BILL ANALYSIS �
SENATE JUDICIARY COMMITTEE
Senator Noreen Evans, Chair
2011-2012 Regular Session
SB 1330 (Simitian)
As Amended March 29, 2012
Hearing Date: April 24, 2012
Fiscal: Yes
Urgency: No
SK:rm
SUBJECT
License Plate Recognition Technology: Personal Information
DESCRIPTION
This bill would place restrictions on the use of license plate
recognition (LPR) technology by private entities, including
restrictions on the retention, use, and sale of such data.
BACKGROUND
License plate technology uses cameras and computer technology to
record license plate information of vehicles. The cameras are
either mobile (e.g., attached to the outside of a vehicle) or
stationary, and the images they collect of license plate numbers
are converted into computer-readable data which is then
instantly checked against various databases such as the National
Crime Information Center (NCIC). LPR technology captures other
data as well, including the geographic location of the vehicle
and the time and date that it is scanned. This information can
then be retained in a database. The technology works at
lightning speed; one company, VeriPlate, indicates that its
cameras can capture one license plate every second.
Law enforcement uses LPR technology to identify and locate
stolen vehicles or compare the information obtained against
databases of outstanding warrants. Auto repossession companies
take advantage of LPR technology to help find debtors who are
behind on their car payments. In January 2012, a California
Watch article entitled "Private company hoarding license-plate
data on US drivers" noted:
(more)
SB 1330 (Simitian)
Page 2 of ?
Capitalizing on one of the fastest-growing trends in law
enforcement, a private California-based company has compiled
a database bulging with more than 550 million license-plate
records on both innocent and criminal drivers that can be
searched by police. . . . �P]olice around the country have
been affixing high-tech scanners to the exterior of their
patrol cars, snapping a picture of every passing license
plate and automatically comparing them to databases of
outstanding warrants, stolen cars, and wanted bank robbers.
The units work by sounding an in-car alert if the scanner
comes across a license plate of interest to police, whereas
before, patrol officers generally needed some reason to take
an interest in the vehicle, like a traffic violation.
But when a license plate is scanned, the driver's geographic
location is also recorded and saved, along with the date and
time, each of which amounts to a record or data point. Such
data collection occurs regardless of whether the driver is a
wanted criminal, and the vast majority are not.
While privacy rules restrict what police can do with their
own databases, Vigilant Video, headquartered in Livermore,
Calif., offers a loophole. It's a private business not
required to operate by those same rules. . . . Vigilant
distinguished itself from competitors by going one step
further and collecting hundreds of millions of scans to
create what's known as the National Vehicle Location
Service. A West Coast sales manager for the company, Randy
Robinson, said the scanners - as well as data from them
compiled in the location system - do far more than simply
help identify stolen vehicles. Stories abound of the
technology also being used by police to stop wanted killers,
bank robbers, and drug suspects. Kidnappers could be
intercepted, too.
Existing law restricts the use of LPR technology by the
California Highway Patrol (CHP). In 2011, the Legislature
passed and the Governor signed AB 115 (Committee on Budget, Ch.
38, Stats. 2011), the transportation budget trailer bill, which
allows the CHP to retain data captured by LPR technology for no
more than 60 days except as specified. AB 115 also prohibited
the CHP from selling the data or making it available to anyone
other than law enforcement.
This bill would impose restrictions on private entities,
including restrictions on retention, use, and sale of LPR data.
SB 1330 (Simitian)
Page 3 of ?
(This analysis reflects author's amendments to be offered in
Committee.)
CHANGES TO EXISTING LAW
Existing law , the California Constitution, provides that all
people have inalienable rights, including the right to pursue
and obtain privacy. (Cal. Const. art. I, Sec. 1.)
Existing law permits the CHP to retain license plate data
captured by a license plate reader for no more than 60 days,
except in circumstances when the data is being used as evidence
or for all felonies being investigated, including, but not
limited to, auto theft, homicides, kidnaping, burglaries, elder
and juvenile abductions, Amber Alerts, and Blue Alerts. (Veh.
Code Sec. 2413(b).)
Existing law prohibits the CHP from selling LPR data for any
purpose and making it available to an agency that is not a law
enforcement agency or an individual who is not a law enforcement
officer. The data may be used by a law enforcement agency only
for purposes of locating vehicles or persons when either are
reasonably suspected of being involved in the commission of a
public offense. (Veh. Code Sec. 2413(c).)
Existing law requires the CHP to monitor internal use of the LPR
data to prevent unauthorized use. (Veh. Code Sec. 2413(d).)
Existing law requires the CHP to report to the Legislature its
LPR practices and usage, including the number of LPR data
disclosures, a record of the agencies to which data was
disclosed and for what purpose, and any changes in policy that
affect privacy concerns. (Veh. Code Sec. 2413(e).)
This bill would impose the following restrictions on any person
who uses LPR technology other than a state or local law
enforcement agency:
the person shall not retain license plate data captured by LPR
technology for more than 60 days;
the person shall not sell LPR data for any purpose and shall
not make the data available to an agency or person that is not
a law enforcement agency or officer;
the person shall make data available to a law enforcement
agency only pursuant to a search warrant. Unless the search
SB 1330 (Simitian)
Page 4 of ?
warrant contains a provision to the contrary, the law
enforcement agency shall immediately, but within no more than
five days, notify the person whose information was disclosed
that his or her records have been obtained. The bill requires
the agency to give a copy of the search warrant to the person
and include the identity of the agency or officer who received
the records; and
the person must allow a peace officer who is conducting a
criminal or traffic collision investigation to obtain
personally identifiable information of a person if the officer
has good cause to believe that a delay in obtaining the
information by seeking a search warrant would cause an adverse
result, as specified.
This bill would require a person using LPR technology to monitor
the internal use of LPR data to prevent its unauthorized use.
This bill would require a person using LPR technology to adopt a
privacy policy to ensure that personally identifiable
information is not unlawfully disclosed.
This bill would require a person using LPR technology to report
annually to the Department of Justice on its LPR practices and
usage, including the number of LPR data disclosures, a record of
the law enforcement agencies or peace officers to which data was
disclosed and for what purpose, and any changes in policy that
affect privacy concerns.
This bill would provide that any person whose information is
sold or disclosed in violation of the bill's provisions relating
to the use of LPR technology by persons other than a state or
local law enforcement agency may bring a civil action and shall
be entitled to recover any and all consequential and incidental
damages, including all costs and attorney's fees.
COMMENT
1.Stated need for the bill
In support of the bill, the author writes:
There is no regulation on the use of license-plate recognition
technology and data by . . . private entities. While the
California Highway Patrol is subject to regulation, local law
enforcement and private entities have unfettered access to this
technology. The lack of regulation creates significant risks.
SB 1330 (Simitian)
Page 5 of ?
. . .
For the private sector, the problems are even more acute. LPR
cameras enable private entities to commodify data on the
movements and habits of law-abiding citizens. Such entities use
"scout cars" that cruise city streets, parking lots, and
highways to track all of the surrounding vehicles. A "scout
car" of this sort can record data on more than 10,000 license
plates in just 8 hours. As a result, multiple private
entities possess well over half a billion LPR records. One
company claims to scan 40 percent of the vehicles in the
country on an annual basis (Vigilant Video); another says that
it captures data on 50 million vehicles each month (MVTrac).
This data is typically sold to financial institutions,
repossession companies, and private investigators.
This bill is supported by the Consumer Federation of California
which writes that the measure will "safeguard Californians'
constitutional right to individual privacy by reining in the
use, and increasing abuse, of license-plate recognition (LPR)
software on both innocent and criminal drivers. . . . Innocent
Californians should not be having their vehicles monitored,
potentially tracked, and that data stored and then sold for
profit to third parties like asset recovery companies and
financial institutions (among others) - all without their
knowledge or consent."
The California Partnership to End Domestic Violence writes:
LPR technology could be used by an abusive partner to track
the victim's whereabouts. Research indicates that at least
one in four victims of stalking report that the offender used
some form of technology. However, this is likely an
underestimate of the actual rates since offenders can use many
forms of technologies against a victim without the victim's
knowledge, such as LPR technology.
Gun Owners of California also supports the bill writing that
"LPR records can be sold to any person or organization for any
purpose. This poses public safety risks and threatens
Californian's constitutional right to privacy, especially since
LPR data is acquired without consent."
2. Author's amendments to delete restrictions on use of LPR
technology by state and local law enforcement agencies
SB 1330 (Simitian)
Page 6 of ?
