BILL ANALYSIS �
SENATE JUDICIARY COMMITTEE
Senator Hannah-Beth Jackson, Chair
2013-2014 Regular Session
SB 893 (Hill)
As Amended April 9, 2014
Hearing Date: April 22, 2014
Fiscal: Yes
Urgency: No
TH
SUBJECT
Automated License Plate Recognition Systems: Use of Data
DESCRIPTION
This bill would place restrictions on the use of Automated
License Plate Recognition (ALPR) technology by both public and
private sector users. Specifically, this bill would:
require retained ALPR data to consist only of a license plate
number, date and time of capture, and geographical location;
prohibit ALPR operators from trespassing onto private property
to collect ALPR data without first obtaining written consent
of the landowner;
prohibit any public agency from sharing ALPR data with any
private entity or individual absent a court order;
prohibit any person authorized to access or distribute ALPR
data from further disclosing or otherwise providing that
information to any other person;
require specific data security protocols for the storage of
ALPR data and require entities that use or store ALPR data to
keep an access log;
add ALPR data to the list of personal information subject to
California's Data Breach Notification Law;
establish that ALPR data alone may not be used to establish
probable cause for a search or arrest warrant; and
create a private right of action to enforce these
restrictions, and allow for the recovery of actual or
statutory damages, attorney's fees, and costs of suit.
BACKGROUND
(more)
SB 893 (Hill)
PageB of?
Automated License Plate Recognition (ALPR) systems use either
mobile (e.g., attached to the outside of a vehicle) or
stationary cameras and sophisticated computer software to
capture and record a vehicle's license plate information. These
systems typically operate by photographing an image of a license
plate, use character recognition software to convert the image
into the alpha-numeric characters of the license plate, and then
compare the alpha-numeric data to data held in other databases
to, for example, instantly identify stolen cars or locate
vehicles subject to repossession. ALPR systems capture other
data as well, including the geographic location of a license
plate and the time and date that the license plate was scanned.
Using this additional ALPR captured data, it is possible over
time and with multiple scans to construct the locational history
of scanned vehicles. The technology works at lightning speed;
one company, ELSAG North America, advertises that its
vehicle-based ALPR system can capture up to 1,800 license plate
reads per minute, day or night, can capture data from parked and
moving vehicles across up to 4 lanes of traffic, day or night
and in any weather, and can read license plate data at moving
speeds of up to 150 mph (241 kph). (See http://elsag.com
/mobile.htm (as of April 14, 2014).)
Law enforcement uses ALPR technology to identify and locate
stolen vehicles and to compare information obtained against
databases of outstanding warrants. Auto repossession companies
take advantage of ALPR technology to help find debtors who are
behind on their car payments. In January 2012, a California
Watch article entitled "Private Company Hoarding License-Plate
Data on US Drivers" noted:
Capitalizing on one of the fastest-growing trends in law
enforcement, a private California-based company has compiled a
database bulging with more than 550 million license-plate
records on both innocent and criminal drivers that can be
searched by police. . . . [P]olice around the country have
been affixing high-tech scanners to the exterior of their
patrol cars, snapping a picture of every passing license plate
and automatically comparing them to databases of outstanding
warrants, stolen cars, and wanted bank robbers. The units
work by sounding an in-car alert if the scanner comes across a
license plate of interest to police, whereas before, patrol
officers generally needed some reason to take an interest in
the vehicle, like a traffic violation.
SB 893 (Hill)
PageC of?
But when a license plate is scanned, the driver's geographic
location is also recorded and saved, along with the date and
time, each of which amounts to a record or data point. Such
data collection occurs regardless of whether the driver is a
wanted criminal, and the vast majority are not.
While privacy rules restrict what police can do with their own
databases, Vigilant Video, headquartered in Livermore, Calif.,
offers a loophole. It's a private business not required to
operate by those same rules. . . . Vigilant distinguished
itself from competitors by going one step further and
collecting hundreds of millions of scans to create what's
known as the National Vehicle Location Service. A West Coast
sales manager for the company, Randy Robinson, said the
scanners - as well as data from them compiled in the location
system - do far more than simply help identify stolen
vehicles. Stories abound of the technology also being used by
police to stop wanted killers, bank robbers, and drug
suspects. Kidnappers could be intercepted, too. (Schulz,
Private Company Hoarding License-Plate Data on US Drivers
(January 12, 2012)
(as of April 14, 2014).)
Vigilant Solutions, the company featured in the California Watch
article, now advertises that its database of license plate
records obtained from commercial sources now includes "over 1.8
billion detections and grows at a rate of almost 70 million per
month." (See http://vigilantsolutions.com/products/nvls (as of
April 14, 2014).)
Existing law restricts the use of ALPR technology by the
California Highway Patrol (CHP). In 2011, the Legislature
passed and the Governor signed AB 115 (Committee on Budget, Ch.
38, Stats. 2011), the transportation budget trailer bill, which
allows the CHP to retain data captured by ALPR systems for no
more than 60 days except as specified. AB 115 also prohibited
the CHP from selling the data or making it available to anyone
other than law enforcement agencies.
This bill would impose a number of restrictions on the use of
ALPR technology and ALPR system-derived data. Specifically,
this bill would specify that data retained by an ALPR system
shall consist only of a license plate number, date and time of
capture, and geographical location, would prohibit ALPR
operators from trespassing onto private property to collect ALPR
data without first obtaining written consent of the landowner,
SB 893 (Hill)
PageD of?
would prohibit public agencies from sharing ALPR data with any
private entity or individual absent a court order, and would
prohibit any person authorized to access or distribute ALPR data
from further disclosing or otherwise providing that information
to any other person. Additionally, this bill would require
specific data security protocols for the storage of ALPR data
and require entities that use or store ALPR data to keep an
access log, would add ALPR data to the list of personal
information subject to California's Data Breach Notification
Law, and would establish that ALPR data alone may not be used to
establish probable cause for a search or arrest warrant. In
addition to any other remedies, this bill would also allow
aggrieved individuals to recover actual or statutory damages,
attorney's fees, and costs of suit against a person who violates
the bill's provisions.
CHANGES TO EXISTING LAW
Existing law , the California Constitution, provides that all
people have inalienable rights, including the right to pursue
and obtain privacy. (Cal. Const. art. I, Sec. 1.)
Existing law permits the CHP to retain license plate data
captured by a license plate reader for no more than 60 days,
except in circumstances when the data is being used as evidence
or for all felonies being investigated, including, but not
limited to, auto theft, homicides, kidnaping, burglaries, elder
and juvenile abductions, Amber Alerts, and Blue Alerts. (Veh.
Code Sec. 2413(b).)
Existing law prohibits the CHP from selling ALPR data for any
purpose and making it available to an agency that is not a law
enforcement agency or an individual who is not a law enforcement
officer. The data may be used by a law enforcement agency only
for purposes of locating vehicles or persons when either are
reasonably suspected of being involved in the commission of a
public offense. (Veh. Code Sec. 2413(c).)
Existing law requires the CHP to monitor internal use of the
ALPR data to prevent unauthorized use. (Veh. Code Sec.
2413(d).)
Existing law requires the CHP to report to the Legislature its
ALPR practices and usage, including the number of ALPR data
disclosures, a record of the agencies to which data was
disclosed and for what purpose, and any changes in policy that
SB 893 (Hill)
PageE of?
affect privacy concerns. (Veh. Code Sec. 2413(e).)
This bill would prohibit an ALPR operator, as defined, from
using an ALPR system to collect any information or data other
than the license plate number, the date and time the information
or data is collected, and the location coordinates where the
information or data is collected, and would prohibit the
collection of this information or data from a license plate
number that is not in public view.
This bill would prohibit an ALPR operator from trespassing or
otherwise entering upon private property to collect information
or data for commercial purposes through the use or operation of
an ALPR system without first obtaining written consent from the
owner of the private property, or the owner's designated agent.
This bill would state that a public agency shall not disclose,
distribute, make available, sell, access, or otherwise provide
for another purpose, information or data collected through the
use or operation of an ALPR system to any private entity or
individual unless authorized by a court order, or as part of
civil or criminal discovery.
This bill would state that unless authorized by this title or
another law, a person authorized to access or distribute
information or data collected through the use or operation of an
ALPR system shall not further disclose, distribute, make
available, sell, access, or otherwise provide that information
or data to another person for any purpose.
