BILL ANALYSIS Ó
-----------------------------------------------------------------
|SENATE RULES COMMITTEE | SB 893|
|Office of Senate Floor Analyses | |
|1020 N Street, Suite 524 | |
|(916) 651-1520 Fax: (916) | |
|327-4478 | |
-----------------------------------------------------------------
THIRD READING
Bill No: SB 893
Author: Hill (D)
Amended: 5/29/14
Vote: 21
SENATE JUDICIARY COMMITTEE : 5-2, 4/22/14
AYES: Jackson, Corbett, Lara, Leno, Monning
NOES: Anderson, Vidak
SENATE APPROPRIATIONS COMMITTEE : 5-2, 5/23/14
AYES: De León, Hill, Lara, Padilla, Steinberg
NOES: Walters, Gaines
SENATE FLOOR : 18-15, 5/28/14 (FAIL)
AYES: Beall, Block, Corbett, De León, DeSaulnier, Hancock,
Hill, Hueso, Jackson, Lara, Leno, Lieu, Mitchell, Monning,
Padilla, Pavley, Steinberg, Torres
NOES: Anderson, Berryhill, Cannella, Correa, Evans, Fuller,
Gaines, Galgiani, Huff, Knight, Morrell, Nielsen, Vidak,
Walters, Wyland
NO VOTE RECORDED: Calderon, Hernandez, Liu, Roth, Wolk, Wright,
Yee
SUBJECT : Automated license plate recognition systems: use of
data
SOURCE : Author
DIGEST : This bill places restrictions on the use of Automated
License Plate Recognition (ALPR) technology by both public and
CONTINUED
SB 893
Page
2
private sector users.
Senate Floor Amendments of 5/29/14 eliminate the proposed
restrictions relating to limitations on retained captured ALPR
data, trespass, and using the data to establish probable cause,
and additionally make ALPR data subject to California's Data
Breach Notification Law, but only when such data is compromised
in combination with an individual's first name or first initial
and last name, provided either the name or the ALPR data was not
encrypted.
ANALYSIS : The California Constitution provides that all
people have inalienable rights, including the right to pursue
and obtain privacy.
Existing law:
1.Permits the Department of California Highway Patrol (CHP) to
retain license plate data captured by a license plate reader
for no more than 60 days, except in circumstances when the
data is being used as evidence or for all felonies being
investigated, including, but not limited to, auto theft,
homicides, kidnaping, burglaries, elder and juvenile
abductions, Amber Alerts, and Blue Alerts.
2.Prohibits the CHP from selling ALPR data for any purpose and
making it available to an agency that is not a law enforcement
agency or an individual who is not a law enforcement officer.
The data may be used by a law enforcement agency only for
purposes of locating vehicles or persons when either are
reasonably suspected of being involved in the commission of a
public offense.
3.Requires the CHP to monitor internal use of the ALPR data to
prevent unauthorized use.
4.Requires the CHP to report to the Legislature its ALPR
practices and usage, including the number of ALPR data
disclosures, a record of the agencies to which data was
disclosed and for what purpose, and any changes in policy that
affect privacy concerns.
This bill:
CONTINUED
SB 893
Page
3
1. Prohibits an ALPR operator, as defined, from using an ALPR
system to retain any information or data other than the
license plate number, the date and time the information or
data is collected, and the location coordinates where the
information or data is collected, and prohibits the
collection of this information or data from a license plate
number that is not in public view.
2. Specifies that an "ALRP operator" does not include the CHP
when subject to Section 2413 of the Vehicle Code or a
transportation agency when subject to Section 31490 of the
Streets and Highways Code.
3. Requires an ALPR operator to ensure that the information or
data collected through the use or operation of the ALPR
system is protected with reasonable operational,
administrative, technical, and physical safeguards to ensure
its confidentiality and integrity.
4. Requires an ALPR operator to implement and maintain
reasonable security procedures and practices appropriate for
the nature of the information or data collected via an ALPR
system, in order to protect the information or data from
unauthorized access, destruction, use, modification, or
disclosure.
5. Requires an ALPR operator to implement and maintain a usage
and privacy policy in order to ensure that the information or
data collected through the use or operation of the ALPR
system is consistent with respect for individuals' privacy
and civil liberties, specifies that the usage and privacy
policy shall be available in writing, and, if the ALPR
operator has an Internet Web site, the usage and privacy
policy shall be posted conspicuously on that Internet Web
site.
6. Makes ALPR data subject to California's Data Breach
Notification Law, but only when such data is compromised in
combination with an individual's first initial and last name,
provided either the name or the ALPR data was not encrypted.
