BILL ANALYSIS Ó
SB 34
Page 1
Date of Hearing: June 22, 2015
ASSEMBLY COMMITTEE ON TRANSPORTATION
Jim Frazier, Chair
SB
34 (Hill) - As Amended April 22, 2015
SENATE VOTE: 25-12
SUBJECT: Automated license plate recognition systems: use of
data.
SUMMARY: Establishes provisions on the usage of automatic
license plate recognition (ALPR) data and expands the meaning of
"personal information" to include information or data collected
through the use or operation of an ALPR system, as specified.
Specifically, this bill:
1)Specifies that a person's information collected through the
use or operation of an ALPR system by a person or business is
considered personal information for purposes of personal data
collection or customer records, as specified.
2)Defines an ALPR system as a system of one or more mobile or
fixed cameras combined with computer algorithms to read and
convert images of registration plates and the characters they
SB 34
Page 2
contain into computer-readable data.
3)Defines ALPR information to mean information or data collected
through the use of an ALPR system.
4)Defines an ALPR end-user as a person that accesses or uses
ALPR information and an ALPR operator as a person that
operates an ALPR system, or that stores or maintains ALPR
information. Specifies, a "person" may include a law
enforcement agency, government agency, private entity, or
individual.
5)Specifies that an ALPR end-user or operator does not include a
transportation agency, as defined.
6)Requires that ALPR operators ensure that ALPR information is
protected with reasonable operational, administrative,
technical, and physical safeguards to ensure its
confidentiality and integrity.
7)Requires that ALPR operators implement and maintain reasonable
security procedures and practices in order to protect ALPR
information from unauthorized access, destruction, use,
modification, or disclosure.
8)Requires that ALPR operators and end users implement and
maintain a usage and privacy policy in order to ensure that
the collection, use, maintenance, sharing, and dissemination
of ALPR information is consistent with respect for an
individuals' privacy and civil liberties.
SB 34
Page 3
9)Requires the ALPR operator and end-user's usage and privacy
policy contain a minimum set of information, as specified.
10)Requires ALPR operators that access or provide access to ALPR
information to maintain a record of that access. The record
must include the date and time of access, the license plate
number which was queried, the name of the person who accessed
the information and if possible, the organization or entity
with whom the person is affiliated, and the purpose for
accessing the information.
11)Allows an individual who has been harmed by a violation of
this title to bring a civil action against a person who
knowingly caused the violation. The court can award damages
which are stipulated in this bill.
12)Requires a public agency that considers using an ALPR system
to provide an opportunity for public comment at a regularly
scheduled public meeting of the governing body of the agency
before it implements the program of ALPR use.
EXISTING LAW:
1)Requires any agency, person, or business that is conducting
business within the state that owns or licenses compuerized
data that includes personal information, to disclose any
breach of security of the system or data following the
discovery of the security breach to any person within the
state whose personal information was or suspected to be
acquired by an unauthorized person, as specified.
SB 34
Page 4
2)Defines "personal information" for the abovementioned purposes
to include an individual's first and last name, or first
initial and last name, in combination with one or more
designated data elements relating to social security numbers,
driver's license numbers, financial accounts, and medical
information.
3)Prohibits a transporation agency from selling or otherwise
providing to any other person or entity personally
identifiable information of any person who subscribes to an
electronic toll or transit fare collection system or uses a
tolling faciltiy that employs an electronic toll collection
system, as specfied.
4)Requires a transportation agency that employs an electronic
toll collection or an electronic transit fare collection
system to establish a privacy policy regarding the collection
and use of personally identifiable information and provide
subscribers of that system a copy of the privacy policy, as
specified.
