As new, emerging technologies enter the marketplace, opportunities for innovation abound, including government uses to enhance the efficiency and effectiveness of public services. For New York City, public trust is paramount. Recognizing the critical role of privacy in government operations and efforts to innovate, New York City has enhanced its existing privacy governance to promote privacy practice and reduce administrative barriers to collaboration in furtherance of enhancing privacy protection in its operations.
Since 2018, New York City’s local privacy law, known as the Identifying Information Law, has governed how agencies collect and disclose identifying information. The law created the position of a citywide chief privacy officer with the authority to establish policies and protocols relating to how agencies handle identifying information, as well as a requirement that each agency head designate an agency privacy officer to support this work at the agency level. Each agency must operate in accordance with the policies and protocols set out by the CPO and biennially report their own policies and practices regarding the collection, retention and disclosure of identifying information to the mayor, speaker of the city council and the CPO, as well as to a body created by the Identifying Information Law known as the Citywide Privacy Protection Committee.
The Citywide Privacy Protection Committee bears the statutory charge of reviewing submitted agency reports and developing recommendations for the CPO relating to policies and procedures regarding the collection, retention and disclosure of identifying information. Through this charge, the committee is capable of improving the privacy posture of New York City government operations while considering the unique missions, subject matter and legal obligations of its agencies. The committee’s membership is defined by the Identifying Information Law. Certain New York City agencies, such as the Police Department, Department of Health and Mental Hygiene, and Department of Social Services, are mandatory members, and the mayor has the authority to add other agencies with expertise relevant to protecting identifying information. In accordance with the Identifying Information Law, the heads of each agency with membership on the committee have designated representatives to serve on their behalf.
The most recent biennial preparation and review of agency privacy reporting began in mid-2022 and was completed this February with the issuance of updated citywide privacy policies. For the second consecutive reporting cycle, the committee recommended strengthening New York City policy to enhance collaboration between privacy and cybersecurity professionals, recognizing how closely the two practice areas are connected in the work of privacy protection.
Our ability to take responsive steps to this recommendation was supported by the citywide technology strategy of the current administration. In January 2022, in one of his first executive orders, Mayor Eric Adams recognized the importance of enhancing collaboration between New York City’s technology and technology-related entities, and consolidated multiple offices into the citywide Office of Technology and Innovation. My office, the Office of Information Privacy, and the Office of Cyber Command, which is responsible for the New York City’s cyber defense efforts, were among the consolidated agencies.
For the first time in history, the citywide privacy and cybersecurity offices in New York City share a common reporting structure, which allows for Cyber Command to collaborate directly with my office. In our February 2023 privacy policy updates, Cyber Command’s perspective was invaluable in integrating the role of the agency chief information security officer in privacy protection, requirements for reporting potential privacy incidents within 24 hours of discovery to align with reporting policy for potential cybersecurity incidents and references to Cyber Command cybersecurity awareness training for New York City employees.
My office also published a revised toolkit to help agency privacy officers comply with the updated privacy policies, which incorporated Cyber Command’s point of view. The revisions included the addition of a model plan, aligned with citywide cybersecurity policy, for agency privacy officers to use when investigating potential incidents, as well as the recommendation of monthly meetings between agency privacy officers and their information security counterparts. We also provided a template agenda to support the initiation and continuation of this important dialogue and further development of a culture of collaboration between these professionals at the agency level.
This month, a reimagined Citywide Privacy Protection Committee will also be launched with a renewed mission and vision. The committee’s role will be expanded beyond the review of agency privacy reports to an advisory capacity to the CPO on matters relating to emerging technology and current events. The reimagined committee will provide dedicated time and space for communication across agency expertise and further enhancement of citywide privacy policies by allowing its membership to remain active outside of the biennial review of agency privacy reporting.
In support of this renewed charge, additional agencies were added to the committee, including Cyber Command, the Office of Labor Relations and the Office of Data Analytics, which is also now part of the OTI. Agency heads were also asked to designate their representatives on the committee factoring in its expanded role, particularly by designating representatives familiar with agency privacy policies and practices, aware of agency cybersecurity incident response and coordination efforts, and knowledgeable of current legislative, regulatory and policy developments relating to privacy protection, as well as a desire to learn about other agency practices and contribute to citywide policy development and goals related to privacy protection.
The reimagined Citywide Privacy Protection Committee, in addition to directly collaborating with the consolidated technology authorities at the OTI, will support timely updates to New York City privacy policies to meet the pace of consideration and adoption of emerging technologies, and support public trust in city services in the push to innovate. New Yorkers deserve and should expect nothing less.
