This op-ed appeared this week in the Salt Lake Tribune.
In the fallout from last year’s revelations about Banjo, a Utah company hired to build an intricate real-time surveillance system for the Utah Attorney General’s office, Auditor John Dougall set up a commission to investigate the matter further. The software boasted the ability to listen to 911 calls, scan social media posts, monitor traffic cameras, track the location of police cars, and more — providing quick and precise detail of crime and citizen conduct.
The Commission on Protecting Privacy and Preventing Discrimination was tasked to review Banjo’s contract and to study the issues that such a technology could produce, such as privacy concerns and discrimination. That review was completed and released earlier this week.
The commission helped craft a long series of principles and questions that every government agency should ask before obtaining and implementing software and systems that rely upon the public and private data of Utahns. These include: “What expectation of privacy do data subjects have regarding this data?” and “When collecting this data, have we been transparent about how the data will be used?”
The review mentions several times that statutory or policy restrictions need to be carefully observed, which brings us to the question of legislative oversight.
In 2019, the public (and the Utah Legislature) learned that the government had been utilizing the driver license database for several years to perform facial recognition scans on a daily basis. This technology was never headline news nor the subject of a legislative vote when it was introduced; the public was entirely unaware that this was being done.
Like with Banjo, these developments highlight a trend of government getting ahead of public awareness and undermining privacy. This places legislators in an awkward position of having to react to a controversy, which does little to further any meaningful policy conversation. Too often, the inertia of law enforcement already using a new technology makes it difficult to put the genie back in the bottle.
Clearly, a process is needed whereby new technologies law enforcement wishes to use, that can undermine our privacy, have public buy-in, transparency for how they are used, and accountability for when they are misused. The Legislature needs to act where long waits for court precedent have failed society and the innocent whose lives can be irrevocably impacted.
State Rep. Francis Gibson has introduced a new bill to tackle this issue head-on. Privacy Protection Amendments, House Bill 243, requires a public, transparent review regarding law enforcement wanting to use new surveillance technology. This enables the Legislature to ensure that the appropriate guardrails and oversight exist to protect civil liberties while still achieving public safety.
The bill builds upon the initial work of last year’s privacy commission to develop best practices and guidelines for government agencies to protect privacy, screen requests to review technologies or tools that may violate privacy, and perform ongoing analysis of the collection of personally-identifying information by various government agencies, both state and local.
By having various experts from a variety of backgrounds examine and scrutinize the use of a new technology or storage of our personal data, policy solutions can be found proactively. Recommendations can be issued to the Legislature, allowing for appropriate guardrails and levels of oversight to be established before a troublesome incident arises.
The bill does not outright ban law enforcement’s use of any particular technology, but paves the way to ensure new technologies are used appropriately, if at all.
The status quo is no longer acceptable. The state can not afford to wait for the next Banjo-like fiasco to be uncovered. The work is far from over, as the conversation is likely to continue over the next several years. Through this bill, Utah has an opportunity to be a leader in thoughtful discussion on balancing public safety interests against the individual’s constitutional right to privacy.