7. Requires an ALPR operator to maintain a record of access if
the ALPR operator accesses or provides access to information
or data collected through the use or operation of an ALPR
CONTINUED
SB 893
Page
4
system and specifies that at a minimum, the record shall
include, but not be limited to, all of the following:
The date and time the information or data is accessed;
The person who accesses the information or data; and
The purpose for accessing the information or data.
1. Provides that in addition to any other sanctions, penalties,
or remedies provided by law, an individual who has been
harmed may bring a civil action in any court of competent
jurisdiction against a person who knowingly caused that
violation. This bill further provides that a court may award
all of the following:
Actual damages, but not less than liquidated damages in
the amount of two thousand five hundred dollars ($2,500);
Punitive damages upon proof of willful or reckless
disregard of the law;
Reasonable attorney's fees and other litigation costs
reasonably incurred; and
Other preliminary and equitable relief as the court
determines to be appropriate.
Background
ALPR systems use either mobile (e.g., attached to the outside of
a vehicle) or stationary cameras and sophisticated computer
software to capture and record a vehicle's license plate
information. These systems typically operate by photographing
an image of a license plate, use character recognition software
to convert the image into the alpha-numeric characters of the
license plate, and then compare the alpha-numeric data to data
held in other databases to, for example, instantly identify
stolen cars or locate vehicles subject to repossession. ALPR
systems capture other data as well, including the geographic
location of a license plate and the time and date that the
license plate was scanned. Using this additional ALPR captured
data, it is possible over time and with multiple scans to
construct the locational history of scanned vehicles. The
technology works at lightning speed; one company, ELSAG North
America, advertises that its vehicle-based ALPR system can
capture up to 1,800 license plate reads per minute, day or
night, can capture data from parked and moving vehicles across
up to 4 lanes of traffic, day or night and in any weather, and
CONTINUED
SB 893
Page
5
can read license plate data at moving speeds of up to 150 mph
(241 kph).
Law enforcement uses ALPR technology to identify and locate
stolen vehicles and to compare information obtained against
databases of outstanding warrants. Auto repossession companies
take advantage of ALPR technology to help find debtors who are
behind on their car payments. In January 2012, a California
Watch article entitled "Private Company Hoarding License-Plate
Data on US Drivers" noted:
Capitalizing on one of the fastest-growing trends in law
enforcement, a private California-based company has
compiled a database bulging with more than 550 million
license-plate records on both innocent and criminal drivers
that can be searched by police?. [P]olice around the
country have been affixing high-tech scanners to the
exterior of their patrol cars, snapping a picture of every
passing license plate and automatically comparing them to
databases of outstanding warrants, stolen cars, and wanted
bank robbers. The units work by sounding an in-car alert
if the scanner comes across a license plate of interest to
police, whereas before, patrol officers generally needed
some reason to take an interest in the vehicle, like a
traffic violation.
But when a license plate is scanned, the driver's
geographic location is also recorded and saved, along with
the date and time, each of which amounts to a record or
data point. Such data collection occurs regardless of
whether the driver is a wanted criminal, and the vast
majority are not.
While privacy rules restrict what police can do with their
own databases, Vigilant Video, headquartered in Livermore,
Calif., offers a loophole. It's a private business not
required to operate by those same rules?. Vigilant
distinguished itself from competitors by going one step
further and collecting hundreds of millions of scans to
create what's known as the National Vehicle Location
Service. A West Coast sales manager for the company, Randy
Robinson, said the scanners - as well as data from them
compiled in the location system - do far more than simply
help identify stolen vehicles. Stories abound of the
CONTINUED
SB 893
Page
6
technology also being used by police to stop wanted
killers, bank robbers, and drug suspects. Kidnappers could
be intercepted, too. (Schulz, Private Company Hoarding
License-Plate Data on US Drivers (January 12, 2012)
(as of April 14,
2014).)
Vigilant Solutions, the company featured in the California Watch
article, now advertises that its database of license plate
records obtained from commercial sources now includes "over 1.8
billion detections and grows at a rate of almost 70 million per
month." (See http://vigilantsolutions.com/products/nvls (as of
April 14, 2014).)
Existing law restricts the use of ALPR technology by the
California Highway Patrol. In 2011, the Legislature passed and
the Governor signed AB 115 (Committee on Budget, Ch. 38, Stats.
2011), the transportation budget trailer bill, which allows the
CHP to retain data captured by ALPR systems for no more than 60
days except as specified. AB 115 also prohibited the CHP from
selling the data or making it available to anyone other than law
enforcement agencies.
