REGULATION OF SURVEILLANCE TECHNOLOGY.

Austin City Code tit. 2, ch. 2-19, art. 2

in effect

Austin City Code § 2-19-3 COUNCIL APPROVAL REQUIRED.

§ 2-19-3 - COUNCIL APPROVAL REQUIRED. Except as otherwise permitted in this chapter, City departments must obtain approval of the city council before: (A) accepting funds for surveillance technology outside of the annual budget process, including private, state, or federal grants, or donations; (B) acquiring new surveillance technology; (C) using new or existing surveillance technology, or the information it collects, for a purpose or in a manner not previously approved by the city council or otherwise required by law; or (D) entering into an agreement with a third-party entity outside of the City to acquire, share, or use surveillance technology or the information it provides. Source: Ord. No. 20260423-029, Pt. 1, 5-4-26.

Austin City Code § 2-19-4 PRIVACY IMPACT ASSESSMENT.

§ 2-19-4 - PRIVACY IMPACT ASSESSMENT. (A) A City department must prepare a privacy impact assessment for each surveillance technology the City department seeks to acquire or use in a manner not previously approved by the city council. (B) A privacy impact assessment must be prepared and developed in consultation with the chief information security officer and the city attorney, or their respective designees. (C) A privacy impact assessment must determine whether the surveillance technology poses more than a minimal risk to civil liberties and privacy rights, and must include at a minimum an analysis of whether the surveillance technology: (1) allows the indiscriminate collection of data without a warrant, probable cause, or reasonable suspicion of criminal activity, or a criminal nexus where the data is capable of being associated with individuals or groups engaged in legal behavior; (2) routinely transmits sensitive personal information through data networks subject to legal or illegal access by third parties, other than networks that are completely internal to the City; (3) can store sensitive personal information in a manner allowing for broad or unrestricted sharing of or access to the information with or by third parties outside of the criminal justice system; (4) can collect sensitive personal information without a warrant, probable cause, or reasonable suspicion of criminal activity or a criminal nexus, or where the technology allows for the creation of data records associated with particular individuals or groups; (5) collects data in such a manner that it can be used by third parties to develop or expand products, services, or technology, including training of artificial intelligence, other than for the exclusive use by and ownership of the City; (6) can be directly controlled or accessed, or its data can be directly controlled or accessed, by third parties outside of the criminal justice system; (7) collects data in such a manner that even if anonymized or compiled, the data can be analyzed or reverse engineered to associate it with individuals or groups; (8) collects data in a manner that is disproportionately associated with a particular demographic, protected class, or the exercise of a constitutionally or statutorily protected right; (9) can collect sensitive personal information of individuals on their own private property; and (10) is known to be associated with frequent violations of law, policies, or guidelines in other jurisdictions, the private sector, or previously by the City. (D) The presence of any one or more of the factors in Subsection (C) shall weigh strongly against a determination that the surveillance technology presents no or minimal risk to civil liberties and privacy rights. (E) The privacy impact assessment shall also analyze whether the benefits of the technology can be achieved through an alternative means that pose a lower risk to civil liberties and/or have a lesser financial cost. (F) A City department must submit a privacy impact assessment to the city council no less than four weeks before the city council meeting at which the City department will seek council approval pursuant to Section 2-19-3 or at which the City department will seek approval of the privacy impact assessment under Section 2-19-8. (G) A City department must post the privacy impact assessment on a publicly available City website on the same day it submits the privacy impact assessment to the city council. The city manager or designee may create a website for the purpose of hosting privacy impact assessments. Source: Ord. No. 20260423-029, Pt. 1, 5-4-26.

Austin City Code § 2-19-5 SURVEILLANCE USE POLICY.

§ 2-19-5 - SURVEILLANCE USE POLICY. (A) The city manager or designee must submit a proposed surveillance use policy to the city council for each surveillance technology that requires council approval under Section 2-19-3. (B) A surveillance use policy must be prepared and developed in consultation with the City department seeking approval of the surveillance technology. (C) A surveillance use policy must contain, at a minimum, the following: (1) the specific purposes for the surveillance technology; (2) a description of the surveillance technology and how it works; (3) provisions related to authorized and unauthorized use of the surveillance technology and data obtained with the surveillance technology, including: (a) an exclusive list of the authorized uses; (b) the rules and processes required before using the technology and the data obtained with the surveillance technology; (c) if applicable, the general location, or types of locations, where the technology may be deployed, unless revealing the locations would compromise criminal investigations; and (d) a description of the machine learning and/or artificial intelligence capabilities and features of the surveillance technology, whether use of the surveillance technology will provide data for any machine learning and/or artificial intelligence tools, and any guidelines or prohibitions relating to machine learning algorithms and/or artificial intelligence; (4) the information and data elements that the surveillance technology collects, including metadata; (5) the individuals and entities, including any City department, vendor, subcontractor, service provider, or other third party, who can access or use the collected information, and the rules and processes governing access or use, including whether data will be used by or integrated with artificial intelligence or machine learning algorithms; (6) safeguards that protect information from unauthorized access, including: (a) encryption; (b) access control; (c) anonymization of data; (d) differential privacy techniques; (e) prohibitions on attempting, directly or indirectly, to re-identify any person from anonymized or de-identified data; and (f) access oversight mechanisms; (7) the time period for which information collected by the surveillance technology will routinely be retained, the reason why the retention period is necessary to achieve the purposes of the technology, the process by which the information is regularly deleted after that period lapses, and the conditions that must be met to retain information beyond that period; (8) if and how collected information can be accessed by members of the public; (9) if and how non-City entities can access, disclose, or use the information, including: (a) any required justification and legal standards and requirements to access, disclose, or use the information; (b) any limitations on non-City entities' ability to disclose data, including to third-party service providers; and (c) any obligations imposed on, or agreements required by, the recipient of the information; (10) the training required for any individual authorized to use the surveillance technology or to access information collected by the surveillance technology, including whether there are or will be any training materials; and (11) the mechanisms to ensure that the surveillance use policy is followed, including, as applicable, a description of: (a) personnel responsible for oversight; (b) internal and external recordkeeping of use or access to the technology or the information collected, including detailed logging of data accessing events; (c) technical measures to monitor for misuse; (d) any audit requirements, including whether vendors or other relevant third parties will be required to provide City representatives or independent auditors hired by the City the ability to access any records needed to ensure compliance with the surveillance use policy; (e) any independent person or entity, inside or outside of the City, with oversight authority; and (f) sanctions for violations of the surveillance use policy. (D) The city attorney or designee must review each surveillance use policy before it is submitted to the city council for approval. (E) The city manager or designee must submit a surveillance use policy to the city council no less than four weeks before the city council meeting at which the City department will seek council approval pursuant to Section 2-19-3. (F) The city manager or designee must post the surveillance use policy on a publicly available City website on the same day the city manager or designee submits the surveillance use policy to the city council. The city manager or designee may create a website for the purpose of hosting surveillance use policies. Source: Ord. No. 20260423-029, Pt. 1, 5-4-26.