Under existing law, the California Highway Patrol is restricted
in its use of LPR technology. As currently in print, this bill
would place similar restrictions on the use of the technology by
state and local law enforcement agencies, including: (1)
specifying how long the agencies may retain data obtained using
LPR technology; (2) prohibiting the sale of the data and
limiting its availability; and (3) ensuring several other
privacy-related protections are in place. In response to
concerns raised, the author is proposing to delete this section
of the bill related to state and local law enforcement agencies.
At the time of the writing of this analysis, it is not clear
how this amendment will affect the position of opponents,
although the author's office indicates that some opponents will
remove their opposition based on the amendment. The amendment
is as follows:
Author's amendments :
On page 2, delete lines 1 - 13
On page 3, delete lines 1 - 31
3. Restrictions on use of LPR technology by non-law enforcement
entities
This bill would impose restrictions on the use of LPR technology
by non-law enforcement entities, including any person, firm,
co-partnership, association, limited liability company, or
corporation. These private entities would be restricted in
their use of LPR technology as described in more detail below.
a. Retention of data captured by LPR technology
This bill would prohibit any person who is not a state or
local enforcement agency and who uses LPR technology from
retaining license plate data captured by LPR technology for
more than 60 days. Unlike the similar retention restriction
imposed on state and local law enforcement agencies, this
provision does not contain an exception if the information is
being used as evidence or in the investigation of a felony.
This provision of the bill is intended to address the use of
LPR technology to capture and retain information about
individuals. A supporter of the bill, the American Civil
Liberties Union (ACLU) notes that the technology allows
companies to "possess millions of LPR data points establishing
SB 1330 (Simitian)
Page 7 of ?
the location of millions of individuals." The ACLU further
writes:
This volume of LPR data can provide a roadmap to an
individual's personal life including his or her movements,
activities, medical conditions, friendships, religious
practices, vocation, political beliefs, etc. This poses a
serious risk to Californians' constitutional right to
privacy, especially since LPR data is acquired without an
individual's knowledge or consent.
This provision of the bill is also intended to address the
profit incentive under existing law-which has no specific
restrictions on this kind of behavior-for companies to
surreptitiously obtain license plate data using LPR technology
and then retain that information in a database that is
searchable and the information contained within is made
available for a cost to others. By limiting how long private
entities may retain this information-and in combination with
the restrictions on sale noted below-this bill would have the
effect of restricting the practice of using LPR technology to
capture individuals' personal information that is then stored
in a database for later access.
In fact, the author indicates that two private entities that
currently use LPR technology, MVTrac and Vigilant Video, have
raised concerns that the bill would "eliminate their ability
to use LPR to locate vehicles and individuals on behalf of
financial institutions, repossession companies, and other
purchasers of LPR data." The author responds to this concern,
stating:
We should not accept a business practice just because it
facilitates asset recovery or private investigations.
Attaching a GPS to every vehicle would, for example, make
asset recovery even simpler; but because it violates our
right to privacy and creates serious risks, we don't allow
it.
Widespread use of LPR creates similar risks. The privacy
risks associated with law enforcement's acquisition of LPR
data are more acute in the private sector; LPR data may be
improperly disclosed, improperly used, sold to private
investigators or bad actors, and its acquisition creates
chilling effects on behaviors including political,
religious, and personal activities.
SB 1330 (Simitian)
Page 8 of ?
More generally, this practice commodifies our everyday
movements, and creates a profit incentive to track
law-abiding citizens without their knowledge or consent.
b. Prohibition on sale of the data and limitations on its
availability
Under this bill, any person who is not a state or local
enforcement agency and who uses LPR technology may not sell
LPR data for any purpose and shall not make the data available
to an agency or person that is not a law enforcement agency or
officer. In addition, the LPR data can only be turned over to
a law enforcement agency pursuant to a search warrant. The
bill provides that, unless the search warrant contains a
provision to the contrary, the law enforcement agency shall
immediately, but within no more than five days, notify the
person whose information was disclosed that his or her records
have been obtained. The bill requires the agency to give a
copy of the search warrant to the person and include the
identity of the agency or officer who received the records.
The California District Attorneys Association objects to this
provision of the bill, writing:
Our opposition stems from the fact that district attorneys
presently obtain the data in question without the use of a
search warrant and that adding a search warrant requirement
is unduly burdensome. Additionally, we are concerned about
the requirement that mandates law enforcement to notify the
person whose information has been disclosed unless each
search warrant contains a provision to the contrary. This
requirement, notwithstanding the exigent circumstance
provision in the bill, could have the effect of
jeopardizing and/or delaying an ongoing criminal
investigation and/or prosecution.
