A majority of California law enforcement agencies collect and use images captured by Automated License Plate Recognition (ALPR) systems. California law imposes requirements on agencies who operate or use an ALPR system, including restrictions on whom this information may be shared.
This article summarizes a recent Information Bulletin by the California Department of Justice (DOJ) which offers guidance to state and local law enforcement agencies on the implementation of Senate Bill 54 (SB 54), which imposes requirements on the storage, collection, sharing, and use of ALPR information.
SB 54 became effective on January 1, 2016, but since then, many law enforcement agencies have started to use ALPR data for investigative purposes. The DOJ’s bulletin reminds law enforcement agencies that 1.) they “shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law,” 2.) any public agency that operates or intends to operate an ALPR system must provide the opportunity for public comment at a regularly scheduled meeting before implementation, and 3.) whether the public agency is operating the ALPR or an end-user of the obtained data, the agency must conspicuously post a developed use and privacy policy on its website. The policy must contain provisions designed to protect ALPR data from “unauthorized access, destruction, use, modification, or disclosure.” These requirements are discussed in further detail below.
Prohibition on the Sale, Sharing, or Transfer of ALPR Information
Generally, public agencies and law enforcement agencies are prohibited from selling, sharing, or transferring ALPR information. There are two important exceptions to this rule. First, agencies are allowed to share ALPR information with private entities for the purposes of data hosting and towing services.
Second, they are allowed to share ALPR information with other state or local public agencies or law enforcement agencies. Unless amended, California law in effect today does not allow the sale, sharing, or transfer of ALPR information with out-of-state or federal law enforcement agencies.
Agencies should review their data user agreements to ensure that they do not allow access other than to state and local agencies or private entities for purposes of data hosting or towing services.
Security Procedures and Practices
Agencies are required to maintain reasonable security procedures and practices to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. Agencies should review their internal practices and procedures to ensure they sufficiently protect ALPR information.
Usage and Privacy Policy
Agencies are required to implement a usage and privacy policy, which must be available to the public in writing and posted conspicuously on the law enforcement agency’s website. The California DOJ states that including the policy in a manual without referring to it on the website’s main page may not satisfy the legal requirement that the policy be posted conspicuously.
The policy must contain provisions designed to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. Agencies should review their ALPR usage and privacy policy to ensure its compliance with state law.
Public Comment
Agencies that operate an ALPR system or provide access to APLR information must also provide an opportunity for public comment at a regularly scheduled meeting of the governing body of the public agency before implementing the APLR program. If an agency would like to implement an APLR program, it must first facilitate public comment.
The legal requirement that agencies go through public comment is new as of January 1, 2016. The California DOJ encourages agencies that implemented ALPR programs before January 1, 2016 consider providing an opportunity for public comment on its ALPR program,
Access Records
Agencies that operate an ALPR system or provide access to APLR information should maintain a record of any access that occurs. This includes the date and time the information was accessed, the license plate number or other data used to search the APLR system, the name of the person who accesses the information, the organization that person is with, and the purpose for accessing the information.
Agencies should require that ALPR information only be used for the authorized purposes described in its ALPR privacy policy.
A majority of California law enforcement agencies use information captured by Automated License Plate Recognition systems. Agencies should ensure they are collecting, using, and/or sharing that information as the law requires. The Department of Justice’s Information Bulletin which this article summarizes can be found here.
Questions
If you have any questions concerning the content of this Legal Alert, please contact the following from our office or the attorney with whom you normally consult.
Mona Ebrahimi
mebrahimi@kmtg.com | 916.321.4500
Brianne O’Sullivan
bosullivan@kmtg.com | 916.321.4332
Relevant Content
If you found value in this article, you might be interested in these links: