BILL ANALYSIS Ó
-----------------------------------------------------------------
|SENATE RULES COMMITTEE | SB 34|
|Office of Senate Floor Analyses | |
|(916) 651-1520 Fax: (916) | |
|327-4478 | |
-----------------------------------------------------------------
UNFINISHED BUSINESS
Bill No: SB 34
Author: Hill (D), et al.
Amended: 9/1/15
Vote: 21
SENATE TRANS. & HOUSING COMMITTEE: 8-2, 4/7/15
AYES: Beall, Allen, Galgiani, Leyva, McGuire, Mendoza, Roth,
Wieckowski
NOES: Bates, Gaines
NO VOTE RECORDED: Cannella
SENATE JUDICIARY COMMITTEE: 4-2, 4/14/15
AYES: Jackson, Leno, Monning, Wieckowski
NOES: Vidak, Anderson
NO VOTE RECORDED: Hertzberg
SENATE APPROPRIATIONS COMMITTEE: 5-2, 5/4/15
AYES: Lara, Beall, Hill, Leyva, Mendoza
NOES: Bates, Nielsen
SENATE FLOOR: 25-12, 5/7/15
AYES: Allen, Beall, Block, Cannella, De León, Galgiani, Hall,
Hancock, Hernandez, Hertzberg, Hill, Hueso, Jackson, Lara,
Leno, Leyva, McGuire, Mendoza, Mitchell, Monning, Pan, Pavley,
Roth, Wieckowski, Wolk
NOES: Anderson, Bates, Berryhill, Gaines, Huff, Moorlach,
Morrell, Nguyen, Nielsen, Runner, Stone, Vidak
NO VOTE RECORDED: Fuller, Liu
ASSEMBLY FLOOR: 71-5, 9/3/15 - See last page for vote
SUBJECT: Automated license plate recognition systems: use of
data
SB 34
Page 2
SOURCE: Author
DIGEST: This bill establishes regulations on the privacy and
usage of automatic license plate recognition (ALPR) data and
expands the meaning of "personal information" to include
information or data collected through the use or operation of an
ALPR system.
Assembly Amendments impose privacy protection requirements on
entities that use ALPR information, as defined; prohibit public
agencies from selling or sharing ALPR information, except to
another public agency, as specified; and require operators of
ALPR systems to use that information only for authorized
purposes.
ANALYSIS:
Existing law:
1) Places regulations on agencies, persons, or businesses that
own, license, or maintain computerized data that includes
personal information. These regulations include disclosing a
breach of security.
2) Prohibits a transportation agency from selling or providing
personally identifiable information of any person who
subscribes to an electronic toll or electronic transit fare
collection system or who uses a toll bridge, toll lane, or
toll highway that employs an electronic toll collection
system. Agencies covered by this regulation are the
Department of Transportation, the Bay Area Toll Authority, any
entity operating a toll bridge, toll lane, or toll highway
within the state, any entity administering an electronic
transit fare collection system and any transit operator
participating in that system, or any entity under contract
with the above-mentioned entities.
SB 34
Page 3
3) Requires that transportation agencies employing an
electronic toll or transit fare collection system establish a
privacy policy for the collection and use of personally
identifiable information and provide users with a copy of the
privacy policy. Transportation agencies include the
Department of Transportation, the Bay Area Toll Authority, any
entity operating a toll bridge, toll lane, or toll highway
within the state, any entity administering an electronic
transit fare collection system, and any transit operator
participating in that system, or any entity under contract
with the above-mentioned entities.
4) Establishes limits on the length of time that transportation
agencies may keep personal information. All information may
be kept only as long as necessary to perform account
functions. All other information must be discarded within 4
years after the conclusion of the billing cycle.
This bill:
1) Defines an ALPR system as a system of one or more mobile or
fixed cameras combined with computer algorithms to read and
convert images of registration plates and the characters they
contain into computer-readable data.
2) Requires that data collected through the use or operation of
an ALPR system be considered as personal information subject
to existing law pertaining to agencies, persons, or businesses
that conduct business in California, and that own or license
computerized data including personal information.
3) Defines an ALPR end-user as a person that accesses or uses
ALPR information and an ALPR operator as a person that
operates an ALPR system, or that maintains ALPR information,
with the exception of transportation agencies; persons already
subject to state and federal code regarding protection of
nonpublic personal information; and a person, other than a law
enforcement agency, to whom information may be disclosed as a
permissible use under federal code regarding prohibition on
release and use of certain personal information from state
motor vehicle records. A person may include any natural
person, public agency, partnership, firm, association,
corporation, limited liability company, or other legal entity.
SB 34
Page 4
4) Requires that ALPR operators ensure that ALPR information is
protected with reasonable operational, administrative,
technical, and physical safeguards to ensure its
confidentiality and integrity.
5) Requires that ALPR operators and end users implement and
maintain reasonable security procedures and practices in order
to protect ALPR information from unauthorized access,
destruction, use, modification, or disclosure.
6) Requires that ALPR operators and end users implement and
maintain a usage and privacy policy in order to ensure that
the collection, access, and use of ALPR information is
consistent with respect for individuals' privacy and civil
liberties.