Staff notes that the provision at issue is based on existing
law. In 2010, SB 1268 (Simitian, Ch. 489, Stats. 2010) was
enacted to prohibit transportation agencies from selling, or
providing to any other person, the personally identifiable
information of either subscribers of an electronic toll
collection system or anyone who uses a toll bridge, lane, or
highway that utilizes an electronic toll collection system.
SB 1268 provided that the personal information could only be
given to a law enforcement agency pursuant to a search
SB 1330 (Simitian)
Page 9 of ?
warrant. The measure also specified that absent a provision
in the search warrant to the contrary, the law enforcement
agency shall immediately, but in any event within no more than
five days, notify the person that his or her records have been
obtained. SB 1268 also required the law enforcement agency to
provide the person with a copy of the search warrant and the
identity of the law enforcement agency or peace officer to
whom the records were provided. This bill uses this same
language.
In addition, this bill also would permit a peace officer who
is conducting a criminal or traffic collision investigation to
obtain personally identifiable information of a person if the
officer has good cause to believe that a delay in obtaining
the information by seeking a search warrant would cause an
adverse result. As a result, in appropriate circumstances,
the bill would allow information to be disclosed without a
search warrant.
c. Other privacy protections
This bill also would impose other privacy protections on
persons who use LPR technology to capture license plate data,
including that the person must monitor the internal use of LPR
data to prevent its unauthorized use. The bill would require
the person to adopt a privacy policy to ensure that personally
identifiable information is not unlawfully disclosed. And,
the person would be required to report annually to the
Department of Justice on its LPR practices and usage,
including the number of LPR data disclosures, a record of the
law enforcement agencies or peace officers to which data was
disclosed and for what purpose, and any changes in policy that
affect privacy concerns.
Importantly, the bill also contains an enforcement mechanism
to address misuse of LPR technology by persons other than a
state or local agency. Under this bill, any person whose
information is sold or disclosed in violation of the bill's
provisions may bring a civil action and shall be entitled to
recover any and all consequential and incidental damages,
including all costs and attorney's fees.
4. Technical amendments needed
On page 3, line 34, after "with" insert "all applicable
statutory and constitutional requirements and"
SB 1330 (Simitian)
Page 10 of ?
On page 4, line 7, delete "subparagraph" and insert
"paragraph"
This bill currently adds new sections of law to Chapter 2 in
the Vehicle Code. The entirety of that Chapter deals with the
California Highway Patrol, including the restrictions on the
CHP's use of LPR technology added by AB 115. The provisions
added by this bill, however, do not apply to the CHP, and the
bill should therefore be amended to relocate the new
provisions of law to more appropriate locations in the code.
As a result, the provisions of the bill relating to persons
other than state and local law enforcement agencies (the
current Section 2 of the bill) should be moved to the Civil
Code to create a new Title 1.81.20 regarding "Use of License
Plate Reader Technology."
Support : American Civil Liberties Union; California Partnership
to End Domestic Violence; California Public Interest Research
Group (CALPIRG); Consumer Federation of California; Electronic
Frontier Foundation; Gun Owners of California; Privacy Rights
Clearinghouse
Opposition : Association for Los Angeles Deputy Sheriffs;
Association of Orange County Deputy Sheriffs; California
Contract Cities Association; California District Attorneys
Association; California Fraternal Order of Police; California
Narcotic Officers' Association; California Police Chiefs
Association; California Public Parking Association; California
State Sheriffs' Association; Chief Probation Officers of
California; City of Beverly Hills; League of California Cities
(initial opposition); Long Beach Police Officers Association;
Los Angeles County Professional Peace Officers Association; Los
Angeles County Sheriff; Los Angeles Police Protective League;
MuniServices; Riverside Sheriffs' Association; Sacramento County
Deputy Sheriffs' Association; San Bernardino County Sheriff's
Office; Santa Ana Police Officers Association
HISTORY
Source : Author
Related Pending Legislation : None Known
SB 1330 (Simitian)
Page 11 of ?
Prior Legislation :
AB 115 (Committee on Budget, Ch. 38, Stats. 2011) (See
Background.)
SB 1268 (Simitian, Ch. 489, Stats. 2010) (See Comment 3b.)
Prior Vote : Senate Transportation and Housing Committee (Ayes
5, Noes 3)
**************