This bill would state that information or data collected through
the use or operation of an ALPR system shall not be the sole
basis for establishing probable cause to obtain a search or
arrest warrant.
This bill would require an ALPR operator to ensure that the
information or data collected through the use or operation of
the ALPR system is protected with reasonable operational,
administrative, technical, and physical safeguards to ensure its
confidentiality and integrity.
This bill would require an ALPR operator to implement and
maintain reasonable security procedures and practices
appropriate for the nature of the information or data collected
via an ALPR system, in order to protect the information or data
SB 893 (Hill)
PageF of?
from unauthorized access, destruction, use, modification, or
disclosure.
This bill would require an ALPR operator to implement and
maintain a usage and privacy policy in order to ensure that the
information or data collected through the use or operation of
the ALPR system is consistent with respect for individuals'
privacy and civil liberties. This bill would specify that the
usage and privacy policy shall be available in writing, and, if
the ALPR operator has an Internet Web site, the usage and
privacy policy shall be posted conspicuously on that Internet
Web site.
This bill would add unencrypted information or data collected
through the use or operation of an ALPR system to the list of
personal information subject to breach notification under
California's Data Breach Notification Law.
This bill would require an ALPR operator to maintain a record of
access if the ALPR operator accesses or provides access to
information or data collected through the use or operation of an
ALPR system. This bill would specify that at a minimum, the
record shall include, but not be limited to, all of the
following:
The date and time the information or data is accessed;
The person who accesses the information or data; and
The purpose for accessing the information or data.
This bill would provide that in addition to any other sanctions,
penalties, or remedies provided by law, an individual may bring
a civil action in any court of competent jurisdiction against a
person who knowingly obtains, discloses, or uses information or
data collected through the use of an ALPR system for a purpose
not authorized by this bill. This bill would further provide
that a court may award all of the following:
Actual damages, but not less than liquidated damages in the
amount of two thousand five hundred dollars ($2,500);
Punitive damages upon proof of willful or reckless disregard
of the law;
Reasonable attorney's fees and other litigation costs
reasonably incurred; and
Other preliminary and equitable relief as the court determines
to be appropriate.
COMMENT
SB 893 (Hill)
PageG of?
1.Stated need for the bill
The author writes:
Except for data collected by the California Highway Patrol
(CHP), current law does not provide any privacy safeguards for
data collected by automatic license plate reader (ALPR)
systems. Current law does not prohibit the sale or sharing of
ALPR data, leaving it wide open for personal information to be
inappropriately sold or shared with non-law enforcement
entities. In addition, current law allows ALPR data to be
retained for an indeterminate amount of time, placing no
limitations on when the data may be accessed or for what
purposes.
Used primarily by law enforcement agencies, automatic license
plate reader technology uses a combination of high-speed
cameras, software and criminal databases to rapidly check and
track the license plates of millions of Californians. The
technology is also used by private, non-law enforcement
entities, such as parking and repossession companies. Some
private communities use it to monitor who enters and leaves
the community.
License plate readers can be placed anywhere, but are most
commonly mounted on the roof of law enforcement vehicles.
Based on a survey of law enforcement agencies, the American
Civil Liberties Union (ACLU) estimates that 75 percent of law
enforcement agencies currently employ ALPRs, 85 percent plan
to expand their use, and within the next five years, at least
25 percent of all police vehicles will be equipped with the
technology.
On balance, ALPR technology has become a critical component of
modern policing. For example, the Sacramento County Sheriff's
Department, in the first 30 days of using the technology,
identified and located 495 stolen vehicles, five carjacked
vehicles, and 19 other vehicles that were involved in
felonies. These ALPR identifications enabled the Sheriff's
Department to take 45 suspects into custody, including
individuals involved with bank robbery and home invasion.
But as use of this technology has increased, so has the
concern of civil libertarians. Whether or not a 'hit' occurs,
SB 893 (Hill)
PageH of?
all license plate scans are sent to "fusion centers" - large
regional databases that aggregate ALPR data from various law
enforcement agencies. The ACLU estimates that only 1 percent
of ALPR data results in a 'hit,' the other 99 percent of data
has no relation to a crime. A database that is maintained on
behalf of various northern California law enforcement agencies
reportedly has over 100 million unique license plate scans. A
database maintained on behalf of San Diego law enforcement
agencies reportedly has over 49 million license plate scans.
