Columbia Definitions ordinance (§ 21-61)

For the purposes of this article, the following words, terms and phrases shall have these definitions:

"Annual surveillance report" means an annual written report concerning specific surveillance technology that is used by the police department. The annual surveillance report will include the following:

(1) A general description of how the surveillance technology was used, including general locations and neighborhoods where surveillance technology was deployed;

(2) A general description of how often data acquired through the use of the surveillance technology was shared with outside entities, the types of data shared with outside entities, and general justification for the sharing of such information;

(3) A summary of complaints received about use of any type of surveillance technology;

(4) The results of any internal audits required by any technology use policy, including data regarding violations of the policy;

(5) Information including crime statistics, where applicable, that help the city council assess whether the surveillance technology has been effective at achieving its identified purposes;

(6) Total costs, to the extent possible, including personnel, maintenance, and other ongoing costs, for the surveillance technology and anticipated funding needed for continued use of the technology;

(7) Any requested modifications to a technology use policy for any surveillance technology; and

(8) Aggregate information concerning technology or tools exempted from public disclosure pursuant to Missouri Sunshine Law.

"Exigent circumstances" means the good faith belief of the police chief that there exists an emergency involving imminent danger of death, serious physical injury to any person, or imminent danger of significant property damage, that requires the use of the surveillance technology or the information it provides.

"Personal communication device" means a cellular telephone that has not been modified beyond stock manufacturer capabilities, a personal digital assistant, a wireless capable tablet or similar wireless two-way communications and/or portable Internet accessing devices, whether procured or subsidized by a city entity or personally owned, that is used in the regular course of conducting city business.

"Police chief" means the chief of police, or designee.

"Surveillance impact report" means a written report for use of proposed surveillance technology, which at a minimum includes the following:

(1) Information describing the technology and how it works;

(2) Information on the proposed purpose(s) and use(s) for the technology; along with any existing independent evaluations demonstrating that the technology can help achieve that purpose;

(3) If applicable, the general location(s) where the technology may be deployed and crime statistics for such location(s);

(4)

The known fiscal costs for the technology, including initial purchase, personnel and other known ongoing costs, and any current or potential sources of funding;

(5) A description of any possible adverse impacts the use of the technology may have on civil rights and liberties, and 1) the safeguards that will be implemented to prevent these impacts; and 2) the potential uses of the technology that will be expressly prohibited.

(6) A description of community engagement activities that have been undertaken in preparation of the report and proposed technology use policy, including but not limited to groups representing communities of color, immigrants and others who may be impacted by technology; and

(7) Whether use or maintenance of the technology will require data gathered by the technology to be handled or stored by a third-party vendor on an ongoing basis.

"Surveillance technology" means any device or system designed or used or intended to be used to collect, retain, process or share audio, electronic, visual, location, thermal, olfactory or similar information associated with, or capable of being associated with, any specific individual or group of specific individuals by the police department. Examples of surveillance technologies include, but are not limited to, the following: cell site simulators (Stingrays); automatic license plate readers; gunshot detectors; facial recognition software; gait analysis software; surveillance enabled or capable light bulbs or light fixtures; social media monitoring software; video cameras that record audio or video and can transmit or be remotely accessed; software designed to integrate or analyze data from surveillance technology, including surveillance target tracking and predictive policing software based on surveillance. The enumeration of surveillance technology examples in this subsection shall not be interpreted as an endorsement or approval of their use by the police department. Surveillance technology does not include the following devices, hardware or software:

(1) Office hardware, such as televisions, computers, credit card machines, copy machines, telephones and printers, that are in widespread use by city departments and used for routine city business and transactions;

(2) City databases and enterprise systems that contain information kept in the ordinary course of city business and do not contain any data or other information collected, capture, recorded, retained, processed, intercepted, or analyzed by surveillance technology, including, but not limited to, human resource, permit, license, business records, payroll, accounting, or other fiscal databases;

(3) Information technology security systems, including firewalls and other cybersecurity systems;

(4) Physical access control systems, employee identification management systems, and other physical control systems;

