BILL ANALYSIS                                                                                                                                                                                                    Ó



                                                                            



           ----------------------------------------------------------------- 
          |SENATE RULES COMMITTEE            |                        SB 893|
          |Office of Senate Floor Analyses   |                              |
          |1020 N Street, Suite 524          |                              |
          |(916) 651-1520         Fax: (916) |                              |
          |327-4478                          |                              |
           ----------------------------------------------------------------- 
           
                                           
                                    THIRD READING


          Bill No:  SB 893
          Author:   Hill (D)
          Amended:  5/29/14
          Vote:     21

           
           SENATE JUDICIARY COMMITTEE  :  5-2, 4/22/14
          AYES:  Jackson, Corbett, Lara, Leno, Monning
          NOES:  Anderson, Vidak

           SENATE APPROPRIATIONS COMMITTEE  :  5-2, 5/23/14
          AYES:  De León, Hill, Lara, Padilla, Steinberg
          NOES:  Walters, Gaines

           SENATE FLOOR  :  18-15, 5/28/14 (FAIL)
          AYES:  Beall, Block, Corbett, De León, DeSaulnier, Hancock,  
            Hill, Hueso, Jackson, Lara, Leno, Lieu, Mitchell, Monning,  
            Padilla, Pavley, Steinberg, Torres
          NOES:  Anderson, Berryhill, Cannella, Correa, Evans, Fuller,  
            Gaines, Galgiani, Huff, Knight, Morrell, Nielsen, Vidak,  
            Walters, Wyland
          NO VOTE RECORDED:  Calderon, Hernandez, Liu, Roth, Wolk, Wright,  
            Yee


           SUBJECT  :    Automated license plate recognition systems:  use of  
          data

           SOURCE  :     Author


           DIGEST  :    This bill places restrictions on the use of Automated  
          License Plate Recognition (ALPR) technology by both public and  
                                                                CONTINUED





                                                                     SB 893
                                                                     Page  
          2

          private sector users.

          Senate Floor Amendments  of 5/29/14 eliminate the proposed  
          restrictions relating to limitations on retained captured ALPR  
          data, trespass, and using the data to establish probable cause,  
          and additionally make ALPR data subject to California's Data  
          Breach Notification Law, but only when such data is compromised  
          in combination with an individual's first name or first initial  
          and last name, provided either the name or the ALPR data was not  
          encrypted.

           ANALYSIS  :    The California Constitution provides that all  
          people have inalienable rights, including the right to pursue  
          and obtain privacy. 

          Existing law:

          1.Permits the Department of California Highway Patrol (CHP) to  
            retain license plate data captured by a license plate reader  
            for no more than 60 days, except in circumstances when the  
            data is being used as evidence or for all felonies being  
            investigated, including, but not limited to, auto theft,  
            homicides, kidnaping, burglaries, elder and juvenile  
            abductions, Amber Alerts, and Blue Alerts. 

          2.Prohibits the CHP from selling ALPR data for any purpose and  
            making it available to an agency that is not a law enforcement  
            agency or an individual who is not a law enforcement officer.   
            The data may be used by a law enforcement agency only for  
            purposes of locating vehicles or persons when either are  
            reasonably suspected of being involved in the commission of a  
            public offense.  

          3.Requires the CHP to monitor internal use of the ALPR data to  
            prevent unauthorized use. 

          4.Requires the CHP to report to the Legislature its ALPR  
            practices and usage, including the number of ALPR data  
            disclosures, a record of the agencies to which data was  
            disclosed and for what purpose, and any changes in policy that  
            affect privacy concerns.  

          This bill:
           

                                                                CONTINUED





                                                                    SB 893
                                                                     Page  
          3

            1. Prohibits an ALPR operator, as defined, from using an ALPR  
             system to retain any information or data other than the  
             license plate number, the date and time the information or  
             data is collected, and the location coordinates where the  
             information or data is collected, and prohibits the  
             collection of this information or data from a license plate  
             number that is not in public view.