A company that maintains an ALPR database maintained for
private companies, such as insurance companies, collections
agencies, and private investigators, has over 1 billion
license plate scans. The company sells vehicle sighting
reports for between $10 and $25.
SB 893 would place reasonable limits on the use of data
collected by ALPR technology.
2.Fundamental Right to Privacy
Staff notes that the right to privacy is a fundamental right
protected by Section 1 of Article I of the California
Constitution. This bill would build upon that fundamental right
by limiting the possibility that ALPR technology, and the
collection of ALPR-generated data, could be used to capture
sensitive personal information of California residents,
including their locational history.
The prevalence of ALPR systems and the ease with which license
plate data can be gathered and aggregated have raised serious
privacy concerns. (See e.g. Clark, License Plate Readers Spark
Privacy, Public Safety Debate (November 20, 2013) < http://
www.usatoday.com/story/news/2013/11/20/license-plate-readers-spar
k-privacy-public-safety/3650273/> (as of April 15, 2014).)
Using large datasets of ALPR data gathered over time, it is
possible to reconstruct the locational history of a vehicle and
extrapolate certain details about the car's driver. As the
American Civil Liberties Union explains in a recent report:
Tens of thousands of license plate readers are now deployed
throughout the United States. Unfortunately, license plate
readers are typically programmed to retain the location
information and photograph of every vehicle that crosses their
path, not simply those that generate a hit. The photographs
and all other associated information are then retained in a
SB 893 (Hill)
PageI of?
database, and can be shared with others, such as law
enforcement agencies, fusion centers, and private companies.
Together these databases contain hundreds of millions of data
points revealing the travel histories of millions of motorists
who have committed no crime. (ACLU, You Are Being Tracked:
How License Plate Readers Are Being Used to Record Americans'
Movements (July 17, 2013) <
https://www.aclu.org/technology-and-liberty/you-are-being-track
ed-how-license-plate-readers-are-being-used-record> (as of
April 15, 2014).)
The U.S. Supreme Court recently examined the significant privacy
concerns raised by locational tracking technology in U.S. v.
Jones (2012). The Jones case considered whether the attachment
of a Global Positioning System (GPS) tracking device to an
individual's vehicle, and the subsequent use of that device to
track the vehicle's movements on public streets, constituted a
search within the meaning of the Fourth Amendment. In her
concurring opinion, Justice Sotomayor made the following
observations:
GPS monitoring generates a precise, comprehensive record of a
person's public movements that reflects a wealth of detail
about her familial, political, professional, religious, and
sexual associations. The Government can store such records
and efficiently mine them for information years into the
future. And because GPS monitoring is cheap in comparison to
conventional surveillance techniques and, by design, proceeds
surreptitiously, it evades the ordinary checks that constrain
abusive law enforcement practices: "limited police resources
and community hostility."
Awareness that the Government may be watching chills
associational and expressive freedoms. And the Government's
unrestrained power to assemble data that reveal private
aspects of identity is susceptible to abuse. The net result
is that GPS monitoring--by making available at a relatively
low cost such a substantial quantum of intimate information
about any person whom the Government, in its unfettered
discretion, chooses to track--may "alter the relationship
between citizen and government in a way that is inimical to
democratic society."
I would take these attributes of GPS monitoring into account
when considering the existence of a reasonable societal
SB 893 (Hill)
PageJ of?
expectation of privacy in the sum of one's public movements.
I would ask whether people reasonably expect that their
movements will be recorded and aggregated in a manner that
enables the Government to ascertain, more or less at will,
their political and religious beliefs, sexual habits, and so
on. (United States v. Jones (2012) 132 S. Ct. 945, 955-956
[internal citations omitted].)
As with GPS monitoring, the accumulation of ALPR locational data
into databases that span both time and distance also threatens
to undermine one's right to privacy. As with GPS monitoring,
California residents may be less willing to exercise their
associational and expressive freedoms if they know that their
movements are being compiled into databases accessible not only
to the government, but also to private industries and
individuals.
