website; and
(3) submit a copy of the report to the Department of Legislative Reference for retention.
(b) Submission time line.
The report required by subsection (a) of this section shall be submitted to the City Council:
(1) within 12 months of the City Council’s approval of the surveillance technology; and
(2) on or before March 15 of each year.
(c) Content.
The report required by subsection (a) of this section shall contain the following information for the previous calendar year:
(1) a summary of how the surveillance technology was used;
(2) whether and how often collected surveillance data was shared with and received from any external persons or entities, including:
(i) the name of any recipient person or entity;
(ii) the type of data disclosed;
(iii) the legal standard under which the information was disclosed; and
(iv) the justification for the disclosure;
(3) if applicable, a breakdown of where the surveillance technology was deployed geographically;
(4) a summary of complaints or concerns that were received about the surveillance technology;
(5) information about violations of the Surveillance Use Policy and any actions taken in response;
(6) an analysis of any discriminatory, disparate, and other adverse impacts the use of the technology may have had on the public’s civil rights and civil liberties; and
(7) total annual costs for the surveillance technology, including costs for personnel, and the source of funding that the agency will use to fund the use of the surveillance technology in the coming year.
(d) Community engagement meeting.
Within 30 days of submitting and publicly releasing the report required by subsection (a) of this section, an agency must hold one or more well-publicized and conveniently located community engagement meetings at which the general public is invited to discuss:
(1) the annual surveillance report; and
(2) the agency’s use of surveillance technology.
(e) Review.
(1) In general.
After receiving the report required by subsection (a) of this section, the City Council shall determine whether each surveillance technology used by the agency has met the standard for approval set forth in § 42-8 {“Approval criteria”} of this subtitle.
(2) Modification or discontinuation.
If the City Council determines that the agency has not met the standard for approval set forth in § 42-8 {“Approval criteria”} of this subtitle, the City Council must:
(i) direct the agency to discontinue the use of the surveillance technology; or
(ii) require the agency to make modifications to the Surveillance Use Policy that will resolve the observed problems.
§ 42-10. Cumulative annual report.
(a) In general.
Not later than April 15 of each year, the City Council or its appointed designee shall release a cumulative annual public surveillance technology report.
(b) Report to be made publicly available.
The cumulative annual report described in subsection (a) of this section shall be:
(1) made publicly available in print;
(2) posted on the City Council’s public website; and
(3) submitted to the Department of Legislative Reference for retention.
(c) Contents of report.
The cumulative annual report must contain the following information for the previous calendar year:
(1) the number of requests for funding, acquisition, or use of surveillance technology the City Council received;
(2) the number of requests for funding, acquisition, or use of surveillance technology the City Council approved;
(3) the number of requests for funding, acquisition, or use of surveillance technology the City Council rejected;
(4) the number of times the City Council required modifications to a Surveillance Impact Report or Surveillance Use Policy before approving a request for funding, acquisition, or use of surveillance technology; and
(5) all annual surveillance reports submitted as required by § 42-9 of this subtitle {“Annual surveillance reports”} and where each report can be accessed.
§ 42-11. Remedies.
(a) In general.
An individual alleging a violation of this subtitle may bring a civil action against the offending agency.
(b) Damages.
An individual who prevails in a civil action under this section may recover for each violation:
(1) against an agency that negligently violated a provision of this subtitle, $1,000 or actual damages, whichever is greater;
(2) against an agency that intentionally or recklessly violated a provision of this subtitle, $5,000 or actual damages, whichever is greater;
(3) reasonable attorney’s fees and costs, including expert witness fees and other litigation expenses; and
(4) other relief, including an injunction, as the court may determine appropriate.
§ 42-12. Whistleblower protections.
(a) In general.
No agency or anyone acting on behalf of an agency may penalize an employee or applicant for employment for being a whistleblower, as defined by §42-1 {“Definitions”} of this subtitle by:
(1) taking a personnel action with respect to the employee or applicant for employment;
(2) failing to take a personnel action with respect to the employee or applicant for employment; or
(3) threatening to take or fail to take a personnel action with respect to the employee or applicant for employment.
(b) Inclusions.
For the purposes of this subtitle, personnel actions include discriminating against an employee or applicant for employment with respect to:
(1) compensation;
(2) terms or conditions of employment;
(3) access to information;
(4) due process rights;
(5) privileges of employment; or
(6) civil or criminal liability.
§ 42-13. Deletion and destruction Requirement.
(a) In general.
Any data or any other information created or collected in violation of this subtitle, and any data or information derived therefrom, shall be immediately deleted and destroyed, and may not:
(1) be offered as evidence by any City agency in any criminal or civil action or proceeding against any member of the public, except as evidence of the violation of this subtitle; and
(2) be voluntarily provided to another person or entity for use as evidence or for any other purpose.
(b) Exception.
If data or other information that was created or collected in violation of this subtitle may be material to the defense in a criminal prosecution, a copy of the relevant, potentially material data or other information shall be provided to the defendant before it is deleted and destroyed.
§ 42-14. Conflicting contractual agreements prohibited.
(a) In general.
The City or any City agency may not enter into any contract or other agreement that conflicts with the provisions of this subtitle.
(b) Conflicting provisions.
Any provisions in any contract or other agreement, including non-disclosure agreements, that conflict with the provisions of this subtitle, are void and legally unenforceable.
(c) Prior conflicts.
Provisions in contracts or agreements signed prior to the enactment of this subtitle that conflict with the provisions of this subtitle are void and unenforceable to the extent permitted by law.
§ 42-15. Certain public-private contracts prohibited.
(a) In general.
The City or any City agency may not enter into any contract or other agreement that facilitates the receipt of:
(1) the receipt of privately generated owned surveillance data from any non-governmental entity; and
(2) the prevision of government generated and owned surveillance data to any non-governmental entity.
(b) Prior contracts.
Any contracts or agreements that violate this section that were signed by the City prior to the enactment of this subtitle shall be terminated as soon as legally possible.
Section 2. And be it further ordained, That no later than 120 days following the effective date of this Ordinance, any unit of City government seeking to continue the use of any surveillance technology that was in use prior to the effective date of this Ordinance, or the sharing of surveillance data therefrom, must commence the City Council approval process described in this Ordinance.
Section 3. And be it further ordained, That if the City Council has not approved the continuing use of the surveillance technology, within 180 days of its submission to the City Council, the governmental unit shall cease its use of the surveillance technology and the sharing of surveillance data therefrom until the governmental unit obtains City Council approval in accordance with this Ordinance.
Section 3. And be it further ordained, That this Ordinance takes effect on the 30th day after the date it is enacted.