Austin City Code § 2-19-6 CONTRACTS FOR SURVEILLANCE USE TECHNOLOGIES.

§ 2-19-6 - CONTRACTS FOR SURVEILLANCE USE TECHNOLOGIES. (A) The city manager or designee must ensure that a City contract with a third party for acquisition or use of a surveillance technology must incorporate all applicable and relevant provisions of the council-approved surveillance use policy for that surveillance technology. (B) To the extent permitted by law, the responsible City department must submit proposed contracts for acquisition or use of a surveillance technology to the city council at least four weeks before the meeting at which the City department will seek council approval of the contract. (C) The city manager must ensure that each City contract with a third party for acquisition or use of a surveillance technology includes one or more provisions that provide for penalties, including monetary damages, specific performance, and early termination, if the third party breaches contractual provisions incorporating the applicable surveillance use policy. Source: Ord. No. 20260423-029, Pt. 1, 5-4-26.

Austin City Code § 2-19-7 EXCEPTION: EXIGENT CIRCUMSTANCES.

§ 2-19-7 - EXCEPTION: EXIGENT CIRCUMSTANCES. (A) Council approval under Section 2-19-3 and 2-19-5 is not required if the city manager or designee determines that exigent circumstances exist which require the immediate temporary acquisition or use of a surveillance technology to mitigate or address the exigent circumstances, provided that: (1) the city manager or designee provides written authorization for the temporary acquisition or use of the surveillance technology due to exigent circumstances; (2) within 60 days of the use or acquisition of the surveillance technology, whichever comes first, the city manager or designee reports and discloses to city council: (a) the written authorization; (b) the exigent circumstances that justified immediate acquisition or use of the surveillance technology, and the specific facts on which that determination was based; (c) a general description of the data collected; and (d) as applicable, the identities of any third parties with whom the data was shared; (3) the responsible City department ceases the use of the surveillance technology when the exigent circumstances end. (B) The city manager or designee may extend the use of a surveillance technology under this section for a definite period beyond 60 days if the city manager or designee certifies in writing to the city council that disclosing the acquisition or use of the surveillance technology within 60 days would compromise the safety or integrity of an active criminal investigation. Such certification must: (1) specify the duration of the extension beyond 60 days; (2) be disclosed in the city manager's annual report to the city council following the conclusion of the exigent circumstances; (3) provide that the extension will not continue beyond the minimum time needed to ensure the safety and integrity of an active criminal investigation; and (4) affirm that the extension is not for a purpose or an investigation unrelated to the exigent circumstances that justified the initial exception. (C) This section shall not permit the acquisition or use of a surveillance technology for mere convenience to meet standard public safety policies or goals, including general crime reduction, traffic safety, or routine law enforcement activities. (D) The city council must approve any continued use of the surveillance technology, as required by Sections 2-19-3 through 2-19-5, after the exigent circumstances end. Source: Ord. No. 20260423-029, Pt. 1, 5-4-26.

Austin City Code § 2-19-8 EXCEPTION: MINIMAL OR NO RISK TO CIVIL LIBERTIES AND PRIVACY RIGHTS.

§ 2-19-8 - EXCEPTION: MINIMAL OR NO RISK TO CIVIL LIBERTIES AND PRIVACY RIGHTS. Council approval under Section 2-19-3 is not required for a surveillance technology if the city council approves a privacy impact assessment for the surveillance technology and that privacy impact assessment determines that there is minimal or no risk to civil liberties and privacy rights posed by the surveillance technology. Source: Ord. No. 20260423-029, Pt. 1, 5-4-26.

Austin City Code § 2-19-9 PROHIBITED TECHNOLOGIES.

§ 2-19-9 - PROHIBITED TECHNOLOGIES. The following surveillance technologies or data uses are not permitted: (A) facial recognition technology, except as consistent with City policy, or with any state or federal requirements; (B) artificial intelligence or machine learning tools, except as consistent with City policy; and (C) collection of data by any vendor or third party for marketing purposes, product development purposes, or any other use that is not necessary to fulfill the terms of a contract but is instead related to the vendor's or other third party's own interests. Source: Ord. No. 20260423-029, Pt. 1, 5-4-26.

Source: City of Austin, City Code and City Charter (Municode Library, library.municode.com)URL: https://library.municode.com/tx/austin/codes/code_of_ordinances?nodeId=TIT2AD_CH2-19SUTE_ART2RESUTEFetched: 10/27/2026