           2. Specifies that an "ALRP operator" does not include the CHP  
             when subject to Section 2413 of the Vehicle Code or a  
             transportation agency when subject to Section 31490 of the  
             Streets and Highways Code. 

           3. Requires an ALPR operator to ensure that the information or  
             data collected through the use or operation of the ALPR  
             system is protected with reasonable operational,  
             administrative, technical, and physical safeguards to ensure  
             its confidentiality and integrity.

           4. Requires an ALPR operator to implement and maintain  
             reasonable security procedures and practices appropriate for  
             the nature of the information or data collected via an ALPR  
             system, in order to protect the information or data from  
             unauthorized access, destruction, use, modification, or  
             disclosure.

           5. Requires an ALPR operator to implement and maintain a usage  
             and privacy policy in order to ensure that the information or  
             data collected through the use or operation of the ALPR  
             system is consistent with respect for individuals' privacy  
             and civil liberties, specifies that the usage and privacy  
             policy shall be available in writing, and, if the ALPR  
             operator has an Internet Web site, the usage and privacy  
             policy shall be posted conspicuously on that Internet Web  
             site.

           6. Makes ALPR data subject to California's Data Breach  
             Notification Law, but only when such data is compromised in  
             combination with an individual's first initial and last name,  
             provided either the name or the ALPR data was not encrypted.

           7. Requires an ALPR operator to maintain a record of access if  
             the ALPR operator accesses or provides access to information  
             or data collected through the use or operation of an ALPR  

                                                                CONTINUED





                                                                     SB 893
                                                                     Page  
          4

             system and specifies that at a minimum, the record shall  
             include, but not be limited to, all of the following:

                 The date and time the information or data is accessed;
                 The person who accesses the information or data; and
                 The purpose for accessing the information or data.

           1. Provides that in addition to any other sanctions, penalties,  
             or remedies provided by law, an individual who has been  
             harmed may bring a civil action in any court of competent  
             jurisdiction against a person who knowingly caused that  
             violation.  This bill further provides that a court may award  
             all of the following:

                 Actual damages, but not less than liquidated damages in  
               the amount of two thousand five hundred dollars ($2,500);
                 Punitive damages upon proof of willful or reckless  
               disregard of the law;
                 Reasonable attorney's fees and other litigation costs  
               reasonably incurred; and
                 Other preliminary and equitable relief as the court  
               determines to be appropriate.

           Background
           
          ALPR systems use either mobile (e.g., attached to the outside of  
          a vehicle) or stationary cameras and sophisticated computer  
          software to capture and record a vehicle's license plate  
          information.  These systems typically operate by photographing  
          an image of a license plate, use character recognition software  
          to convert the image into the alpha-numeric characters of the  
          license plate, and then compare the alpha-numeric data to data  
          held in other databases to, for example, instantly identify  
          stolen cars or locate vehicles subject to repossession.  ALPR  
          systems capture other data as well, including the geographic  
          location of a license plate and the time and date that the  
          license plate was scanned.  Using this additional ALPR captured  
          data, it is possible over time and with multiple scans to  
          construct the locational history of scanned vehicles.  The  
          technology works at lightning speed; one company, ELSAG North  
          America, advertises that its vehicle-based ALPR system can  
          capture up to 1,800 license plate reads per minute, day or  
          night, can capture data from parked and moving vehicles across  
          up to 4 lanes of traffic, day or night and in any weather, and  

                                                                CONTINUED





                                                                     SB 893
                                                                     Page  
          5

          can read license plate data at moving speeds of up to 150 mph  
          (241 kph).  