FISCAL EFFECT: Unknown
COMMENTS: ALPR is a common public safety enforcement method
that utilizes optical character recognition to read vehicle
license plates. ALPR systems typically use infrared lighting
and a variety of algorithms to take a picture of a license
plate, identify any text, and determine the proper letter/number
sequence on the plate. This technology also allows an ALPR
camera to capture license plate images at any time of the day or
night. Once a license plate is scanned, in most cases, the
license plate sequence is then checked against a variety of
databases to determine if the vehicle is stolen, has outstanding
SB 34
Page 5
tickets, or whether the registered owner possesses outstanding
arrest warrants. If a "hit" occurs, the ALPR system alerts the
appropriate law enforcement entity. While many law enforcement
and local government entities utilize ALPR technology, ALPR
hardware and systems are generally developed and managed by
non-governmental entities.
Aside for the California Highway Patrol and local transportation
agencies, existing law is silent on how government agencies and
businesses manage and protect the data gathered by ALPR systems.
The author introduced this bill to institute a number usage and
privacy standards for the operation of ALPR systems within the
state. Additionally, the author notes that this bill also
provides an opportunity for public input on the usage and
standards of ALPR system that are used by government entities,
something the author contends most government entities do not
practice.
With the use of ALPR technology by government agencies and
private industry becoming commonplace, states are now discussing
how to best use and manage the data collected through these
systems. According to the National Conference of State
Legislators (NCSL), 18 states have introduced legislation
attempting to establish or revise standards and privacy
requirements related to ALPR systems. Additionally, 9 states
have enacted laws in some form that address the use and
management of data collected through ALPR systems.
Furthermore, while the discussion of ALPR standards is ongoing
at the state level, privacy concerns surrounding to the
collection of personal information remains a key policy issue
that has been raised by a number of stakeholders. According to
a 2013 study conducted by the American Civil Liberties Union
(ACLU), the ACLU found that an estimated one percent of ALPR
scans resulted in a "hit" while the other 99% of data had no
relation to criminal activity. Thus, when an ALPR system is
SB 34
Page 6
used by law enforcement, whether or not a "hit" occurs, all
license plate scans are transmitted and checked by databases
that aggregate and store license plate data. This data that is
collected, for example, may be used to by law enforcement to
investigate and enforce the law; however, minimal, if any,
requirements exist on how this data is managed, stored,
retained, accessed, or shared.
SB 34 aims to establish a minimal set of privacy standards for
personal data collected by a person or entity using ALPR
technology. SB 34 further exempts transportation agencies
involved in automatic toll and transit fare collection from the
provisions specified in this bill as existing law sets privacy
standards for personal data collected using ALPR technology for
these purposes. The author asserts SB 34 will put in place
regulations for businesses and agencies which currently do not
have any policies regarding the use of ALPR data and exempt
transportation agencies which are already regulated by existing
law.
Previous legislation: SB 893 (Hill) of 2014, would have placed
restrictions on the use of ALPR technology by both public and
private sector users. SB 893 died on the Senate Inactive File.
AB 179 (Bocanegra, Chapter 375, Statutes of 2013) prohibits
transportation agencies and other entities that employ an
electronic transit fare collection system (ETFC) for the payment
of transit fares from selling or providing to third parties any
personally identifiable information obtained through a person's
participation in an ETFC, with certain exceptions.
SB 1330 (Simitian) of 2011, would have placed restrictions on
the use of automated license plate recognition technology by
private entities, including restrictions on the retention, use,
and sale of such data. SB 1330 would have also restricted the
SB 34
Page 7
ability for a person to transfer ALPR data to a law enforcement
agency absent a search warrant or other specified circumstances.
SB 1330 died on the Senate Floor.
SB 1268 (Simitian, Chapter 489, Statutes of 2010) prohibits
transportation agencies from selling, or providing to any other
person, the personally identifiable information of either
subscribers of an electronic toll collection system or anyone
who uses a toll bridge, lane, or highway that utilizes an
electronic toll collection system.
Double referral: This bill will be referred to the Assembly
Privacy and Consumer Protection Committee should it pass out of
this committee.
REGISTERED SUPPORT / OPPOSITION:
Support
Bay Area Civil Liberties Coalition
California Civil Liberties Council
Media Alliance
Small Business California
SB 34
Page 8
Opposition
None on file
Analysis Prepared by:Manny Leon / TRANS. / (916)
319-2093