FISCAL EFFECT : Appropriation: No Fiscal Com.: Yes
Local: No
According to the Senate Appropriations Committee:
Significant private sector and local law enforcement agency
costs (Private/Local) to comply with the provisions of this
measure, including but not limited to administrative
resources and infrastructure needs potentially required for
compliance. As the use or access of ALPR systems is not a
mandated activity, any restrictions placed on the use or
access of these systems is estimated to be non-reimbursable
by the state.
Potential periodic minor to significant costs to public
(State/Local) and private ALPR operators, to issue data
breach notifications. Private entities and public agencies
are already subject to data breach notification law,
therefore costs would be dependent on the frequency and size
of data breaches specific to ALPR data, and the process of
notification utilized by each agency.
CONTINUED
SB 893
Page
7
Potentially significant reduction in fine revenues (Local)
due to reduced collection of outstanding parking fines
utilizing ALPR technology. Although state penalty
assessments and state surcharges are generally not levied on
parking violations, to the extent the parking violation
rises to the level of being assessed a fine associated with
a notice to appear, state levies would apply, resulting in
potentially significant reductions in revenue to the General
Fund.
No impact to CHP and transportation agencies due to carve
out for these agencies, with the exception of the ALPR data
breach notification requirement.
SUPPORT : (Verified 5/29/14)
American Civil Liberties Union of California
OPPOSITION : (Verified 5/29/14)
California Fraternal Order of Police
California Peace Officers Association
Long Beach Police Officers Association
Los Angeles County Professional Peace Officers Association
Sacramento County Deputy Sheriffs Association
Santa Ana Police Officers Association
ARGUMENTS IN SUPPORT : According to the author, "Except for
data collected by the California Highway Patrol (CHP), current
law does not provide any privacy safeguards for data collected
by automatic license plate reader (ALPR) systems. Current law
does not prohibit the sale or sharing of ALPR data, leaving it
wide open for personal information to be inappropriately sold or
shared with non-law enforcement entities. In addition, current
law allows ALPR data to be retained for an indeterminate amount
of time, placing no limitations on when the data may be accessed
or for what purposes.
"Used primarily by law enforcement agencies, automatic license
plate reader technology uses a combination of high-speed
cameras, software and criminal databases to rapidly check and
track the license plates of millions of Californians. The
CONTINUED
SB 893
Page
8
technology is also used by private, non-law enforcement
entities, such as parking and repossession companies. Some
private communities use it to monitor who enters and leaves the
community.
"License plate readers can be placed anywhere, but are most
commonly mounted on the roof of law enforcement vehicles. Based
on a survey of law enforcement agencies, the American Civil
Liberties Union (ACLU) estimates that 75 percent of law
enforcement agencies currently employ ALPRs, 85 percent plan to
expand their use, and within the next five years, at least 25
percent of all police vehicles will be equipped with the
technology.
"But as use of this technology has increased, so has the concern
of civil libertarians. Whether or not a 'hit' occurs, all
license plate scans are sent to "fusion centers" - large
regional databases that aggregate ALPR data from various law
enforcement agencies. The ACLU estimates that only 1 percent of
ALPR data results in a 'hit,' the other 99 percent of data has
no relation to a crime. A database that is maintained on behalf
of various northern California law enforcement agencies
reportedly has over 100 million unique license plate scans. A
database maintained on behalf of San Diego law enforcement
agencies reportedly has over 49 million license plate scans. A
company that maintains an ALPR database maintained for private
companies, such as insurance companies, collections agencies,
and private investigators, has over 1 billion license plate
scans. The company sells vehicle sighting reports for between
$10 and $25.
"SB 893 would place reasonable limits on the use of data
collected by ALPR technology."
ARGUMENTS IN OPPOSITION : A group of opponents argue, among
other things, that, "ALPR data does NOT include any personally
identifying information about the registered owner of the
vehicle or anyone else. ALPR data is used for a wide variety of
legitimate commercial and public purposes, including but not
limited to the following: (1) by the National Center for
Missing and Exploited Children to assist in the recovery of
missing and exploited children; (2) by municipal government and
their commercial vendors to enforce parking limits and identify
repeat parking scofflaws; (3) by public and private parking
CONTINUED
SB 893
Page
9
facilities - including shopping malls, entertainment venues and
airport parking providers - to assist patrons with locating
their vehicles; (4) by the financial services industry to locate
and recover vehicles used to secure anon-performing loan; (5) by
the insurance industry - through a partnership with the National
Insurance Crime Bureau ("NICB") - to investigate underwriting
and claims fraud and to recover stolen vehicles; and (6) private
property owners, including homeowners associations, to control
access and ensure the safety and security of persons and
property."
AL:n:k 5/29/14 Senate Floor Analyses
SUPPORT/OPPOSITION: SEE ABOVE
**** END ****
CONTINUED