          Law enforcement uses ALPR technology to identify and locate  
          stolen vehicles and to compare information obtained against  
          databases of outstanding warrants.  Auto repossession companies  
          take advantage of ALPR technology to help find debtors who are  
          behind on their car payments.  In January 2012, a California  
          Watch article entitled "Private Company Hoarding License-Plate  
          Data on US Drivers" noted:

               Capitalizing on one of the fastest-growing trends in law  
               enforcement, a private California-based company has  
               compiled a database bulging with more than 550 million  
               license-plate records on both innocent and criminal drivers  
               that can be searched by police?.  [P]olice around the  
               country have been affixing high-tech scanners to the  
               exterior of their patrol cars, snapping a picture of every  
               passing license plate and automatically comparing them to  
               databases of outstanding warrants, stolen cars, and wanted  
               bank robbers.  The units work by sounding an in-car alert  
               if the scanner comes across a license plate of interest to  
               police, whereas before, patrol officers generally needed  
               some reason to take an interest in the vehicle, like a  
               traffic violation.

               But when a license plate is scanned, the driver's  
               geographic location is also recorded and saved, along with  
               the date and time, each of which amounts to a record or  
               data point.  Such data collection occurs regardless of  
               whether the driver is a wanted criminal, and the vast  
               majority are not.

               While privacy rules restrict what police can do with their  
               own databases, Vigilant Video, headquartered in Livermore,  
               Calif., offers a loophole.  It's a private business not  
               required to operate by those same rules?.  Vigilant  
               distinguished itself from competitors by going one step  
               further and collecting hundreds of millions of scans to  
               create what's known as the National Vehicle Location  
               Service.  A West Coast sales manager for the company, Randy  
               Robinson, said the scanners - as well as data from them  
               compiled in the location system - do far more than simply  
               help identify stolen vehicles.  Stories abound of the  

                                                                CONTINUED





                                                                     SB 893
                                                                     Page  
          6

               technology also being used by police to stop wanted  
               killers, bank robbers, and drug suspects.  Kidnappers could  
               be intercepted, too.  (Schulz, Private Company Hoarding  
               License-Plate Data on US Drivers (January 12, 2012)  
                (as of April 14,  
               2014).)

          Vigilant Solutions, the company featured in the California Watch  
          article, now advertises that its database of license plate  
          records obtained from commercial sources now includes "over 1.8  
          billion detections and grows at a rate of almost 70 million per  
          month."  (See http://vigilantsolutions.com/products/nvls (as of  
          April 14, 2014).)

          Existing law restricts the use of ALPR technology by the  
          California Highway Patrol.  In 2011, the Legislature passed and  
          the Governor signed AB 115 (Committee on Budget, Ch. 38, Stats.  
          2011), the transportation budget trailer bill, which allows the  
          CHP to retain data captured by ALPR systems for no more than 60  
          days except as specified. AB 115 also prohibited the CHP from  
          selling the data or making it available to anyone other than law  
          enforcement agencies.

           FISCAL EFFECT  :    Appropriation:  No   Fiscal Com.:  Yes    
          Local:  No

          According to the Senate Appropriations Committee:

              Significant private sector and local law enforcement agency  
              costs (Private/Local) to comply with the provisions of this  
              measure, including but not limited to administrative  
              resources and infrastructure needs potentially required for  
              compliance.  As the use or access of ALPR systems is not a  
              mandated activity, any restrictions placed on the use or  
              access of these systems is estimated to be non-reimbursable  
              by the state.    

              Potential periodic minor to significant costs to public  
              (State/Local) and private ALPR operators, to issue data  
              breach notifications.  Private entities and public agencies  
              are already subject to data breach notification law,  
              therefore costs would be dependent on the frequency and size  
              of data breaches specific to ALPR data, and the process of  
              notification utilized by each agency.

                                                                CONTINUED





                                                                     SB 893
                                                                     Page  
          7


              Potentially significant reduction in fine revenues (Local)  
              due to reduced collection of outstanding parking fines  
              utilizing ALPR technology.  Although state penalty  
              assessments and state surcharges are generally not levied on  
              parking violations, to the extent the parking violation  
              rises to the level of being assessed a fine associated with  
              a notice to appear, state levies would apply, resulting in  
              potentially significant reductions in revenue to the General  
              Fund.

              No impact to CHP and transportation agencies due to carve  
              out for these agencies, with the exception of the ALPR data  
              breach notification requirement.


