BILL ANALYSIS �
SENATE JUDICIARY COMMITTEE
Senator Noreen Evans, Chair
2011-2012 Regular Session
SB 1330 (Simitian)
As Amended March 29, 2012
Hearing Date: April 17, 2012
Fiscal: Yes
Urgency: No
SK:rm
SUBJECT
License Plate Recognition Technology: Personal Information
DESCRIPTION
This bill would place restrictions on the use of license plate
recognition (LPR) technology by state and local law enforcement
agencies and private entities, including restrictions on the
retention, use, and sale of such data.
BACKGROUND
License plate technology uses cameras and computer technology to
record license plate information of vehicles. The cameras are
either mobile (e.g., attached to the outside of a vehicle) or
stationary, and the images they collect of license plate numbers
are converted into computer-readable data which is then
instantly checked against various databases such as the National
Crime Information Center (NCIC). LPR technology captures other
data as well, including the geographic location of the vehicle
and the time and date that it is scanned. This information can
then be retained in a database. The technology works at
lightning speed; one company, VeriPlate, indicates that its
cameras can capture one license plate every second.
Law enforcement uses LPR technology to identify and locate
stolen vehicles or compare the information obtained against
databases of outstanding warrants. Auto repossession companies
take advantage of LPR technology to help find debtors who are
behind on their car payments. In January 2012, a California
Watch article entitled "Private company hoarding license-plate
data on US drivers" noted:
(more)
SB 1330 (Simitian)
Page 2 of ?
Capitalizing on one of the fastest-growing trends in law
enforcement, a private California-based company has compiled
a database bulging with more than 550 million license-plate
records on both innocent and criminal drivers that can be
searched by police. . . . �P]olice around the country have
been affixing high-tech scanners to the exterior of their
patrol cars, snapping a picture of every passing license
plate and automatically comparing them to databases of
outstanding warrants, stolen cars, and wanted bank robbers.
The units work by sounding an in-car alert if the scanner
comes across a license plate of interest to police, whereas
before, patrol officers generally needed some reason to take
an interest in the vehicle, like a traffic violation.
But when a license plate is scanned, the driver's geographic
location is also recorded and saved, along with the date and
time, each of which amounts to a record or data point. Such
data collection occurs regardless of whether the driver is a
wanted criminal, and the vast majority are not.
While privacy rules restrict what police can do with their
own databases, Vigilant Video, headquartered in Livermore,
Calif., offers a loophole. It's a private business not
required to operate by those same rules. . . . Vigilant
distinguished itself from competitors by going one step
further and collecting hundreds of millions of scans to
create what's known as the National Vehicle Location
Service. A West Coast sales manager for the company, Randy
Robinson, said the scanners - as well as data from them
compiled in the location system - do far more than simply
help identify stolen vehicles. Stories abound of the
technology also being used by police to stop wanted killers,
bank robbers, and drug suspects. Kidnappers could be
intercepted, too.
Existing law restricts the use of LPR technology by the
California Highway Patrol (CHP). In 2011, the Legislature
passed and the Governor signed AB 115 (Committee on Budget, Ch.
38, Stats. 2011), the transportation budget trailer bill, which
allows the CHP to retain data captured by LPR technology for no
more than 60 days except as specified. AB 115 also prohibited
the CHP from selling the data or making it available to anyone
other than law enforcement.
This bill would apply similar requirements to state and local
SB 1330 (Simitian)
Page 3 of ?
law enforcement agencies, and also would impose restrictions on
private entities, including restrictions on retention, use, and
sale of LPR data.
CHANGES TO EXISTING LAW
Existing law , the California Constitution, provides that all
people have inalienable rights, including the right to pursue
and obtain privacy. (Cal. Const. Art. I, Sec. 1.)
