BILL ANALYSIS                                                                                                                                                                                                    Ó




           ----------------------------------------------------------------- 
          |SENATE RULES COMMITTEE            |                         SB 34|
          |Office of Senate Floor Analyses   |                              |
          |(916) 651-1520    Fax: (916)      |                              |
          |327-4478                          |                              |
           ----------------------------------------------------------------- 


                                UNFINISHED BUSINESS 


          Bill No:  SB 34
          Author:   Hill (D), et al.
          Amended:  9/1/15  
          Vote:     21  

           SENATE TRANS. & HOUSING COMMITTEE:  8-2, 4/7/15
           AYES:  Beall, Allen, Galgiani, Leyva, McGuire, Mendoza, Roth,  
            Wieckowski
           NOES:  Bates, Gaines
           NO VOTE RECORDED:  Cannella

           SENATE JUDICIARY COMMITTEE:  4-2, 4/14/15
           AYES:  Jackson, Leno, Monning, Wieckowski
           NOES:  Vidak, Anderson
           NO VOTE RECORDED:  Hertzberg

           SENATE APPROPRIATIONS COMMITTEE:  5-2, 5/4/15
           AYES:  Lara, Beall, Hill, Leyva, Mendoza
           NOES:  Bates, Nielsen

           SENATE FLOOR:  25-12, 5/7/15
           AYES:  Allen, Beall, Block, Cannella, De León, Galgiani, Hall,  
            Hancock, Hernandez, Hertzberg, Hill, Hueso, Jackson, Lara,  
            Leno, Leyva, McGuire, Mendoza, Mitchell, Monning, Pan, Pavley,  
            Roth, Wieckowski, Wolk
           NOES:  Anderson, Bates, Berryhill, Gaines, Huff, Moorlach,  
            Morrell, Nguyen, Nielsen, Runner, Stone, Vidak
           NO VOTE RECORDED:  Fuller, Liu

           ASSEMBLY FLOOR:  71-5, 9/3/15 - See last page for vote

           SUBJECT:   Automated license plate recognition systems:  use of  
                     data










                                                                      SB 34  
                                                                    Page  2



          SOURCE:    Author


          DIGEST:  This bill establishes regulations on the privacy and  
          usage of automatic license plate recognition (ALPR) data and  
          expands the meaning of "personal information" to include  
          information or data collected through the use or operation of an  
          ALPR system.




          Assembly Amendments impose privacy protection requirements on  
          entities that use ALPR information, as defined; prohibit public  
          agencies from selling or sharing ALPR information, except to  
          another public agency, as specified; and require operators of  
          ALPR systems to use that information only for authorized  
          purposes.


          ANALYSIS: 

          Existing law:
          
          1)  Places regulations on agencies, persons, or businesses that  
            own, license, or maintain computerized data that includes  
            personal information.  These regulations include disclosing a  
            breach of security. 
           
          2)  Prohibits a transportation agency from selling or providing  
            personally identifiable information of any person who  
            subscribes to an electronic toll or electronic transit fare  
            collection system or who uses a toll bridge, toll lane, or  
            toll highway that employs an electronic toll collection  
            system.  Agencies covered by this regulation are the  
            Department of Transportation, the Bay Area Toll Authority, any  
            entity operating a toll bridge, toll lane, or toll highway  
            within the state, any entity administering an electronic  
            transit fare collection system and any transit operator  
            participating in that system, or any entity under contract  
            with the above-mentioned entities.  









                                                                      SB 34  
                                                                    Page  3



          3)  Requires that transportation agencies employing an  
            electronic toll or transit fare collection system establish a  
            privacy policy for the collection and use of personally  
            identifiable information and provide users with a copy of the  
            privacy policy.  Transportation agencies include the  
            Department of Transportation, the Bay Area Toll Authority, any  
            entity operating a toll bridge, toll lane, or toll highway  
            within the state, any entity administering an electronic  
            transit fare collection system, and any transit operator  
            participating in that system, or any entity under contract  
            with the above-mentioned entities. 

