AMERICAN CIVIL LIBERTIES UNION FOUNDATION Northern California April 6, 2018 Via First-Class U.S, Mail & E-mail Jacky Morales-Ferrand Housing Director Department of Housing City of San Jose 200 East Santa Clara St. 12th San Jose, CA 95113 jacky.morales-ferrand@sanjoseca.gov Re: Implementation of San Jose Rent Registry Dear Ms. Morales-Ferrand: It has come to the attention of the American Civil Liberties Union of Northern California that the City of San Jose (the “City”) plans to make the personal information of tenants gathered for its rent registry available to the public. While the rent registry may be an important tool to maintain affordable housing, the collection and public dissemination of information about tenants raises concerns about unintended negative consequences on the safety and privacy of vulnerable groups and individuals. The Department of Housing should ensure that tenants’ personal information is collected only if necessary and that it is not made publicly accessible. San Jose created the rent registry as part of an ordinance adopted by the City Council in 2017 to “protect tenants from excessive and unreasonable rent increases” (the “Apartment Rent Ordinance”). See San Jose City Council Ordinance No. 30032 (Nov. 14, 2017) (amending San Jose Mun. Code § 17.23.020). Among several other measures, the Apartment Rent Ordinance created a rent registry (the “Rent Registry”), composed of information that landlords would be required to provide about certain rental units within the City. Id. § 17.28.90. The Apartment Rent Ordinance directed the City Manager to determine, as part of the implementing regulations, the “content and submission of registrations” to be submitted by landlords about their units. Id. § 17.23.900(B). ‘Those regulations (the “Regulations’) require landlords to submit an annual registration form to the Director of the Department of Housing for certain types of American jberties Union Foundation of Northern California EXECUTIVE DIRECTOR Abdi Solteni + BOARD CHAIR Mogan Pritam Ray SAN FRANCISCO OFFICE: 39 Drumm St, San Francisce, CA 4111 FRESNO OFFICE. PO Box 188 Fresno, CA 83707 TEL (415) 621-2409 » FAX (416) 265-1478 » TTY (418) BE9-7822 » WWW_ACLUNG.ORGLir. re Implementation of San Jose Rent Registry April 6, 2018 Page 2 rental units. See Regulation 4.02, 4.03, San Jose City Council Resolution No. 78413 (Nov. 14, 2017). Among other items, landlords must provide the “number of [tlenants occupying the unit, and the [tJenants’ names.”! Id. 4.05(7). The Apartment Rent Ordinance provides some protection for this information: For so long as the City requires registry of rents and requires the Landlord to provide the name of present or former tenant, the following information, when required to be provided by and received from the Landlord is confidential and shall be treated as confidential information within the meaning of the Information Practices Act of 1977: the name of a present or former Tenant and any additional information provided concerning the Tenant. San Jose Mun. Code § 17.23.600(D). We understand that the Rent Registry will be launched by the Department of Housing shortly. Further, we understand that the Rent Registry and information collected from landlords through their annual registration statements, may be accessible to the public via an online portal or other method. We write to raise several concerns regarding the collection, use, and access to information collected for the Rent Registry, and specifically, tenants’ names. Individuals in California possess a right to privacy protected by Article I, Section 1 of the California Constitution. “Informational privacy” is one of the rights enjoyed by individuals and encompasses an individual's interest in “precluding the dissemination or misuse of sensitive and confidential information.” Hill v. Nat'l Collegiate Athletic Ass'n, 7 Cal.4th 1, 36 (1994). Among other purposes, Article I, Section 1 is intended to prevent “the overbroad collection and retention of unnecessary personal information by government and business interests” and “the improper use of information properly obtained for a specific purpose, for example, . the disclosure of it to some third party.” White v. Davis, 13 Cal.3d 757, 775 (1975). Not only would tenant names fall within the interests protected by the California Constitution's right to privacy, they constitute “personal information” within the meaning of California Information Practices Act. See Cal. Civ. Code § 1798.3(a). As with any database containing personal information, the City should have a clear purpose for the collection of each piece of data to be included in the Rent Registry. The City should be aware that personal information, once collected, may be vulnerable to disclosure in response to subpoenas, warrants or court orders, 1 The requirement that landlords submit tenants’ names to the Rent Registry marks a shift in the position previously taken by the San Jose Director of Housing, who noted, prior to the passage of the Apartment Rent Ordinance, that the Rent Registry would not include renters’ names. See Ramona Giwargis, “San Jose City Council Approves Critical Change to Rent Control Policy,” San Jose Mercury News, Jan. 81, 2017, https://bavareane,ws/2GATK61.Ltr. re Implementation of San Jose Rent Registry April 6, 2018 Page 3 including agencies engaged in immigration enforcement activities. Therefore, the City should ensure that it collects only the minimum amount of information necessary to fulfill the purposes of the Apartment Rent Ordinance and the Rent Registry. This is especially so when collecting personal, sensitive information about potentially vulnerable populations—for example, immigrants and domestic violence survivors. Information such as tenants’ names, or information like social security numbers, taxpayer identification numbers, or employer information, should be collected only if there is a demonstrated need for it. Next, if personal information about tenants is included in the database, including their names and the amount of their rent, notice should be provided to those individuals. ‘The City should also notify individuals prior to disclosure of their personal information pursuant to legal process. See, e.g., Cal. Civ. Code § 1798.24(k). ‘The City should also adopt and publish a policy regarding access to and use of the Rent Registry and appropriate limitations. Databases such as the Rent Registry should be should only be accessible by persons who require access to perform their function and serve the public. Public disclosure and access to the Rent Registry should be extremely limited. Tenant names should not be disclosed or available to the public. Access and usage policies should be explicit about who can access the Rent Registry, including: + which persons within the controlling agency have access or the authority to grant access; * whether law enforcement (state or federal) or other government agencies may access it, under what circumstances, and whether legal process is required before any such access or disclosure of the data; * whether private parties of any sort can access it, and under what circumstances or restrictions; and © whether tenants or the public at large can access the data or challenge its accuracy, Finally, the City should adopt appropriate safeguards to secure the personal information contained in the Rent Registry. In addition to an access and usage policy, appropriate technical security measures should be adopted to ensure that the usage policies are followed. Such safeguards and policies should also have an enforcement mechanism.