Existing law permits the CHP to retain license plate data
captured by a license plate reader for no more than 60 days,
except in circumstances when the data is being used as evidence
or for all felonies being investigated, including, but not
limited to, auto theft, homicides, kidnaping, burglaries, elder
and juvenile abductions, Amber Alerts, and Blue Alerts. (Veh.
Code Sec. 2413(b).)
Existing law prohibits the CHP from selling LPR data for any
purpose and making it available to an agency that is not a law
enforcement agency or an individual who is not a law enforcement
officer. The data may be used by a law enforcement agency only
for purposes of locating vehicles or persons when either are
reasonably suspected of being involved in the commission of a
public offense. (Veh. Code Sec. 2413(c).)
Existing law requires the CHP to monitor internal use of the LPR
data to prevent unauthorized use. (Veh. Code Sec. 2413(d).)
Existing law requires the CHP to report to the Legislature its
LPR practices and usage, including the number of LPR data
disclosures, a record of the agencies to which data was
disclosed and for what purpose, and any changes in policy that
affect privacy concerns. (Veh. Code Sec. 2413(e).)
This bill would apply all of the above to state and local law
enforcement agencies, other than the CHP, except that the bill
would require the report on the agency's use of LPR to be
submitted to the state or local agency that governs the law
enforcement agency.
This bill would require state and local law enforcement agencies
to adopt a privacy policy to ensure that personally identifiable
information is not unlawfully disclosed and post that policy on
the agency's Internet Web site.
SB 1330 (Simitian)
Page 4 of ?
This bill would impose the following restrictions on any person
who uses LPR technology other than a state or local law
enforcement agency:
The person shall not retain license plate data captured by LPR
technology for more than 60 days;
The person shall not sell LPR data for any purpose and shall
not make the data available to an agency or person that is not
a law enforcement agency or officer;
The person shall make data available to a law enforcement
agency only pursuant to a search warrant. Unless the search
warrant contains a provision to the contrary, the law
enforcement agency shall immediately, but within no more than
five days, notify the person whose information was disclosed
that his or her records have been obtained. The bill requires
the agency to give a copy of the search warrant to the person
and include the identity of the agency or officer who received
the records; and
The person must allow a peace officer who is conducting a
criminal or traffic collision investigation to obtain
personally identifiable information of a person if the officer
has good cause to believe that a delay in obtaining the
information by seeking a search warrant would cause an adverse
result, as specified.
This bill would require a person using LPR technology to monitor
the internal use of LPR data to prevent its unauthorized use.
This bill would require a person using LPR technology to adopt a
privacy policy to ensure that personally identifiable
information is not unlawfully disclosed.
This bill would require a person using LPR technology to report
annually to the Department of Justice on its LPR practices and
usage, including the number of LPR data disclosures, a record of
the law enforcement agencies or peace officers to which data was
disclosed and for what purpose, and any changes in policy that
affect privacy concerns.
This bill would provide that any person whose information is
sold or disclosed in violation of the bill's provisions relating
to the use of LPR technology by persons other than a state or
local law enforcement agency may bring a civil action and shall
be entitled to recover any and all consequential and incidental
damages, including all costs and attorney's fees.
COMMENT
SB 1330 (Simitian)
Page 5 of ?
1.Stated need for the bill
In support of the bill, the author writes:
There is no regulation on the use of license-plate recognition
technology and data by local law enforcement, or private
entities. While the California Highway Patrol is subject to
regulation, local law enforcement and private entities have
unfettered access to this technology. The lack of regulation
creates significant risks. The International Association of
Chiefs of Police conducted the most thorough examination of law
enforcement's use of LPR technology in 2009, and identified
privacy risks including improper disclosure of data, chilling
effects on social and political activity, restriction of
recognized access to anonymous exercise of First Amendment
rights, and several dignitary harms.
