By unanimous vote, San Francisco's public records appeals body ruled last night that the San Francisco Police Department (SFPD) violated state and local laws when it failed to respond adequately to EFF's requests for documents about face recognition and the department's relationship with the Northern California Regional Intelligence Center (NCRIC), the Bay Area's fusion center.

The Sunshine Ordinance Task Force further ordered SFPD to conduct a fresh search for records and respond point-by-point to EFF's original records request within 5 days or potentially face sanctions.

In the summer of 2019, San Francisco became the first major U.S. city to ban government use of face recognition, a technology that extracts information about a person's face and compares that data to a database of images in order to establish identity. SFPD's compliance with the ban came into question in September 2020 when the San Francisco Chronicle reported that SFPD had circulated a bulletin containing a surveillance camera image of a suspect, and in response, NCRIC staff used face recognition on the image and forwarded the results to SFPD. EFF and other organizations were concerned that this practice could constitute an end-run around the ban.

EFF followed up by submitting a public records request to SFPD under the San Francisco Sunshine Ordinance asking for 11 different categories of documents, ranging from original bulletins and correspondence regarding the original case, general discussions over face recognition between SFPD and external parties, and all documents that establish the relationship between NCRIC and SFPD.

Despite seeking a time extension, SFPD provided only one document: an email statement to reporters regarding the incident in the Chronicle article. SFPD claimed some of the records were wholesale exempt because they were investigative. For the remaining items, SFPD claimed it could not locate any records, such as standard agreements that govern SFPD's formal partnership with the fusion center.

EFF filed a formal complaint with the Task Force and only then did SFPD "re-evaluate" its response. It then provided 20 pages of previously unreleased documents, including the bulletin and emails it received from other agencies that reviewed the image. The other documents remained elusive.

The gears of oversight often move slow, and so it took a year and a half for EFF's complaint to reach a full hearing before the Task Force.

During the hearing, EFF testified that SFPD only provided records after the agency faced a formal complaint. However, we also highlighted the missing documents, such as the fusion center agreements. As we told the task force: "It's difficult to understand how SFPD could not find any information considering the city has two members of SFPD's special investigations unit assigned to NCRIC and Chief [William] Scott is chair of the NCRIC executive board." If true, then SFPD would be irresponsibly engaged in an intelligence and data sharing partnership without any record of the rules, limitations, and obligations of the agencies involved. We also raised skepticism about SFPD's claim that it could not find a single email discussing face recognition technology in the year and a half since the ban took effect.

SFPD stood by its determination and provided no further insight into its decisions. Unpersuaded, the Task Force found that SFPD had violated Sections 6253(b) and (c) of the California Public Records Act for failing to provide records in a timely manner, as well as 67.27(d) and 67.26 of the Sunshine Ordinance for failing to keep withholding of information to a minimum and failing to justify such withholding.

In addition, pursuant to section 67.21(e) of the ordinance, the Task Force ordered SFPD to comply with the remainder of our request within 5 days. Under the law, if the agency fails to comply, the Task Force must report the violation to the district attorney or attorney general.

Initially, the Task Force voted to refer the matter to the San Francisco Ethics Commission for investigation of "willful failure" to comply with the law, a form of official misconduct. However, they rescinded that vote because it was unclear which official at SFPD should be named in the referral. Task Force members indicated that this option would remain available should SFPD fail to comply with its order.

No agency, and especially not the police department, should require a member of the public to file a complaint before they provide information to the public. And no agency should get away with claiming it can't find records that plainly should exist. As we said during the hearing, a transparent and accountable government can only function if these errors are confirmed and documented by an independent body. We applaud the Task Force for its ruling and look forward to seeing what, if any, records SFPD produces next week.

And if SFPD doesn't produce these records, the Task Force should escalate the case for further investigation or prosecution.