          4)  Establishes limits on the length of time that transportation  
            agencies may keep personal information.  All information may  
            be kept only as long as necessary to perform account  
            functions.  All other information must be discarded within 4  
            years after the conclusion of the billing cycle. 
          This bill:

          1)  Defines an ALPR system as a system of one or more mobile or  
            fixed cameras combined with computer algorithms to read and  
            convert images of registration plates and the characters they  
            contain into computer-readable data.

          2)  Requires that data collected through the use or operation of  
            an ALPR system be considered as personal information subject  
            to existing law pertaining to agencies, persons, or businesses  
            that conduct business in California, and that own or license  
            computerized data including personal information. 

          3)  Defines an ALPR end-user as a person that accesses or uses  
            ALPR information and an ALPR operator as a person that  
            operates an ALPR system, or that maintains ALPR information,  
            with the exception of transportation agencies; persons already  
            subject to state and federal code regarding protection of  
            nonpublic personal information; and a person, other than a law  
            enforcement agency, to whom information may be disclosed as a  
            permissible use under federal code regarding prohibition on  
            release and use of certain personal information from state  
            motor vehicle records.  A person may include any natural  
            person, public agency, partnership, firm, association,  
            corporation, limited liability company, or other legal entity.








                                                                      SB 34  
                                                                    Page  4




          4)  Requires that ALPR operators ensure that ALPR information is  
            protected with reasonable operational, administrative,  
            technical, and physical safeguards to ensure its  
            confidentiality and integrity.

          5)  Requires that ALPR operators and end users implement and  
            maintain reasonable security procedures and practices in order  
            to protect ALPR information from unauthorized access,  
            destruction, use, modification, or disclosure.

          6)  Requires that ALPR operators and end users implement and  
            maintain a usage and privacy policy in order to ensure that  
            the collection, access, and use of ALPR information is  
            consistent with respect for individuals' privacy and civil  
            liberties.  

          7)  Requires ALPR operators that access or provide access to  
            ALPR information to maintain a record of that access.  The  
            record must include the date and time of access, the license  
            plate number which was queried, the person who accesses the  
            information, and the purpose of accessing the information.
          8)  Allows an individual who has been harmed by a violation of  
            this title to bring a civil action against a person who  
            knowingly caused the violation.  The court can award damages  
            which are stipulated in this bill.

          9)  Requires a public agency that operates or intends to operate  
            an ALPR system to provide an opportunity for public comment at  
            a regularly scheduled public meeting of the governing body of  
            the agency before it implements the program of ALPR use.

          Comments

          Purpose.  The author states that this bill is necessary to  
          institute reasonable usage and privacy standards for the  
          operation of ALPR systems, which do not exist for the majority  
          of local agencies that have approved the use of ALPR technology,  
          according to the American Civil Liberties Union (ACLU).   
          Additionally, this bill requires an opportunity for public input  
          on the usage and standards of ALPR technologies, something the  
          author contends few local agencies allow.  The author states  








                                                                      SB 34  
                                                                    Page  5



          that the main focus of this bill is to put in place regulations  
          for businesses and agencies which currently do not have any  
          policies regarding the use of ALPR data, unlike transportation  
          agencies which are already regulated by existing law.

          ALPR background and history.  ALPR systems automatically scan  
          any license plate within range.  Some ALPR systems can scan  
          2,000 plates in a minute.  When used by law enforcement, each  
          scanned license plate is checked against crime databases.  If a  
          "hit" occurs - for example, a stolen vehicle, AMBER alert, or an  
          arrest warrant - the ALPR technology alerts the law enforcement  
          officer.  While some suggest this technology is useful for  
          modern policing, others raise concerns over an invasion of  
          peoples' civil liberties.  Whether or not a hit occurs, all  
          license plate scans are sent to large regional databases that  
          aggregate ALPR data from various law enforcement agencies.  The  
          ACLU reports that an estimated 1% of ALPR data results in a hit  
          and the other 99% of data has no relation to criminal activity.   
          Databases maintained for northern California law enforcement  
          agencies, San Diego law enforcement agencies, and private  
          companies (such as insurance companies, collections agencies,  
          and private investigators) contain 100 million, 49 million, and  
          more than 1 billion license plate scans, respectively.  Some  
          argue that this information has the potential to be involved in  
          large-scale security breach issues.