Similarly, a 2010 study from the Center for Evidence-Based
Crime Policy at George Mason University argued that law
enforcement's use of LPR lacks scrutiny. The study found,
"Speculation exists over the legal and legitimacy implications
of LPR use. Yet, despite the pressing need for answers to these
questions, few agencies or researchers have examined these
concerns." The report added, "Our national survey of police
agencies indicates that only 28.5% of agencies researched the
legal implications of the technology before adopting LPR."
For the private sector, the problems are even more acute. LPR
cameras enable private entities to commodify data on the
movements and habits of law-abiding citizens. Such entities use
"scout cars" that cruise city streets, parking lots, and
highways to track all of the surrounding vehicles. A "scout
car" of this sort can record data on more than 10,000 license
plates in just 8 hours. As a result, multiple private
entities possess well over half a billion LPR records. One
company claims to scan 40 percent of the vehicles in the
country on an annual basis (Vigilant Video); another says that
it captures data on 50 million vehicles each month (MVTrac).
This data is typically sold to financial institutions,
repossession companies, and private investigators.
This bill is supported by the Consumer Federation of California
which writes that the measure will "safeguard Californians'
constitutional right to individual privacy by reining in the
use, and increasing abuse, of license-plate recognition (LPR)
SB 1330 (Simitian)
Page 6 of ?
software on both innocent and criminal drivers. . . . Innocent
Californians should not be having their vehicles monitored,
potentially tracked, and that data stored and then sold for
profit to third parties like asset recovery companies and
financial institutions (among others) - all without their
knowledge or consent."
The California Partnership to End Domestic Violence writes:
LPR technology could be used by an abusive partner to track
the victim's whereabouts. Research indicates that at least
one in four victims of stalking report that the offender used
some form of technology. However, this is likely an
underestimate of the actual rates since offenders can use many
forms of technologies against a victim without the victim's
knowledge, such as LPR technology.
Gun Owners of California also supports the bill writing that
"LPR records can be sold to any person or organization for any
purpose. This poses public safety risks and threatens
Californian's constitutional right to privacy, especially since
LPR data is acquired without consent."
2. Restrictions on use of LPR technology by state and local law
enforcement agencies
Under existing law, the California Highway Patrol is restricted
in its use of LPR technology. This bill would place similar
restrictions on the use of the technology by state and local law
enforcement agencies, including: (1) specifying how long the
agencies may retain data obtained using LPR technology; (2)
prohibiting the sale of the data and limiting its availability;
and (3) ensuring several other privacy-related protections are
in place.
a. Retention of data captured by LPR technology
Existing law allows the CHP to retain license plate data
captured by LPR technology for no more than 60 days, except in
circumstances when the data is being used as evidence or for
all felonies being investigated, including, but not limited
to, auto theft, homicides, kidnaping, burglaries, elder and
juvenile abductions, Amber Alerts, and Blue Alerts. This bill
would impose this same restriction on state and local law
enforcement agencies when they retain license plate data using
LPR technology.
SB 1330 (Simitian)
Page 7 of ?
This provision of the bill is meant to address the concern
that once license plate information is scanned and searched
against a database and no match is made (i.e., the vehicle is
not stolen and there are no outstanding warrants on the
registered owner), that information should be disposed of and
should not be retained. The bill would allow state and local
law enforcement agencies to retain the information for up to
60 days which allows time for an investigation to proceed, if
necessary. In addition, the law enforcement agency may keep
the information without limitation when it is being used as
evidence or for the investigation of a felony.
Opponents to the measure raise particular concern about this
provision. Specifically, the Association for Los Angeles
Deputy Sheriffs writes:
This information is used differently by local law
enforcement and is often used many months after it is
obtained in order to establish an individual's identity or
to prove their guilt many months or even years after the
commission of a crime. To require local law enforcement to
relinquish, rather than file, this data is a severe
hindrance to our public safety obligation. The CHP is
primarily a traffic enforcement office and their obligation
to investigate other criminal matters is not the same as
that imposed on local law enforcement.