This bill seeks to strengthen California residents' fundamental
right to privacy by limiting the ability of ALPR operators to
amass large locational databases. SB 893 would obstruct the
aggregation of ALPR data by prohibiting public agencies from
sharing this data with private entities and individuals absent a
court order, and by prohibiting any person authorized to access
or distribute ALPR data from further disclosing or otherwise
providing that information to any other person. The bill would
also strengthen California's fundamental right to privacy by
limiting the amount of data that can be retained by ALPR
systems. By restricting retained ALPR data to license plate
numbers, dates and times of capture, and geographical locations,
this bill would ensure that ALPR systems do not become tools for
recording pictures of the occupants of a vehicle, or from
inadvertently capturing other sensitive personal information
that may be within view of an ALPR system's cameras. While it
may be true that retention of photographs taken by ALPR systems
could be helpful in ensuring that ALPR data is accurate, such
assurance would come at the high cost of the privacy interests
of countless California motorists and passengers.
Several entities in opposition to this bill argue that ALPR data
does not, in itself, include any personal or sensitive
information about the registered owner of a vehicle, its driver,
or its occupants. While this may be true when ALPR data is
viewed in isolation, the ability to interface ALPR data with a
database that does contain personal information, and the ability
to aggregate ALPR data and discern travel patterns from that
SB 893 (Hill)
PageK of?
data alone gives ALPR data the capacity to reveal sensitive
personal information much in the same way that aggregated data
from a GPS tracking device can reveal sensitive personal
information. Several entities in opposition also note how state
and federal courts have held that "[a] person traveling in an
automobile on public thoroughfares has no reasonable expectation
of privacy in his movements from one place to another." (United
States v. Knotts (1983) 460 U.S. 276, 281.) However, as Justice
Alito's concurrence in the Jones case notes, these earlier
decisions may rest on the assumption that people have "a
well-developed and stable set of privacy expectations." (Jones,
132 S. Ct. at 962.) "But," as Justice Alito explains:
technology can change those expectations. Dramatic
technological change may lead to periods in which popular
expectations are in flux and may ultimately produce
significant changes in popular attitudes. New technology may
provide increased convenience or security at the expense of
privacy, and many people may find the tradeoff worthwhile.
And even if the public does not welcome the diminution of
privacy that new technology entails, they may eventually
reconcile themselves to this development as inevitable. . . .
On the other hand, concern about new intrusions on privacy may
spur the enactment of legislation to protect against these
intrusions. (Id.)
None of the court decisions cited by those in opposition
squarely address the impact of modern technology such as ALPR
systems on expectations of privacy on California's public
thoroughfares. In light of the Supreme Court's pronouncements
on this issue, it is premature to conclude that the use of ALPR
technology on public roads categorically does not interfere with
reasonable expectations of privacy.
3.Free Speech
The First Amendment to the U.S. Constitution and Article 1,
Section 2 of the California Constitution protect the right of
every person to "freely speak, write and publish his or her
sentiments on all subjects, being responsible for the abuse of
this right." (Cal. Const. art. 1, Sec. 2.) The U.S. Supreme
Court has held that "the creation and dissemination of
information are speech within the meaning of the First Amendment
. . . Facts, after all, are the beginning point for much of the
speech that is most essential to advance human knowledge and to
conduct human affairs." (Sorrell v. IMS Health Inc. (2011) 131
SB 893 (Hill)
PageL of?
S. Ct. 2653, 2667 [citations omitted].) ALPR data collected and
aggregated by ALPR operators could arguably be viewed as "facts"
for the purpose of the First Amendment's free speech clause.<1>
However, this does not mean that the restrictions imposed by
this bill are likely to run afoul of an ALPR operator's
presumptive right to engage in constitutionally protected
speech.
In commercial speech cases - those involving "expression related
solely to the economic interests of the speaker and its
audience" - the Supreme Court has developed a four-part test for
determining when the government may regulate speech commensurate
with the First Amendment. (Cent. Hudson Gas & Elec. Corp. v.
Public Serv. Comm'n (1980) 447 U.S. 557, 561.)
At the outset, we must determine whether the expression is
protected by the First Amendment. For commercial speech to
come within that provision, it at least must concern lawful
activity and not be misleading. Next, we ask whether the
asserted governmental interest is substantial. If both
inquiries yield positive answers, we must determine whether
the regulation directly advances the governmental interest
asserted, and whether it is not more extensive than is
necessary to serve that interest. (Id., 447 U.S. 557, 566.)
