TONY WEBSTER 
 tony@tonywebster.com
 202-930-9200 July 6, 2017 BY EMAIL Mayor Emily Larson City of Duluth 411 West 1st Street, Room 403 Duluth, MN 55802 Re: Council President Joel Sipress
 City of Duluth
 411 West 1st Street, Room 330
 Duluth, MN 55802 Public Comment in Opposition to Resolution No. 17-0503R, Establishing a 
 Flat Fee of $40 Per Hour for Data Practices Act Search and Retrieval Time Dear Mayor and Council Members: My name is Tony Webster, and I am an investigative journalist in Minneapolis. I frequently write about issues of public policy—such as law enforcement’s adoption of new technology—and I’ve used the Minnesota Government Data Practices Act (“MGDPA”) on a routine basis for the past decade in my research. This year I was recognized by the Minnesota Society of Professional Journalists and the Minnesota Coalition on Government Information for this work. In addition to having a good understanding of these issues, I’ve also directly experienced working with the City of Duluth on two data requests. Currently before the Duluth City Council is a resolution that would establish a flat fee for complying with data requests of $40 per hour.1 Not only is the resolution vague in scope and plainly unlawful, it’s also misguided as a measure of public policy. I hope to convince you of all these points, but I start with questioning the necessity for the cost increase. To the extent this resolution purports to counteract increased costs of complying with data requests from journalists and the public, Duluth should pause and proactively consider whether the problem is instead its own policies and procedures not being optimized for efficiency. As contemplated in multiple Department of Administration advisory opinions, government cannot comply with the law if they haven’t invested time into thinking about data governance issues until a request comes in or until an emergency data-security issue arises.2 As of last year, the City of Duluth had not updated its public access policy since 1995. The law requires this policy be updated annually. If the City has not thought about how to efficiently manage, access, and secure data in 22 years, I respectfully suggest the City should begin their cost-savings inquiry right there. Peter Passi, Duluth mulls fee for data requests. DULUTH NEWS TRIBUNE (Jul. 6, 2017), 
 http://www.duluthnewstribune.com/news/4294040-duluth-mulls-fee-data-requests 1 2 See, e.g., Op. Minn. Dept. Admin. Nos. 95-006, 00-067, 14-013. City of Duluth, Minnesota July 6, 2017 Page ! 2 of ! 6 The City of Duluth, like all government entities, stores a lot of data in a lot of places: paper files, multiple forms of technology, databases from various vendors, and so on. Each time the City decides to create and maintain data, it has a statutory obligation to consider how that data can be made “easily accessible for convenient use” by the public.3 So, is there someone at the City charged with reviewing vendor contracts or overseeing I.T. database work to ensure ease-of-access is considered? This is not just arcane drivel, especially in context of the resolution before you. When the City expresses a desire to increase the costs of searching for and retrieving government data—but it hasn’t taken the time to ensure it is doing so as efficiently as possible—the City is passing the costs of its noncompliance and inefficiency onto the public. That’s not fair. If the City actually feels pressure from its data governance obligations, that pressure should motivate the City to look inward, and do better. And I know the City is not looking inward because Duluth City Attorney Gunnar Johnson apparently justified the cost increase resolution before you by telling a reporter the following, about me: “He’s one of a few people out there making very voluminous and administratively difficult data practices requests, and the city works to accommodate that, but we need to make sure that we’re also doing the other work of the city so that the little things are getting done…” Fittingly, the two requests I’ve sent to the City of Duluth are a perfect example of the points I am making against this resolution, and I’d like to tell you about them. I’ll be brief. Request No. 1 – License Plate Reader Request In 2015, the Minnesota Legislature passed a bill regulating law enforcement’s use of automated license plate readers (“ALPR”). The bill also created two accountability requirements: that law enforcement agencies create written procedures for ALPR use, and that law enforcement maintain logs of use—essentially, some aggregate statistics. In 2016, I sent requests to nearly every law enforcement agency in Minnesota known to use ALPR, asking for a copy of these two items, so I could report on how well the law was working. Most agencies made a good-faith effort to comply—some even completely fulfilling the request for free, via email, within a day: an indication they thought about the law in advance, and that compliance was so easy, it wasn’t even worth charging me. Some weren’t in perfect compliance, but told me they would work on fixing it, and they did. “…every government entity shall keep records containing government data in such an arrangement and condition as to make them easily accessible for convenient use.” Minn. Stat. § 13.03, subd. 1. 