BILL ANALYSIS Ó
SB 34
Page 1
Date of Hearing: August 19, 2015
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Jimmy Gomez, Chair
SB 34
(Hill) - As Amended July 13, 2015
-----------------------------------------------------------------
|Policy |Transportation |Vote:|13 - 1 |
|Committee: | | | |
| | | | |
| | | | |
|-------------+-------------------------------+-----+-------------|
| |Privacy and Consumer | |11 - 0 |
| |Protection | | |
| | | | |
| | | | |
|-------------+-------------------------------+-----+-------------|
| | | | |
| | | | |
| | | | |
-----------------------------------------------------------------
Urgency: No State Mandated Local Program: NoReimbursable: No
SUMMARY:
This bill imposes security, privacy and public hearing
requirements on the use of automated license plate recognition
(ALPR) systems by public or private entities, and provides for a
SB 34
Page 2
private right of action, and associated remedies, for violations
of the requirements. Specifically, this bill:
1)Requires that data collected through the use or operation of
an ALPR system be treated as personal information for purposes
of the state's existing data breach notification laws applying
to public agencies, persons, or businesses.
2)Requires an ALPR operator and an ALPR end-user to implement
and maintain usage and privacy policies, as specified, to be
available in writing to the public, and conspicuously posted
on an operator or end-user's website.
3)Requires ALPR operators to maintain a record of access to ALPR
information, including the date and time of access, the
license plate number which was queried, the username of the
person who accessed the information, and the purpose for
accessing the information.
4)Allows an individual harmed by a violation of these
requirements to bring a civil action against a person who
knowingly caused the violation, and authorizes the court to
award specified remedies.
5)Requires a public agency operating or intending to operate an
ALPR system to provide an opportunity for public comment at a
public meeting of the agency's governing body before
implementing the program.
6)Prohibits a public agency from selling, sharing or
transferring ALPR information, except to another public agency
and only as permitted by law, although data hosting services
are exempted.
FISCAL EFFECT:
SB 34
Page 3
1)The state's Data Breach Protection Law requires a public
agency or California business that owns or licenses
computerized data containing personal information to disclose
a breach of the system's security or data to any California
resident whose unencrypted personal information was acquired
by an unauthorized person. If the costs to provide
notifications exceed $250,000, or if the breach affected more
than 500,000 persons, the agency or business can use one of
several alternative methods of notification, including posting
a notice on the entity's website.
2)The CHP could incur unknown, but likely minor costs to provide
notifications in the event of a data breach. Because the
department's ALPR system contains several million plates at
any one time, it would likely use the less costly alternative
means of notification. Other provisions of the bill are
consistent with existing requirements placed on the CHP's use
of ALPR.
3)Potentially significant, but nonreimbursable costs to comply
with the bill's requirements for those local law enforcement
agencies that elect to operate ALPR systems. Similar to the
CHP, local agencies could also incur notification-related
costs in the event of a data breach of their ALPR systems.
COMMENTS:
1)Purpose. According to the author, "While at least seven other
states have already passed laws to regulate automatic license
plate reader (ALPR) systems, current California law has not
kept up with the rapid adoption of the technology. Except for
the California Highway Patrol (CHP) and transportation
agencies, current California law doesn't require any privacy
safeguards or establish any protocols for the use of ALPR
SB 34
Page 4
systems."
A 2014 report by the American Civil Liberties Union of
Northern California (ACLU) found that, of 60 cities and 58
counties surveyed, a total of 57 combined had ALPR systems -
but only 16 of those jurisdictions had a public policy
governing their use, and only eight had hearings with public
input before deploying the systems.
2)Background. An ALPR system is one or more mobile or fixed
cameras combined with computer algorithms that can read and
convert images of automobile registration plates and the
characters they contain into computer-readable data showing
the license plate itself, as well as the time, date and place
of the picture. ALPR systems can also provide a "contextual"
photo of the car itself, making information about car make and
model, distinguishing features, state of registration, and
driver and passage potentially available as well.
It is important to note that while ALPR does not identify a
specific person by itself and is not considered "personally
identifiable information", it can be linked to an identifiable
person through a registration database, like that operated by
the DMV.
ALPR systems operate by automatically scanning any license
plate within range. Some ALPR systems can scan up to 2,000
license plates per minute. In the private sector, ALPR
systems are used to monitor parking facilities and assist
repossession companies in identifying vehicles, and even gated
communities use ALPRs to monitor and regulate access.
SB 34
Page 5
When used by law enforcement, each scanned license plate is
checked against a variety of databases, such as the federal
AMBER Alert for missing children, or the National Crime
Information Center, which aggregates 21 different databases
tracking categories such as stolen property, sex offenders,
immigration violators, gang affiliates, and known violent
persons. If one of the license plates photographed by the
system gets a hit based on a match with one of the databases
or some other 'hot list', the ALPR system can alert the law
enforcement officer in real time so she or he can take action.
3)ALPR Restrictions on CHP. A 2011 transportation budget trailer
bill restricted the use of ALPR technology by the CHP by only
authorizing the department to retain data captured by ALPR
systems for 60 days, except where the data is being used for
felony investigations or as evidence. The CHP is also
prohibited from selling the data for any purpose or making the
data available to an agency or person other than law
enforcement agencies or officers. The data may only be used
by law enforcement agencies for purposes of locating vehicles
or persons reasonably suspected of being involved in the
commission of a public offense. The CHP is required to monitor
the internal use of ALPR data to prevent unauthorized use, and
to regularly report to the Legislature on its ALPR practices
and uses.
4)Prior Legislation. SB 893 (Hill), of 2014, which was similar
to this bill, failed passage on the Senate Floor.
Analysis Prepared by:Chuck Nicol / APPR. / (916)
319-2081
SB 34
Page 6