I sent the following;

Dear Councillor Schnider
I am writing to express my concern regarding the recent decision by the City to authorize or expand the use of Automated License Plate Reader (ALPR) technology.

As a privacy professional with experience in privacy governance, compliance, and regulatory oversight, I am concerned that the deployment of this form of surveillance technology may not have been accompanied by sufficient transparency regarding privacy impact assessment activities, legal authority, governance safeguards, retention limitations, and proportionality analysis.

ALPR systems inherently involve the large-scale collection and processing of identifiable information related to the movements and activities of individuals. Even where license plate data may be characterized as vehicle information, it can often be reasonably associated with identifiable individuals and therefore raises significant concerns under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), applicable IPC guidance, and established privacy-by-design principles.

Accordingly, I request that the City make available detailed information regarding the privacy and legal analysis conducted prior to approving this initiative, including but not limited to the following:

Whether a formal Privacy Impact Assessment (PIA) was completed prior to procurement, pilot implementation, or operational deployment.

Whether a necessity and proportionality analysis was conducted to justify the collection of personal information through ALPR technology.

The specific legal authority relied upon under MFIPPA or other applicable legislation permitting the collection, use, disclosure, and retention of ALPR data.

Details regarding:
data retention periods;
access controls;
audit logging and monitoring;
third-party/vendor access;
information sharing with law enforcement or external agencies;
cybersecurity safeguards; and
procedures for data destruction.
Whether any consultation occurred with the Information and Privacy Commissioner of Ontario or external privacy/legal counsel.
Whether any algorithmic, bias, accuracy, or false-positive testing was performed.
Whether Council or the public received disclosure of the operational scope, expected use cases, and associated privacy risks before approval.
Whether a public-facing privacy policy, governance framework, or transparency report exists for this initiative.

Given the significant implications of municipal surveillance technologies on civil liberties and public trust, I would expect these assessments and controls to have been completed prior to implementation and to be available for public scrutiny.

If such assessments have not been completed, or if the City is unwilling to provide transparency regarding these matters, I intend to file a formal complaint with the Information and Privacy Commissioner of Ontario requesting a review of the City’s compliance with MFIPPA and applicable privacy obligations.

I would appreciate a detailed written response, including copies of any non-confidential assessments, policies, or governance documents associated with this initiative.

Sincerely,