3 City of Duluth, Minnesota July 6, 2017 Page ! 3 of ! 6 Duluth, however, apparently did not know about the law. Duluth’s response was the worst in the entire state. First, instead of just emailing me an Excel spreadsheet or PDF as most everyone else did, 4 Duluth decided to print 401 pages from Excel to physical paper, and informed me it would charge $108.00 for doing so. The City refused to email it, upload it to a form I have on my website, or send it to me on a disc or flash drive, even at my own cost. After conversation back and forth, the City finally agreed to send me the data on a DVD, charging me $15.00 for a single disc, and $3.00 for packaging and postage. The City insisted the file was too large for email. It was not: it was a mere 1.47 megabytes, far under any email attachment size limit I’ve ever heard of. Lt. Laura Marquardt at the Duluth Police Department mailed me the DVD, but it didn’t contain the data I requested. Instead of sending me the written procedures and logs of use, Lt. Marquardt sent me a full list of every single license plate number scanned by Duluth Police Department ALPRs, including timestamp and geographical (GPS) coordinates—when the vehicle was spotted and where it was. This is a serious problem: the data Duluth sent me, which I didn’t ask for, was classified as private under law. The City sending it to me violated the privacy rights of about 10,000 drivers. I asked Duluth to send me what I actually asked for, and was told that this time, the City Attorney was going to review the data before it would be sent to me. Perhaps a good idea. But when I finally got the replacement disc, I was pained to open it and find that Duluth did it again, sending me the license plate numbers, timestamps, and locations of ALPR reads and hits—private data under law—after the City Attorney apparently reviewed it. But again, I want to emphasize that the procedures and logs of use I requested are required by state law to be prepared in advance and made easily accessible to the public. There is nothing “administratively difficult,” as Mr. Johnson says, in asking for a copy. Such difficulty arose because Duluth didn’t know the law, didn’t have effective or updated policies, passed on every opportunity to be efficient, and unnecessarily violated the privacy of ten thousand people without explanation—twice.5 And now, you are being asked to give them more money.
 Some agencies maintained handwritten logs of use. Consequently, they would have been unable to send me an Excel spreadsheet. 4 I reported Duluth to the state for this, and the state decided it did not trigger breach notification requirements because the “intent to use the data for nongovernmental purposes is not present.” In other words, because I was the good guy, Duluth got lucky—but could still have liability. 5 City of Duluth, Minnesota July 6, 2017 Page ! 4 of ! 6 Request No. 2 – Body Camera Request The Duluth Police Department was an early-adopter of law enforcement body-worn cameras, and began using the technology before there were any privacy considerations enacted in state law. Duluth has taken an active role in lobbying efforts at the Capitol on the topic of body camera data classification, and even proactively asked the State to temporarily make body camera data not-public, on behalf of law enforcement agencies throughout the state.6 Duluth being a leader in the state on these issues, I felt Duluth would have newsworthy correspondence that could provide valuable insight into not just how body cameras are being used by Minnesota law enforcement, but also how law enforcement worked to shape legislation that passed last year. Therefore, I sent a request to the City asking to see, inter alia, correspondence referencing body cameras over a key 19-month period of time. Again, the City is obligated under law to know what data it has, and where that data is located. For emails in particular, the City of Duluth uses Microsoft Exchange, which has built-in email indexing and multi-mailbox search capabilities. Performing a search of this nature is quite easy, and is routine across government and corporations in human resources investigations, civil e-discovery, and so on. But Duluth struggled, and I still don’t know why. I repeatedly and voluntarily reduced the scope of my request, but nearly four months after I sent it in, Alison Lutterman in the City Attorney’s Office was still asking me clarification questions about the request. These questions should have been asked right away to make the handling of the request most efficient. The City repeatedly broke the law by not certifying its access-denials in writing, by not fulfilling the request in a timely manner, by not allowing me access to inspect data, by not knowing how to let me see emails, and so on. These all sound to me like issues that adequate policies, procedures, and forethought could have prevented. I also believe Duluth is not effectively using resources. For example, the City has decided to have a City staff member “monitor” me while I look at emails, which feels intimidating, unnecessary, unusual, and an excuse to delay data inspections because staff isn’t available. By way of example, I’ve recently inspected data—including on government computers—at Hennepin, Dakota, Washington, and Carver counties, the cities of Shakopee and Minnetonka, and the University of Minnesota, and none of these agencies paid a staffer to sit in a room and “monitor” me. for Temporary Classification of Government Data, Dec. 16, 2014, available at 
