Audit Finds 2019 City Law on Surveillance Technology Needs to Be Revised to Limit Wasted Resources

San Francisco, CA — The City and County of San Francisco has had a law in place since 2019 to ensure the City’s responsible use of devices and software that collect and share data, including images and video footage. This Acquisition of Surveillance Technology law aims to protect privacy and civil liberties by requiring the City to disclose all uses of surveillance technology every year. An audit conducted by the Controller’s Office found that the law as it’s currently written does not enable the City to use a risk-based approach to match the level of oversight for different proposed uses of surveillance technology to the risks they pose. Instead, all surveillance technology is uniformly treated, despite the different levels of risk.

This is problematic because surveillance technology covers a broad range of devices and software designed to collect, retain, or share data with an individual or group. Surveillance technology ranges from body-worn cameras and aerial drones to social media monitoring software — and they all pose varying levels of privacy violation risks. By not using a risk-based assessment, the City might be inadvertently wasting resources by closely monitoring low-risk tools and devices.

“The City passed a law to protect residents’ right to privacy and safeguard their personal data. Where the law applies, it treats all technologies the same — which is a missed opportunity for stronger oversight of high-risk technologies,” said Controller Greg Wagner. “I think we’re making a strong case that the law can and should be revised in the interest of the public. As a city, we have a duty to ensure responsible use of the data we collect.”

The Controller’s Office will follow up every six months on the status of six recommendations made in today’s audit report.