           SUPPORT  :   (Verified  5/29/14)

          American Civil Liberties Union of California

           OPPOSITION  :    (Verified  5/29/14)

          California Fraternal Order of Police
          California Peace Officers Association
          Long Beach Police Officers Association
          Los Angeles County Professional Peace Officers Association
          Sacramento County Deputy Sheriffs Association
          Santa Ana Police Officers Association

           ARGUMENTS IN SUPPORT  :    According to the author, "Except for  
          data collected by the California Highway Patrol (CHP), current  
          law does not provide any privacy safeguards for data collected  
          by automatic license plate reader (ALPR) systems.  Current law  
          does not prohibit the sale or sharing of ALPR data, leaving it  
          wide open for personal information to be inappropriately sold or  
          shared with non-law enforcement entities.  In addition, current  
          law allows ALPR data to be retained for an indeterminate amount  
          of time, placing no limitations on when the data may be accessed  
          or for what purposes.

          "Used primarily by law enforcement agencies, automatic license  
          plate reader technology uses a combination of high-speed  
          cameras, software and criminal databases to rapidly check and  
          track the license plates of millions of Californians.  The  

                                                                CONTINUED





                                                                     SB 893
                                                                     Page  
          8

          technology is also used by private, non-law enforcement  
          entities, such as parking and repossession companies.  Some  
          private communities use it to monitor who enters and leaves the  
          community. 

          "License plate readers can be placed anywhere, but are most  
          commonly mounted on the roof of law enforcement vehicles.  Based  
          on a survey of law enforcement agencies, the American Civil  
          Liberties Union (ACLU) estimates that 75 percent of law  
          enforcement agencies currently employ ALPRs, 85 percent plan to  
          expand their use, and within the next five years, at least 25  
          percent of all police vehicles will be equipped with the  
          technology. 

          "But as use of this technology has increased, so has the concern  
          of civil libertarians. Whether or not a 'hit' occurs, all  
          license plate scans are sent to "fusion centers" - large  
          regional databases that aggregate ALPR data from various law  
          enforcement agencies.  The ACLU estimates that only 1 percent of  
          ALPR data results in a 'hit,' the other 99 percent of data has  
          no relation to a crime.  A database that is maintained on behalf  
          of various northern California law enforcement agencies  
          reportedly has over 100 million unique license plate scans.  A  
          database maintained on behalf of San Diego law enforcement  
          agencies reportedly has over 49 million license plate scans.  A  
          company that maintains an ALPR database maintained for private  
          companies, such as insurance companies, collections agencies,  
          and private investigators, has over 1 billion license plate  
          scans. The company sells vehicle sighting reports for between  
          $10 and $25.

          "SB 893 would place reasonable limits on the use of data  
          collected by ALPR technology."

           ARGUMENTS IN OPPOSITION  :    A group of opponents argue, among  
          other things, that, "ALPR data does NOT include any personally  
          identifying information about the registered owner of the  
          vehicle or anyone else.  ALPR data is used for a wide variety of  
          legitimate commercial and public purposes, including but not  
          limited to the following:  (1) by the National Center for  
          Missing and Exploited Children to assist in the recovery of  
          missing and exploited children; (2) by municipal government and  
          their commercial vendors to enforce parking limits and identify  
          repeat parking scofflaws; (3) by public and private parking  

                                                                CONTINUED





                                                                     SB 893
                                                                     Page  
          9

          facilities - including shopping malls, entertainment venues and  
          airport parking providers - to assist patrons with locating  
          their vehicles; (4) by the financial services industry to locate  
          and recover vehicles used to secure anon-performing loan; (5) by  
          the insurance industry - through a partnership with the National  
          Insurance Crime Bureau ("NICB") - to investigate underwriting  
          and claims fraud and to recover stolen vehicles; and (6) private  
          property owners, including homeowners associations, to control  
          access and ensure the safety and security of persons and  
          property."



          AL:n:k  5/29/14   Senate Floor Analyses 

                           SUPPORT/OPPOSITION:  SEE ABOVE

                                   ****  END  ****



























                                                                CONTINUED