--------------------------
<1> But see Sorrell v. IMS Health Inc. (2011) 131 S. Ct. 2653,
2675, 2685 (Breyer, J., dissenting):
Since ordinary regulatory programs can affect speech,
particularly commercial speech, in myriad ways, to apply a
"heightened" First Amendment standard of review whenever such
a program burdens speech would transfer from legislatures to
judges the primary power to weigh ends and to choose means,
threatening to distort or undermine legitimate legislative
objectives.
. . .
The Court reaches its conclusion [in Sorrell] . . . without
taking full account of the regulatory context, the nature of
the speech effects, the values these First Amendment
categories seek to promote, and prior precedent. At best the
Court opens a Pandora's Box of First Amendment challenges to
many ordinary regulatory practices that may only incidentally
affect a commercial message. At worst, it reawakens Lochner's
pre-New Deal threat of substituting judicial for democratic
decisionmaking where ordinary economic regulation is at issue.
SB 893 (Hill)
PageM of?
Applied to the bill at hand, it is clear that the State has a
substantial governmental interest in regulating the
dissemination of sensitive information about California
residents, including locational data derived through the use of
ALPR systems. As noted above, privacy is a fundamental right in
the State of California, and the unrestricted collection and
distribution of sensitive personal information by ALPR operators
threatens the integrity of this fundamental right. While it is
ultimately an issue for the courts, staff notes that this bill
appears to be narrowly tailored to advance the State's
fundamental interest in preserving the right of privacy of its
citizens. The bill does not preclude ALPR operators from
collecting license plate information. Rather, it provides that
ALPR systems cannot be used to inadvertently collect additional
sensitive personal information by specifying that data retained
by an ALPR system shall consist only of a license plate number,
date and time of capture, and geographical location.
4.Trespass for Commercial Purposes
Recent news articles suggest that ALPR operators may be
collecting license plate information on private property for
commercial purposes without the consent of landowners.
According to one such article:
A number of [ALPR] companies contacted by the Globe confirmed
that they often send their spotter cars to commercial lots,
such as shopping mall parking lots, because those tend to be
hotspots for ?vehicles to repossess.
In fact, on its website Digital Recognition described what it
calls good "target environments" for repossession agents,
including "malls, movie?theaters, sporting events, and
numerous other locations." In marketing materials, the firm
has indicated that it suggests routes for repossession
companies that focus on workplaces and commercial lots during
the day and apartment complexes and residential areas at
night.
However, several commercial property owners contacted by the
Globe said they had no idea repossession agents could be in
their parking lots, scanning license plates and feeding them
into a national database. Some said they would consider the
practice trespassing.
SB 893 (Hill)
PageN of?
"We're unaware that this is happening, and we're reaching out
to our security teams and law enforcement contacts to get a
better handle on it," said Les Morris, spokesman for Simon
Property Group, which owns Copley Place mall in Boston and
South Shore Plaza in Braintree.
"If we saw scanning like this being done, we would throw them
out," said Issie Shait, senior vice president of property
management at New England Development, which owns the
CambridgeSide Galleria and Bunker Hill Mall District.
(Musgrave, A Vast Hidden Surveillance Network Runs Across
America, Powered By The Repo Industry (March 5, 2014)
(as of April 16, 2014).)
As a general matter, engaging in commercial activities on the
property of another without permission may infringe upon the
protected property interests of the landowner. Such activities
may interfere with a landowner or tenant's use or enjoyment of
the property, or deprive a landowner of rents that would
otherwise be charged to the commercial actor for the right to
use or access the property. In California, the "detriment
caused by the wrongful occupation of real property" through
civil trespass is "deemed to include the value of the use of the
property for the time of that wrongful occupation." (Civ. Code
Sec. 3334(a).) Thus, an ALPR operator who engages in commercial
activities on the property of another may be civilly liable to
the property owner for "the greater of the reasonable rental
value of that property or the benefits obtained by the person
wrongfully occupying the property by reason of that wrongful
occupation." (Civ. Code Sec. 3334(b)(1).)
This bill would clarify that ALPR operators may not trespass
upon the property of others to collect ALPR data without first
obtaining written consent from the landowner or their designated
agent. By requiring prior, written consent from a landowner
before operating an ALPR system on private land, this bill would
help to uphold the private property rights of California
landowners and would undermine any economic incentive for ALPR
operators to commit civil trespass to collect license plate
data.