 https://www.scribd.com/doc/250786909/Duluth-Temporary-Classification-Request-Body-Cameras 6 Application City of Duluth, Minnesota July 6, 2017 Page ! 5 of ! 6 The City has also been slow. Fourteen months after I asked to see this data, the City has still not completed the request. When I ask for updates, Ms. Lutterman frequently does not respond. When I suggested the City consider hiring an outside vendor who might be able to respond more efficiently and cost-effectively—something the Minnesota Department of Administration says would be appropriate 7—Ms. Lutterman actually responded, “your suggestion of an outside contractor made me chuckle.” *** I could go on, but the point is that the City of Duluth has serious and widespread compliance problems with—if not unmitigated contempt for—the Data Practices Act. This should be remedied, and not by charging data requestors more money. Certainly, even if Duluth were to increase search-and-retrieval costs as the resolution seeks, the City’s gain would be negligible as compared to the everyday risk of noncompliance. I also mentioned that this resolution is vague and unlawful. The resolution runs afoul of the plain language of the MGDPA, and of state advisory opinions on actual costs. The MGDPA prescribes that government entities “…may require the requesting person to pay the actual costs of searching for and retrieving government data, including the cost of employee time…” Minn. Stat. § 13.03, subd. 3(c) (emphasis added). Further, “if an entity chooses to use a flat rate for labor costs, it should be no greater than that of the lowest paid staff who could possibly complete the task.” Op. Minn. Dept. Admin. No. 04-056. Additionally, “…the statute requires a government entity to charge its actual, not average, costs associated with producing copies of data.” Op. Minn. Dept. Admin. No. 01-047. Actual costs will vary by the type of data being requested. “…in general, a flat fee structure works best for the portion of the copy fee that reflects the cost of paper, toner, etc. A flat fee for labor costs is more problematic . . . the cost to search for, retrieve and compile data, and to make the copies, can vary widely depending upon the specific request.” Op. Minn. Dept. Admin. No. 04-042. In many Data Practices Act requests, someone simply needs to copy an electronic file to an email or use a photocopier, and the lowest-paid employees capable of doing those tasks surely are not paid $40 per hour, even when considering benefits. This, again, circles back to the City’s inadequate policies and procedures. If the City had procedures to ensure the best staff were being assigned search and retrieval tasks, this 7 Op. Minn. Dept. Admin. No. 00-067 City of Duluth, Minnesota July 6, 2017 Page ! 6 of ! 6 might be less of a problem. In a way, the City desiring to charge flat fees is yet another example of the City cutting corners when it comes to its obligations under law. The resolution is also vague in both the cost line-item proposal and the resolution’s statement of purpose, which describe the fee as being “for search and retrieval.” It fails to mention that the cost is only for statutory requests for copies, which the City may charge actual costs for,8 and not statutory requests for inspection, which the City may not assess actual costs for.9 The resolution, if it were to pass, should be more specific. *** Finally, the City should recognize that the effect of increasing fees to search for and retrieve government data will be to injure the ideals of transparency and accountability in the City of Duluth. Assigning a data request “…task for search, retrieval, and copying to one of [a government entity’s] most highly compensated employees…could have a chilling effect on an individual's right to gain access to data.” Op. Minn. Dept. Admin. No. 00-027. The City should also be particularly embarrassed for not reaching out to frequent users of the law for feedback and collaboration. While some city clerks and police chiefs have picked up the phone and called me and others in this line of work, invited us to roundtable discussions, attended events, and emailed us asking for feedback on policy proposals, Duluth would rather not engage. When I attempted to discuss Duluth’s compliance issues with Duluth Assistant City Attorney Alison Lutterman, she curtly responded, “…I will not debate the issue with you further.” When I attempted to call Duluth City Attorney Gunnar Johnson today to discuss this resolution and my concerns about it, upon hearing my name, my call was refused, and I was told I couldn’t even leave a voicemail for him. Closing doors is bad governing. Closing doors and then asking for more money to help keep the door shut is bad government. I respectfully urge you to reject this resolution.
 Sincerely,
 
 Tony Webster 8 Minn. Stat. § 13.03, subd. 3(c) 9 Minn. Stat. § 13.03, subd. 3(b)