While the author has indicated a willingness to work with the
opposition to address this concern, at the time of the writing
of this analysis, no agreement had been reached by the
parties. Although the author appears open to a more lenient
retention requirement to address law enforcement's concerns,
the opposition has indicated its desire for no retention
period at all. Such a provision would permit state and local
law enforcement to retain information obtained by LPR
technology indefinitely, possibly forever, without any real
data demonstrating the need for such a lengthy retention
period. The author, in particular, notes that a retention
restriction is necessary for the following reasons:
First, the bill already exempts data that is being used as
evidence, or for the investigation of a felony, from the
retention period. Second, the International Association
of Chiefs of Police �IACP] conducted a study of LPR
technology in 2009 and found that, "there is considerable
SB 1330 (Simitian)
Page 8 of ?
need to establish a set of guidelines, including standard
criteria" for data retention policies. Currently, there are
widely varying retention policies across the state; some
departments retain data for just a few weeks, while others
retain it indefinitely.
Third, the IACP study also pointed out that retaining a
vast amount of LPR data "may undermine the usefulness" of
an LPR system. The study added, "�n]ot only might it take
longer for the system to search its vast repository of
data, but the system might also return too much information
for a user to sort through effectively." It is also costly
for locals to store more data. Fourth, other states have
even shorter retention periods, such as a 21-day retention
period in Maine. New Hampshire altogether prohibits public
entities from collecting LPR data, and CHP previously had
an internal policy of deleting the data after just 72
hours.
b. Prohibition on sale of the data and limitations on its
availability
Under existing law, the CHP is prohibited from selling LPR
data for any purpose and making it available to an agency that
is not a law enforcement agency or an individual who is not a
law enforcement officer. The data may be used by a law
enforcement agency only for purposes of locating vehicles or
persons when either are reasonably suspected of being involved
in the commission of a public offense. This bill would
impose these same restrictions on state and local law
enforcement agencies when they retain license plate data using
LPR technology.
c. Other privacy protections
Existing law requires the CHP to monitor internal use of LPR
data to prevent unauthorized use and report to the Legislature
its LPR practices and usage, including the number of LPR data
disclosures, a record of the agencies to which data was
disclosed and for what purpose, and any changes in policy that
affect privacy concerns. This bill would impose these same
requirements on state and local law enforcement agencies,
except that the reporting requirement is revised slightly so
that the report on the agency's use of LPR must be submitted
to the state or local agency that governs the law enforcement
agency. The League of California Cities submitted a "Notice
SB 1330 (Simitian)
Page 9 of ?
of Initial Opposition" to the bill and highlighted its
concerns with this reporting requirement, stating ". . . the
measure requires on-going tracking, posting, and reporting
mechanisms for local (and state) law enforcement agencies, to
be reported to the appropriate oversight body, regardless if
that body has requested the information. These are not
automatically generated reports but time-consuming and
unnecessary steps, duplicative of a local council's ability to
request such actions should the need arise." It would seem,
on the other hand, that these reports could contain helpful
information that a council, or other governing agency, could
use to determine whether any issues exist concerning a state
or local law enforcement agency's use of LPR technology.
This bill would also require state and local law enforcement
agencies that use LPR technology to adopt a privacy policy to
ensure that personally identifiable information is not
unlawfully disclosed and post that policy on the agency's
Internet Web site.
3. Restrictions on use of LPR technology by non-law enforcement
entities
This bill would impose restrictions on the use of LPR technology
by non-law enforcement entities, including any person, firm,
co-partnership, association, limited liability company, or
corporation. Similar to state and local law enforcement
agencies, these private entities would be restricted in their
use of LPR technology as described in more detail below.
a. Retention of data captured by LPR technology
This bill would prohibit any person who is not a state or
local enforcement agency and who uses LPR technology from
retaining license plate data captured by LPR technology for
more than 60 days. Unlike the similar retention restriction
imposed on state and local law enforcement agencies, this
provision does not contain an exception if the information is
being used as evidence or in the investigation of a felony.