5.Probable Cause
SB 893 (Hill)
PageO of?
This bill would provide that information or data collected
through the use or operation of an ALPR system shall not be the
sole basis for establishing probable cause to obtain a search or
arrest warrant. In People v. Scott (2011) 52 Cal.4th 452, 474,
the California Supreme Court characterized probable cause as
follows:
"Probable cause exists when the facts known to the arresting
officer would persuade someone of 'reasonable caution' that
the person to be arrested has committed a crime. (Dunaway v.
New York (1979) 442 U.S. 200, 208.) '[P]robable cause is a
fluid concept-turning on the assessment of probabilities in
particular factual contexts ? .' (Illinois v. Gates (1983)
462 U.S. 213, 232.) It is incapable of precise definition.
(Maryland v. Pringle (2003) 540 U.S. 366, 371.) '"The
substance of all the definitions of probable cause is a
reasonable ground for belief of guilt,"' and that belief must
be 'particularized with respect to the person to be ?
seized.'" (People v. Celis (2004) 33 Cal.4th 667, 673 [16 Cal.
Rptr. 3d 85, 93 P.3d 1027].)
Several entities in opposition to this bill suggest that current
law provides adequate protection against the issuance of an
unlawful or inappropriate search or arrest warrant. However,
staff notes that it is sometimes difficult to discern how new
technologies fit within the framework of existing law, including
laws interpreting the probable cause standard. This bill would
establish clear guidelines to both law enforcement agencies and
reviewing courts that, without more, ALPR data alone cannot form
the basis for establishing probable cause to obtain a search or
arrest warrant. ALPR data, by its nature, captures information
about vehicles and not individuals. While this data can be
aggregated and analyzed to discern sensitive information about
drivers, it cannot be used to reliably establish the whereabouts
of a particular individual at any particular time.
Consequently, without more information such as eyewitness
reports or physical evidence gathered in the field, ALPR data
alone is not sufficient to form "a reasonable ground for the
belief of guilt" that a particular person has committed a
particular crime.
6.Data Security
Existing law requires any state agency, and any person or
SB 893 (Hill)
PageP of?
business conducting business in California, that owns or
licenses computerized data that includes personal information,
as defined, to disclose any security breach concerning that data
to any California resident whose unencrypted personal
information was, or is believed to have been, acquired by an
unauthorized person. (Civ. Code Secs. 1798.29(a), 1798.82(a).)
This bill would add unencrypted ALPR data to the list of
personal information subject to breach notification under
California's Data Breach Notification Law. This bill would also
require APLR operators to adhere to specific data security
protocols, including:
ensuring that the information or data collected through the
use or operation of an ALPR system is protected with
reasonable operational, administrative, technical, and
physical safeguards to ensure its confidentiality and
integrity;
implementing and maintaining reasonable security procedures
and practices appropriate for the nature of the information or
data collected via an ALPR system, in order to protect the
information or data from unauthorized access, destruction,
use, modification, or disclosure;
implementing and maintaining a usage and privacy policy in
order to ensure that the information or data collected through
the use or operation of an ALPR system is consistent with
respect for individuals' privacy and civil liberties; and
maintaining a record of access to information or data
collected through the use or operation of an ALPR system.
Staff notes that ALPR data has been mishandled in the past, in
part due to ineffective data security protocols. In 2013, the
Boston Police Department inadvertently released unencrypted ALPR
records pertaining to 40,000 different vehicles as part of a
public records request. (See Musgrave, Boston Police Halt
License Scanning Program (December 14, 2013) <
http://www.bostonglobe.com/metro/2013/12/14/boston-police-suspend
-use-high-tech-licence-plate-readers-amid-privacy-concerns/
B2hy9UIzC7KzebnGyQ0JNM/story.html> (as of April 16, 2014).)
Collectively, the data security protocols implemented through
this bill will help ensure that sensitive personal information
collected through the use of ALPR systems will be protected from
improper use and inadvertent disclosure. In so doing, these
data security requirements further the Legislature's
longstanding policy of providing effective laws to protect an
individual's privacy.
SB 893 (Hill)
PageQ of?
