Proposal seeks to create oversight of government surveillance and tech in Utah

As rapidly evolving technologies and cozy government contracts have raised alarms over privacy issues, or at least made some Utahns uncomfortable, a local think tank is touting a solution.

The libertarian-leaning, Lehi-based Libertas Institute released a proposal Thursday morning that it’s calling the Privacy Protection Act. The proposal would direct the Legislature to create a state privacy officer within the Auditor’s Office as well as a personal privacy oversight committee. The committee would include volunteer experts in the tech and privacy sectors along with one or two members representing law enforcement.

“For the past several years we’ve seen a number of instances in which the government has been acquiring and using technology that endangers or undermines people’s privacy,” said Libertas president Connor Boyack. “This is being done largely without any oversight, public awareness or scrutiny about whether these tools are appropriate.”

House Majority Leader Francis Gibson, R-Mapleton, has agreed to sponsor the bill in the next regular legislative session, Boyack said. Gibson did not respond to request for comment Wednesday.

States have long collected sensitive information from citizens, including driving records, credit card information and Social Security numbers. Meanwhile, private companies from Amazon to Google to Ring doorbells collect sensitive information about our comings and goings, purchases and search preferences.

But recent high-profile events have raised concerns about how governments use Utahns’ data, especially when it’s combined with rapidly changing technology. Some wonder whether proper measures are in place to protect civil rights and ensure privacy.

Most recently, state agencies, health providers, the University of Utah and local police departments suspended contracts that would have provided the surveillance company Banjo with traffic information, 911 calls, security camera images and other data. Those contracts were procured with enthusiastic support from the Attorney General’s Office after that office awarded Banjo its own contract without competition or the public’s knowledge.

Last summer, a Georgetown University investigation revealed Utah had shared its driver license database with federal agencies like Immigration and Customs Enforcement and the FBI. Those agencies, in turn, scanned drivers’ photos with facial recognition software.

“We need to be considering opt-ins and opts-out,” Boyack said. “People shouldn’t just be government guinea pigs when it comes to personal information.”

The state privacy officer Libertas proposes would inform Utah residents and other interested parties about the government’s use of technology and any associated privacy concerns. The officer would train government agencies on best practices for collecting personal information, keeping data safe and how certain platforms could raise civil liberties concerns. The official could also require government agencies to review the personally identifying information they collect and determine whether it’s properly protected.

Utah is among about a dozen states that already has a state privacy officer, according to assessments by Pew Charitable Trusts and Government Technology Magazine. The officer works under the Utah Department of Technology Services.

According to Phil Bates, who oversees the position as chief information security officer, the role only serves Cabinet-level agencies in the executive branch. It does not work with other state government entities, like the Attorney General’s Office.

“To my knowledge, that position has not really addressed any of these problems,” Boyack said. “We feel it’s better to have [an] auditor’s watchdog role and to have a privacy officer working with them.”

If the Libertas Privacy Protection Act becomes law, the personal privacy oversight committee would spend its first year compiling a list of technologies and platforms that need reform and reporting it to the Legislature. Technologies that receive a favorable review from the committee would need re-review every two years.

The committee would also evaluate public data funneled to third-party companies like Banjo, as well as the ways local law enforcement uses surveillance tools. The proposal specifically calls on the committee to review use of biometric technology by police, including facial recognition, DNA databases and fingerprints stored on cellphones.

“Now that people can unlock phones with fingerprints or their face, police officers have found it helpful to their cause to require a defendant to unlock their phone,” Boyack said. “Is that a violation of the Fifth Amendment right not to incriminate themselves?”

Attorney General Sean Reyes has deployed and promoted Rapid DNA testing in Utah, even though the FBI and civil liberties groups have cast doubts on the technology’s effectiveness or whether findings can be used in court. The attorney general also offered up the state as a testing ground for machines that secretly conduct body scans in public places.

The attorney general’s chief of staff, Ric Cantrell, has said he supported the idea of an oversight committee for surveillance technologies when pressed by The Salt Lake Tribune in the past.

“I like the idea,” Cantrell said of Libertas’ specific proposal, adding that he hadn’t had enough conversations “to take a formal position as an office.”

Although other states like California and Washington have adopted privacy protection policies, Christopher Koopman with the Center for Growth and Opportunity at Utah State University said the Libertas proposal would put Utah “ahead of the curve.”

“Most other states that are concerned about privacy are creating extremely proscriptive and backward regulations,” Koopman said. “[This proposal] is creating a space for innovation in Utah without stifling what the future may look like.”

Rep. Angela Romero, D-Salt Lake City, has raised concerns in the past about Banjo’s data collection and technologies that could potentially discriminate against minorities.

“[The proposal] recognizes that some personal data collection is a good thing and it’s helpful,” she said. “But we should definitely provide public transparency.”

Romero said she’s wary of too many restrictions on DNA databases, since they have proven useful in tracking down perpetrators of sex crimes. She also raised concerns about whether budget cuts forced by the pandemic means there will enough money to fund a new privacy officer and oversight committee next year.

Still, Romero said she mostly approves of the ideas outlined in the Libertas proposal, especially an ethics oversight commission.

“I’m glad to see other people interested in this topic,” Romero said. “I look forward to seeing this proposal go forward, to learn who’s going to run it and to have some conversations.”

Note 2:50 p.m. Thursday, May 14: This story was updated to include information from the Department of Technology Services.