This provision of the bill is intended to address the use of
LPR technology to capture and retain information about
individuals. A supporter of the bill, the American Civil
Liberties Union (ACLU) notes that the technology allows
companies to "possess millions of LPR data points establishing
SB 1330 (Simitian)
Page 10 of ?
the location of millions of individuals." The ACLU further
writes:
This volume of LPR data can provide a roadmap to an
individual's personal life including his or her movements,
activities, medical conditions, friendships, religious
practices, vocation, political beliefs, etc. This poses a
serious risk to Californians' constitutional right to
privacy, especially since LPR data is acquired without an
individual's knowledge or consent.
This provision of the bill is also intended to address the
profit incentive under existing law-which has no specific
restrictions on this kind of behavior-for companies to
surreptitiously obtain license plate data using LPR technology
and then retain that information in a database that is
searchable and the information contained within is made
available for a cost to others. By limiting how long private
entities may retain this information-and in combination with
the restrictions on sale noted below-this bill would have the
effect of restricting the practice of using LPR technology to
capture individuals' personal information that is then stored
in a database for later access.
In fact, the author indicates that two private entities that
currently use LPR technology, MVTrac and Vigilant Video, have
raised concerns that the bill would "eliminate their ability
to use LPR to locate vehicles and individuals on behalf of
financial institutions, repossession companies, and other
purchasers of LPR data." The author responds to this concern,
stating:
We should not accept a business practice just because it
facilitates asset recovery or private investigations.
Attaching a GPS to every vehicle would, for example, make
asset recovery even simpler; but because it violates our
right to privacy and creates serious risks, we don't allow
it.
Widespread use of LPR creates similar risks. The privacy
risks associated with law enforcement's acquisition of LPR
data are more acute in the private sector; LPR data may be
improperly disclosed, improperly used, sold to private
investigators or bad actors, and its acquisition creates
chilling effects on behaviors including political,
religious, and personal activities.
SB 1330 (Simitian)
Page 11 of ?
More generally, this practice commodifies our everyday
movements, and creates a profit incentive to track
law-abiding citizens without their knowledge or consent.
b. Prohibition on sale of the data and limitations on its
availability
Under this bill, any person who is not a state or local
enforcement agency and who uses LPR technology may not sell
LPR data for any purpose and shall not make the data available
to an agency or person that is not a law enforcement agency or
officer. In addition, the LPR data can only be turned over to
a law enforcement agency pursuant to a search warrant. The
bill provides that, unless the search warrant contains a
provision to the contrary, the law enforcement agency shall
immediately, but within no more than five days, notify the
person whose information was disclosed that his or her records
have been obtained. The bill requires the agency to give a
copy of the search warrant to the person and include the
identity of the agency or officer who received the records.
The California District Attorneys Association objects to this
provision of the bill, writing:
Our opposition stems from the fact that district attorneys
presently obtain the data in question without the use of a
search warrant and that adding a search warrant requirement
is unduly burdensome. Additionally, we are concerned about
the requirement that mandates law enforcement to notify the
person whose information has been disclosed unless each
search warrant contains a provision to the contrary. This
requirement, notwithstanding the exigent circumstance
provision in the bill, could have the effect of
jeopardizing and/or delaying an ongoing criminal
investigation and/or prosecution.
Staff notes that the provision at issue is based on existing
law. In 2010, SB 1268 (Simitian, Ch. 489, Stats. 2010) was
enacted to prohibit transportation agencies from selling, or
providing to any other person, the personally identifiable
information of either subscribers of an electronic toll
collection system or anyone who uses a toll bridge, lane, or
highway that utilizes an electronic toll collection system.
