Welcome
Privacy & Data Security Law News

San Francisco Voters OK ‘Privacy First’ Policy

Nov. 7, 2018, 2:56 PM

Companies would have to secure users’ personal information and disclose their data collection practices to win government contracts under a just-approved San Francisco ballot measure.

Voters in the center of the tech industry, with fresh memories of Facebook Inc.’s Cambridge Analytica data harvesting scandal, approved the “Privacy First” initiative Nov. 6. It affirms the public’s right to know how their personal information —including geolocation data, IP addresses, and genetic and biometric data—is being used and to opt out of having their data collected or sold.

The measure covers information collected on residents and visitors by any entity that has contracts, leases, and permits with the city. Companies would have to abide by 11 principles, including securing data against unauthorized or unlawful disclosure, having publicly available policies on how to access data collected, and adopting tools to correct information.

The initiative, which passed by an unofficial count of 56.79 percent to 43.21 percent, follows California’s new privacy law that gives consumers the right to know what information is being collected about them, whether it is being sold, and to whom.

The city must now enact policies ensuring any personal information collection or use is done transparently, lawfully, securely, and narrowly. The San Francisco administrator must draft a law for Board of Supervisors’ approval by May 31, 2019, that would apply the guiding principles to third parties. The initiative is expected to have minimal to moderate impact on the cost of government, depending on the policies adopted, the Controller’s analysis said.

Delayed Results

Mail-in ballots likely will change the final tally, which may be weeks away. Nearly 58 percent of ballots cast in the 2016 election were absentee ballots, the California Secretary of State’s office said.

All valid ballots in California are counted regardless of outcome. And late registrations also may affect outcomes, as California permits same-day registration and voting. But in-person voters approved the measure by a margin large enough that absentee ballots are unlikely to change the outcome.

The Privacy First initiative faced opposition from the Society of Professional Journalists, Northern California chapter, the League of Women Voters, and San Francisco Labor Council. The groups said supervisors could tamper with the city’s voter-enacted open government law without providing the promised benefits, under the initiative.

But city Supervisor Aaron Peskin, who wrote the initiative, has said that it contains language explicitly saying that “it may not be implemented to undermine the Sunshine Ordinance or any other public records law.”

To contact the reporter on this story: Joyce E. Cutler in San Francisco at jcutler@bloomberglaw.com

To contact the editors responsible for this story: Rebecca Baker at rbaker@bloomberglaw.com, Keith Perine at kperine@bloomberglaw.com