title
CC – ACTION ITEM: Authorization to Develop Citywide Data Privacy and Responsible Technology Principles and Implement a Phased Privacy Program.
body
Meeting Date: November 9, 2026

Contact Person/Dept.: Lea Eriksen/City Manager’s Office

Phone Number: (310) 253-6007

Fiscal Impact: Yes [ ] No [X] General Fund: Yes [ ] No [X]

Attachments: Yes [ ] No [X]

Public Notification: (E-Mail) Meetings and Agendas - City Council (11/04/2026)

Department Approval: Lea Eriksen, Sr. Assistant City Manager (11/03/2026)

RECOMMENDATION

Staff recommends the City Council:
Authorize the City Manager, or designee, to develop proposed Citywide Data Privacy and Responsible Technology Principles through community engagement, interdepartmental review, consideration of the City’s existing Artificial Intelligence (AI) Governance Policy, and research practices adopted by other jurisdictions; and return the proposed principles to City Council for consideration and possible adoption.
Authorize the City Manager, or designee, to initiate a phased, staff-led Citywide Data Privacy and Responsible Technology Program using existing resources, building on the City’s AI Governance Policy and cybersecurity assessment processes.
Authorize the City Manager, or designee, to develop preliminary administrative privacy procedures, pilot risk-based privacy screening and Privacy Impact Assessments where feasible, and plan a public-facing privacy information webpage, with final policy details informed by the principles-development process.
Authorize staff to return to City Council with proposed privacy principles for consideration and a program progress report, including engagement findings, implementation milestones, assessments completed, identified gaps, and any future resource needs.
BACKGROUND

In providing municipal services, the City collects and manages information relating to residents, businesses, employees, and visitors. The growing use of digital platforms, data analytics, cameras, sensors, and other technologies creates opportunities to improve services while also requiring thoughtful privacy and security safeguards.
The City already has relevant governance tools in place. Its AI Governance Policy (AP VI-06), effective March 13, 2026, establishes guiding principles for human-centered design, security and safety, privacy, transparency, equity, accountability, effectiveness, and workforce enablement. The policy also establishes roles, review requirements, and restrictions on certain AI uses. The City also maintains a cybersecurity assessment process. A broader citywide privacy framework can build upon these existing assets without duplicating them.
As a municipal example, the City of Long Beach adopted Data Privacy Guidelines in 2021 and subsequently developed implementation tools including administrative policy, privacy assessments, and public-facing transparency resources. Culver City proposes to adapt selected practices to its size and available staffing rather than replicate a larger-city program.

DISCUSSION
Development of Citywide Privacy Principles
Rather than asking City Council to adopt a pre-drafted set of principles, staff proposes a collaborative process to develop principles for future Council consideration. Staff would use the City’s AI Governance Policy as a starting point; review privacy guidelines and implementation approaches from Long Beach and other jurisdictions; solicit input from departments that collect, use, and share data; and provide opportunities for residents and community stakeholders to comment. Potential subjects include purpose limitation, data minimization, security, transparency, equity, accountability, data sharing, retention, human oversight, and public engagement. These are discussion topics, not principles being presented for adoption at this meeting.
Phased Implementation Using Existing Resources
Staff proposes a focused, incremental implementation model coordinated by Information Technology, with executive oversight through the City Manager’s Office, legal guidance from the City Attorney’s Office, and departmental accountability for data practices. Initial work would emphasize developing the principles through community and departmental input while testing practical privacy review tools. The program would not initially require a dedicated new position, standalone digital rights platform, or comprehensive inventory of every City data system.
First 90 days: Designate an Information Technology program coordinator and departmental contacts; prepare an engagement plan; review the City’s AI policy and privacy programs in other jurisdictions; and develop an initial discussion draft and a short technology privacy screening tool.
Months 3–6: Conduct targeted community engagement and interdepartmental review of draft principles; revise the draft in response to feedback; pilot privacy screening and one or more higher-risk Privacy Impact Assessments as staff capacity permits.
Months 6–9: Refine proposed principles through legal and executive review; summarize community and departmental feedback; and return to Council with proposed principles for consideration and possible adoption.
Months 9–12: Develop a draft administrative privacy policy framework informed by engagement; plan a basic public-facing privacy and technology webpage using existing City web resources, report pilot results and implementation progress, and identify gaps and potential future resource needs.
Risk-Based Privacy Review
A brief privacy screening would be incorporated into the City’s existing technology review process to identify systems involving personal or sensitive information, monitoring or tracking, third-party sharing, AI or automated decision-making, retention concerns, or other material privacy impacts. Systems presenting elevated risks would receive a more detailed Privacy Impact Assessment and appropriate departmental, Information Technology, and legal review. This process would be applied prospectively to new or materially changed technologies and may also be piloted with selected existing systems as capacity allows.
Governance and Accountability
The City Manager’s Office would provide executive sponsorship; Information Technology would coordinate privacy screening and phased program implementation; and the City Attorney’s Office would advise on legal requirements. Individual departments would remain accountable for their operational data practices and responsible for identifying related systems, documenting operational purposes and maintaining appropriate controls, and participating in privacy reviews. Staff would use existing processes where feasible and report on milestones rather than establishing a separate oversight bureaucracy.
Regulatory and Legal Context
The program would be implemented consistent with applicable privacy, records retention, public records, confidentiality, cybersecurity, and breach notification requirements. California’s consumer privacy statutes generally regulate covered businesses rather than cities in their capacity as public agencies; staff therefore does not propose treating the CCPA/CPRA as a blanket source of municipal obligations. The City Attorney’s Office would review the administrative policy and relevant legal requirements for specific data types and City functions.
Alternatives Considered
The City could continue relying solely on decentralized departmental practices, but this would not establish a consistent citywide privacy framework. Alternatively, the City could pursue a fully resourced standalone privacy office or technology platform. Staff proposes a phased approach that leverages existing staff, the AI Governance Policy, and cybersecurity reviews while allowing future resource needs to be assessed based on implementation experience.


FISCAL ANALYSIS
There is no new appropriation requested with this action. Initial implementation is proposed using existing staff and City technology resources, subject to competing workload priorities. Although this approach does not create an immediate additional General Fund expenditure, implementation will require staff time and may affect the scheduling of other work. Any identified need for additional staffing, consultant support, or technology expenditures would be brought forward separately through applicable budget and approval processes.

ATTACHMENTS
None.

recommended action
MOTION
That the City Council:
Authorize the City Manager, or designee, to develop proposed Citywide Data Privacy and Responsible Technology Principles through community engagement, departmental review, the existing AI Governance Policy, and research on other jurisdictions; initiate a phased privacy program using existing resources; and return with proposed principles for Council consideration and a progress report.