SB 1268 provided that the personal information could only be
given to a law enforcement agency pursuant to a search
SB 1330 (Simitian)
Page 12 of ?
warrant. The measure also specified that absent a provision
in the search warrant to the contrary, the law enforcement
agency shall immediately, but in any event within no more than
five days, notify the person that his or her records have been
obtained. SB 1268 also required the law enforcement agency to
provide the person with a copy of the search warrant and the
identity of the law enforcement agency or peace officer to
whom the records were provided. This bill uses this same
language.
In addition, this bill also would permit a peace officer who
is conducting a criminal or traffic collision investigation to
obtain personally identifiable information of a person if the
officer has good cause to believe that a delay in obtaining
the information by seeking a search warrant would cause an
adverse result. As a result, in appropriate circumstances,
the bill would allow information to be disclosed without a
search warrant.
c. Other privacy protections
This bill also would impose other privacy protections on
persons who use LPR technology to capture license plate data,
including that the person must monitor the internal use of LPR
data to prevent its unauthorized use. The bill would require
the person to adopt a privacy policy to ensure that personally
identifiable information is not unlawfully disclosed. And,
the person would be required to report annually to the
Department of Justice on its LPR practices and usage,
including the number of LPR data disclosures, a record of the
law enforcement agencies or peace officers to which data was
disclosed and for what purpose, and any changes in policy that
affect privacy concerns.
Importantly, the bill also contains an enforcement mechanism
to address misuse of LPR technology by persons other than a
state or local agency. Under this bill, any person whose
information is sold or disclosed in violation of the bill's
provisions may bring a civil action and shall be entitled to
recover any and all consequential and incidental damages,
including all costs and attorney's fees.
4. Technical amendments needed
On page 2, line 13, after "with" insert "all applicable
statutory and constitutional requirements and"
SB 1330 (Simitian)
Page 13 of ?
On page 3, line 34, after "with" insert "all applicable
statutory and constitutional requirements and"
On page 4, line 7, delete "subparagraph" and insert
"paragraph"
This bill currently adds new sections of law to Chapter 2 in
the Vehicle Code. The entirety of that Chapter deals with the
California Highway Patrol, including the restrictions on the
CHP's use of LPR technology added by AB 115. The provisions
added by this bill, however, do not apply to the CHP, and the
bill should therefore be amended to relocate the new
provisions of law to more appropriate locations in the code.
As a result, the provisions of the bill relating to state and
local law enforcement agencies (Section 1 of the bill) should
be moved to a new Chapter 3 in the Vehicle Code and the
provisions dealing with persons other than state and local law
enforcement agencies (Section 2 of the bill) should be moved
to the Civil Code to create a new Title 1.81.20 regarding "Use
of License Plate Reader Technology."
Support : American Civil Liberties Union; California Partnership
to End Domestic Violence; California Public Interest Research
Group (CALPIRG); Consumer Federation of California; Electronic
Frontier Foundation; Gun Owners of California; Privacy Rights
Clearinghouse
Opposition : Association for Los Angeles Deputy Sheriffs;
Association of Orange County Deputy Sheriffs; California
District Attorneys Association; California Fraternal Order of
Police; California Narcotic Officers' Association; California
Police Chiefs Association; California State Sheriffs'
Association; Chief Probation Officers of California; City of
Beverly Hills; League of California Cities (initial opposition);
Long Beach Police Officers Association; Los Angeles County
Professional Peace Officers Association; Los Angeles County
Sheriff; Los Angeles Police Protective League; MuniServices;
Riverside Sheriffs' Association; Sacramento County Deputy
Sheriffs' Association; Santa Ana Police Officers Association
HISTORY
Source : Author
SB 1330 (Simitian)
Page 14 of ?
Related Pending Legislation : None Known
Prior Legislation :
AB 115 (Committee on Budget, Ch. 38, Stats. 2011) (See
Background.)
SB 1268 (Simitian, Ch. 489, Stats. 2010) (See Comment 3b.)
Prior Vote :
Senate Transportation and Housing Committee (Ayes 5, Noes 3)
**************