Several entities in opposition suggest that ALPR data should not
be subject to California's Data Breach Notification Law because
an ALPR license plate data capture does not reveal any personal
information about the registered owner of a vehicle, its driver,
or its passengers. While that may be true when viewing ALPR
data in isolation, as discussed in Comment 2 ALPR data collected
over time can reveal quite a lot of sensitive personal
information about the travel habits of a particular car owner,
driver, or passenger.
1.Technical Amendments
The author offers the following technical amendments:
On page 13, line 17, delete "Collect" and insert "Retain"
On page 14, line 8, delete "authorized"
On page 14, lines 17 and 18, delete "for a purpose not
authorized by" and insert "in violation of"
Support : American Civil Liberties Union of California
Opposition : Association for Los Angeles Deputy Sheriffs;
Association of Orange County Deputy Sheriffs; California
Association of Licensed Investigators; California Bankers
Association; California College and University Police Chiefs
Association; California District Attorneys Association;
California Financial Services Association; California Fraternal
Order of Police; California Narcotic Officers Association;
California Peace Officers Association; California Police Chiefs
Association; California Public Parking Association; California
State Sheriffs Association; Equal Access Lenders of California;
Long Beach Police Officers Association; Los Angeles County
Professional Peace Officers Association; Los Angeles Police
Protective League; MuniServices; Peace Officers Research
Association of California; Riverside Sheriffs Association;
Sacramento County Deputy Sheriffs Association; Santa Ana Police
Officers Association; TransUnion; Vigilant Solutions
HISTORY
Source : Author
SB 893 (Hill)
PageR of?
Related Pending Legislation :
AB 2197 (Mullin) would authorize the development of a temporary
license plate system that would enable vehicle dealers and
lessor-retailers to print temporary license plates on
weatherproof paper or other media selected by the Department of
Motor Vehicles. This bill is in the Assembly Committee on
Transportation.
AB 1710 (Dickinson) would, among other things, extend data
breach notification requirements to businesses that maintain but
do not own or license personal information, and would add
noncomputerized data containing personal information to the
categories of data subject to data breach notification
requirements. This bill is in the Assembly Committee on
Judiciary.
Prior Legislation :
AB 179 (Bocanegra, Ch. 375, Stats. 2013) prohibits
transportation agencies and other entities that employ an
electronic transit fare collection system (ETFC) for the payment
of transit fares from selling or providing to third parties any
personally identifiable information obtained through a person's
participation in an electronic transit fare collection system
(ETFC), with certain exceptions.
SB 1330 (Simitian, 2011) would have placed restrictions on the
use of automated license plate recognition (ALPR) technology by
private entities, including restrictions on the retention, use,
and sale of such data. This bill would have also restricted the
ability for a person to transfer ALPR data to a law enforcement
agency absent a search warrant or other specified circumstances.
This bill died on the Senate Floor.
AB 115 (Committee on Budget, Ch. 38, Stats. 2011), see
Background.
SB 1268 (Simitian, Ch. 489, Stats. 2010) prohibits
transportation agencies from selling, or providing to any other
person, the personally identifiable information of either
subscribers of an electronic toll collection system or anyone
who uses a toll bridge, lane, or highway that utilizes an
electronic toll collection system.
SB 893 (Hill)
PageS of?
SB 854 (Committee on Budget and Fiscal Review, 2010) would,
among other things, have authorized the Department of the
California Highway Patrol to retain license plate data captured
by an automated license plate reader (ALPR) for not more than 72
hours unless the data is being used as evidence or for a
legitimate law enforcement purpose. The bill would have
prohibited the Department from selling ALPR data or making the
data available to an agency that is not a law enforcement agency
or an individual that is not a law enforcement officer, and
would require the Department to monitor internal use of the data
to prevent unauthorized use. This bill died on the Senate
Floor.
AB 1614 (Committee on Budget and Fiscal Review, 2010) would,
among other things, have authorized the Department of the
California Highway Patrol to retain license plate data captured
by an automated license plate reader (ALPR) for not more than 72
hours unless the data is being used as evidence or for a
legitimate law enforcement purpose. The bill would have
prohibited the Department from selling ALPR data or making the
data available to an agency that is not a law enforcement agency
or an individual that is not a law enforcement officer, and
would require the Department to monitor internal use of the data
to prevent unauthorized use. This bill died on the Senate
Floor.
**************