(5) Infrastructure and mechanical control systems, including those that control or manage street lights, traffic lights, electrical, natural gas, or water or sewer functions;

(6) Manually-operated technological devices used primarily for internal city and department communications and are not designed to surreptitiously collect surveillance data, such as radios, personal communication devices and email systems;

(7)

Manually-operated, non-wearable, handheld cameras, audio recorders and video recorders that are not designed to be used surreptitiously and whose functionality is limited to manually capturing and manually downloading video and/or audio recordings;

(8) Surveillance devices that cannot record or transmit audio or video or be remotely accessed, such as image stabilizing binoculars or night vision equipment;

(9) Computers, software, hardware, security cameras or devices used in monitoring the work and workrelated activities involving city buildings, employees, contractors and volunteers or used in conducting internal investigations involving city employees, contractors and volunteers;

(10) Medical equipment and systems used to record, diagnose, treat, or prevent disease or injury and are used and/or kept in the ordinary course of providing city services;

(11) Parking ticket devices;

(12) Photo enforcement cameras, provided the cameras and the data collected therefrom are used and maintained solely to enforce traffic laws;

(13) Police department interview room, holding cell and police department internal security audio/video recording systems;

(14) Police department computer aided dispatch (CAD), records/case management, live scan, booking, Bureau of Motor Vehicles, Missouri Uniform Law Enforcement System, 9-1-1 and related dispatch and operation or emergency services systems, and any similar state or federal maintained criminal history record information or database;

(15) Technology or tools used to investigate specific criminal incidents where such technology or tools are not readily known to the public and for which the effectiveness of the technology or tool would be compromised by disclosure;

(16) Any technology that collects information exclusively on or regarding city employees or contractors;

(17) Technology or tools used by police officers solely while they are working as part of an established federal task force.

"Technology use policy" means a policy adopted by the chief of police and approved by the city manager for use of a specific item or category of surveillance technology. Such policy shall be posted and available to the public on the city website for as long as the surveillance technology is in effect. The policy must, at a minimum, specify the following:

(1) Purpose: The specific purpose(s) that the surveillance technology item is intended to advance.

(2) Authorized use: The uses that are authorized, and the rules and processes required prior to and associated with such use.

(3) Data collection: The information that can be collected by the surveillance technology, including "open source" data.

(4) Data access: The category of individual who can access or use the collected information, and the rules and processes required prior to access or use of the information.

(5) Data protection: The general safeguards that protect information from unauthorized access, including encryption and access control mechanisms. Nothing in this subsection shall be construed to require the disclosure of information that could reveal vulnerabilities to, or otherwise increase the potential for an attack on an information technology system of the city.

(6) Data retention: The time period, if any, for which information collected by the surveillance technology will be routinely retained, the reason such retention period is appropriate to further the purpose(s), the process by which the information is regularly deleted after that period lapses, and the specific conditions that must be met to retain information beyond that period.

(7) Location notification: The provision of notice by the police department of the general location of fixed surveillance technology whenever fixed surveillance technology is deployed or moved. At a minimum the policy must provide for posting the notice on the city's website and through social media within seventy-two (72) hours of deploying the surveillance technology. Such notice will not be required to be provided if the surveillance technology is being used to investigate specific criminal incidents or the disclosure would otherwise impair a police investigation.

(8) Public access: How collected information can be accessed or used by members of the public, including criminal defendants.

(9) Third party data sharing: If and how other city or non-city entities can access, use, or retain the information, including any required justification or legal standard necessary to do so and any obligations imposed on the recipient of the information.

(10) Training: The training required for any individual authorized to use the surveillance technology or to access information collected by the surveillance technology.

(11) Accountability: The mechanisms to ensure that the technology use policy is followed, including internal personnel assigned to ensure compliance with the policy, internal record keeping of the use of the technology or access to information collected by the technology, technical measures to monitor for misuse, any independent person with oversight authority outside the police department, and the sanctions for violations of the policy. The policy shall provide for an audit of all technology used by the police department, which shall include technology or tools exempt from this article and will restrict the use of information obtained from such exempt technology or tools.