By Sarah Weld
The Oakland City Council voted unanimously this week to adopt a set of privacy principles drafted by three students from the Samuelson Law, Technology & Public Policy Clinic.
In just 14 weeks last spring, Nomi Conway ’20, Amisha Gandhi ’20, and Courtney Reed ’20 wrote the privacy principles and guidance documents for the city. This lays a foundation for city staff to carefully consider decisions any time they use residents’ personal information in situations such as installing surveillance cameras, collecting data on students who miss school, using automated license-plate readers to log parking violations, or gathering personal information about library patrons.
Supervised by Samuelson Clinic Associate Director Erik Stallman ‘03 and Clinical Supervising Attorney Megan Graham, the students also drafted guidance explaining how to implement each of the principles, using hypothetical examples inspired from real-world scenarios drawn from extensive interviews and meetings with city departments, local nonprofits, and academics. (The clinic’s work has already spread to other cities. In December, the Alameda City Council voted to adopt its own set of privacy principles based closely on the students’ efforts.)
“While much of the discussion of privacy regulation occurs at the state and federal level, privacy is very much a local concern. In interview after interview, representatives from Oakland municipal departments and civic organizations tied privacy to social justice and equity in the provision of city services,” Stallman says. “The students did tremendous work in ensuring that the Oakland privacy principles and guidance reflect this understanding. It’s no wonder that other cities in the East Bay modeled their own principles after this work.”
Samuelson Clinic Director Catherine Crump notes that today, “major cities collect more and more personal information about everyone who lives, works, and travels through them. Yet many cities do not recognize how sensitive this data can be. Most of them have not thought systematically about how to use personal information to advance important civic goals while also safeguarding privacy and other civil liberties.”
Oakland’s Privacy Advisory Commission, which has been examining these issues closely, approached the clinic and asked if it would help develop a set of privacy principles that reflect Oakland’s distinctive spirit. Conway, Gandhi, and Reed pulled it off in a semester.
“To say the students did the heavy lifting is an understatement. They did everything,” says Brian Hofer, inaugural chair of the commission and an expert on surveillance technology laws, who worked closely with the students. “It’s a really great body of work. The Oakland document is the most robust and strongest that I have seen.”
Graham agrees. “Oakland is diverse, active, big-hearted, and special, and the city wanted the principles to reflect all of those qualities,” she says. “The students’ work is genuinely incredible—top-quality, very thoughtful and considerate, and true to Oakland. We looked at the privacy principles of various other cities, and tried to find a way to build a set that is Oakland’s own.”
The students spent as much as 25 hours a week on the project, mostly in meetings with staff from the cities of Oakland, Seattle, and Portland, nonprofits like the American Civil Liberties Union of Northern California, Oakland privacy commissioners, and academic experts.
“It was fascinating, a side of policy-making that I had never experienced before. It really informed my legal education because a lot of what we do as lawyers touches on this policy-making process,” says Reed, who worked in the policy planning office of the Federal Trade Commission (FTC) last fall through the UCDC Law Program.
Gandhi says she especially appreciated the variety of work during the project, “from drafting the one-page privacy principles, which was deceptively difficult, to conducting informational meetings with various Oakland city departments, and presenting our progress at monthly [commission] meetings.”
“I’m continually blown away by the way cities in California operate,” says Conway, who also spent last fall working at the FTC, in its privacy and identity protection division. “It’s incredible how active local communities are and how effective they are in dictating how their cities run. I really admire the way Oakland residents are so engaged in how their city works.”
The result of those hours of meetings is a comprehensive set of specific hypothetical examples based on real-life situations of how and why city staff should use the privacy principles. Those examples include:
- The Oakland Unified School District wants to measure the percentage of chronically absent students. But since the purpose of the measurement is not to enforce truancy laws, the district does not collect names or other personal information, just demographic data.
- The Oakland Public Library decides to limit how much personal information it collects from patrons when they apply for a library card, so that law enforcement agencies can’t use the information to target vulnerable people. Patrons only have to provide their date of birth and first and last names, for which they can use an alias.
- The Oakland Department of Race and Equity wants to measure how many children visit local emergency rooms for asthma-related symptoms so it can look at racial disparities in asthma in children, which has been linked to housing conditions. The department decides to collect only the race, zip codes, and census block data for these children.
“It was really a form of creative lawyering. We are all law students or already lawyers, and very little of what we were doing was offering legal advice or drafting legal documents, but we still created this written work that will have an impact on the city,” Conway says. “A big takeaway for me was how much impact you can have on the local level as opposed to state or federal.”