7) Requires ALPR operators that access or provide access to
ALPR information to maintain a record of that access. The
record must include the date and time of access, the license
plate number which was queried, the person who accesses the
information, and the purpose of accessing the information.
8) Allows an individual who has been harmed by a violation of
this title to bring a civil action against a person who
knowingly caused the violation. The court can award damages
which are stipulated in this bill.
9) Requires a public agency that operates or intends to operate
an ALPR system to provide an opportunity for public comment at
a regularly scheduled public meeting of the governing body of
the agency before it implements the program of ALPR use.
Comments
Purpose. The author states that this bill is necessary to
institute reasonable usage and privacy standards for the
operation of ALPR systems, which do not exist for the majority
of local agencies that have approved the use of ALPR technology,
according to the American Civil Liberties Union (ACLU).
Additionally, this bill requires an opportunity for public input
on the usage and standards of ALPR technologies, something the
author contends few local agencies allow. The author states
SB 34
Page 5
that the main focus of this bill is to put in place regulations
for businesses and agencies which currently do not have any
policies regarding the use of ALPR data, unlike transportation
agencies which are already regulated by existing law.
ALPR background and history. ALPR systems automatically scan
any license plate within range. Some ALPR systems can scan
2,000 plates in a minute. When used by law enforcement, each
scanned license plate is checked against crime databases. If a
"hit" occurs - for example, a stolen vehicle, AMBER alert, or an
arrest warrant - the ALPR technology alerts the law enforcement
officer. While some suggest this technology is useful for
modern policing, others raise concerns over an invasion of
peoples' civil liberties. Whether or not a hit occurs, all
license plate scans are sent to large regional databases that
aggregate ALPR data from various law enforcement agencies. The
ACLU reports that an estimated 1% of ALPR data results in a hit
and the other 99% of data has no relation to criminal activity.
Databases maintained for northern California law enforcement
agencies, San Diego law enforcement agencies, and private
companies (such as insurance companies, collections agencies,
and private investigators) contain 100 million, 49 million, and
more than 1 billion license plate scans, respectively. Some
argue that this information has the potential to be involved in
large-scale security breach issues.
The use of ALPR technology is growing. The ACLU estimates that
nationally, 75% of law enforcement currently uses ALPRs, 85%
plan to expand their use, and within the next five years at
least 25% of all police vehicles will be equipped with the
technology.
Privacy concerns. The collection of a license plate number,
location, and time stamp over multiple time points can identify
not only a person's exact whereabouts but also their pattern of
movement. Unlike other types of personal information that are
covered by existing law, civilians are not always aware when
their ALPR data is being collected. One does not even need to
be driving to be subject to ALPR technology: A car parked on
the side of the road can be scanned by an ALPR system.
This bill will put in place minimal privacy protections by
SB 34
Page 6
requiring the establishment of privacy and usage protection
policies for ALPR operators and end users. This bill does not
prevent the authorized sharing of data, but if data is shared,
it must be justified and recorded.
FISCAL EFFECT: Appropriation: No Fiscal
Com.:YesLocal: No
According to the Assembly Appropriations Committee:
1)The state's Data Breach Protection Law requires a public
agency or California business that owns or licenses
computerized data containing personal information to disclose
a breach of the system's security or data to any California
resident whose unencrypted personal information was acquired
by an unauthorized person. If the costs to provide
notifications exceed $250,000, or if the breach affected more
than 500,000 persons, the agency or business can use one of
several alternative methods of notification, including posting
a notice on the entity's website.
2)The California Highway Patrol (CHP) could incur unknown but
likely minor costs to provide notifications in the event of a
data breach. Because the department's ALPR system contains
several million plates at any one time, it would likely use
the less costly alternative means of notification. Other
provisions of this bill are consistent with existing
requirements placed on the CHP's use of ALPR.
3)Potentially significant, but non-reimbursable costs to comply
with this bill's requirements for those local law enforcement
agencies that elect to operate ALPR systems. Similar to the
CHP, local agencies could also incur notification-related
costs in the event of a data breach of their ALPR systems.
SUPPORT: (Verified9/3/15)
SB 34
Page 7
Bay Area Civil Liberties Coalition
California Civil Liberties Council
Conference of California Bar Associations
Media Alliance
Small Business California
OPPOSITION: (Verified9/3/15)
None received
ASSEMBLY FLOOR: 71-5, 9/3/15
AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom,
Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang,
Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle,
Daly, Dodd, Eggman, Frazier, Cristina Garcia, Eduardo Garcia,
Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Hadley, Harper,
Roger Hernández, Holden, Irwin, Jones-Sawyer, Kim, Lackey,
Levine, Linder, Lopez, Low, Maienschein, Mayes, McCarty,
Medina, Mullin, Nazarian, O'Donnell, Olsen, Perea, Quirk,
Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth,
Mark Stone, Thurmond, Ting, Waldron, Weber, Wilk, Williams,
Wood, Atkins
NOES: Grove, Jones, Mathis, Obernolte, Wagner
NO VOTE RECORDED: Beth Gaines, Gallagher, Melendez, Patterson
Prepared by:Randy Chinn / T. & H. / (916) 651-4121
9/3/15 18:02:01
**** END ****
SB 34
Page 8