          The use of ALPR technology is growing.  The ACLU estimates that  
          nationally, 75% of law enforcement currently uses ALPRs, 85%  
          plan to expand their use, and within the next five years at  
          least 25% of all police vehicles will be equipped with the  
          technology.

          Privacy concerns.  The collection of a license plate number,  
          location, and time stamp over multiple time points can identify  
          not only a person's exact whereabouts but also their pattern of  
          movement.  Unlike other types of personal information that are  
          covered by existing law, civilians are not always aware when  
          their ALPR data is being collected.  One does not even need to  
          be driving to be subject to ALPR technology:  A car parked on  
          the side of the road can be scanned by an ALPR system.   

          This bill will put in place minimal privacy protections by  








                                                                      SB 34  
                                                                    Page  6



          requiring the establishment of privacy and usage protection  
          policies for ALPR operators and end users.  This bill does not  
          prevent the authorized sharing of data, but if data is shared,  
          it must be justified and recorded.
          
          FISCAL EFFECT:   Appropriation:    No          Fiscal  
          Com.:YesLocal:   No

          According to the Assembly Appropriations Committee:


          1)The state's Data Breach Protection Law requires a public  
            agency or California business that owns or licenses  
            computerized data containing personal information to disclose  
            a breach of the system's security or data to any California  
            resident whose unencrypted personal information was acquired  
            by an unauthorized person.  If the costs to provide  
            notifications exceed $250,000, or if the breach affected more  
            than 500,000 persons, the agency or business can use one of  
            several alternative methods of notification, including posting  
            a notice on the entity's website.


          2)The California Highway Patrol (CHP) could incur unknown but  
            likely minor costs to provide notifications in the event of a  
            data breach.  Because the department's ALPR system contains  
            several million plates at any one time, it would likely use  
            the less costly alternative means of notification.  Other  
            provisions of this bill are consistent with existing  
            requirements placed on the CHP's use of ALPR.


          3)Potentially significant, but non-reimbursable costs to comply  
            with this bill's requirements for those local law enforcement  
            agencies that elect to operate ALPR systems.  Similar to the  
            CHP, local agencies could also incur notification-related  
            costs in the event of a data breach of their ALPR systems.




          SUPPORT:   (Verified9/3/15)








                                                                      SB 34  
                                                                    Page  7





          Bay Area Civil Liberties Coalition
          California Civil Liberties Council
          Conference of California Bar Associations
          Media Alliance
          Small Business California


          OPPOSITION:   (Verified9/3/15)


          None received

          ASSEMBLY FLOOR:  71-5, 9/3/15
          AYES:  Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom,  
            Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang,  
            Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle,  
            Daly, Dodd, Eggman, Frazier, Cristina Garcia, Eduardo Garcia,  
            Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Hadley, Harper,  
            Roger Hernández, Holden, Irwin, Jones-Sawyer, Kim, Lackey,  
            Levine, Linder, Lopez, Low, Maienschein, Mayes, McCarty,  
            Medina, Mullin, Nazarian, O'Donnell, Olsen, Perea, Quirk,  
            Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth,  
            Mark Stone, Thurmond, Ting, Waldron, Weber, Wilk, Williams,  
            Wood, Atkins
          NOES:  Grove, Jones, Mathis, Obernolte, Wagner
          NO VOTE RECORDED:  Beth Gaines, Gallagher, Melendez, Patterson


          Prepared by:Randy Chinn / T. & H. / (916) 651-4121
          9/3/15 18:02:01


                                   ****  END  ****


          












                                                                      SB 34  
                                                                    Page  8