BILL ANALYSIS �
Senate Appropriations Committee Fiscal Summary
Senator Kevin de Le�n, Chair
SB 893 (Hill) - Automated License Plate Recognition systems: use
of data.
Amended: May 6, 2014 Policy Vote: Judiciary 5-2
Urgency: No Mandate: Yes
Hearing Date: May 23, 2014 Consultant: Jolie Onodera
SUSPENSE FILE. AS AMENDED.
Bill Summary: SB 893 would place restrictions on the use of
Automated License Plate Recognition (ALPR) systems by both
public and private sector users, as specified.
Fiscal Impact (as approved on May 23, 2014):
Significant private sector and local law enforcement agency
costs (Private/Local) to comply with the provisions of this
measure, including but not limited to administrative
resources and infrastructure needs potentially required for
compliance. As the use or access of ALPR systems is not a
mandated activity, any restrictions placed on the use or
access of these systems is estimated to be non-reimbursable
by the state.
Potential periodic minor to significant costs to public
(State/Local) and private ALPR operators, to issue data
breach notifications. Private entities and public agencies
are already subject to data breach notification law,
therefore costs would be dependent on the frequency and size
of data breaches specific to ALPR data, and the process of
notification utilized by each agency.
Potentially significant reduction in fine revenues (Local)
due to reduced collection of outstanding parking fines
utilizing ALPR technology. Although state penalty
assessments and state surcharges are generally not levied on
parking violations, to the extent the parking violation
rises to the level of being assessed a fine associated with
a notice to appear, state levies would apply, resulting in
potentially significant reductions in revenue to the General
Fund.
No impact to CHP and transportation agencies (Caltrans) due
to carve out for these agencies, with the exception of the
ALPR data breach notification requirement.
SB 893 (Hill)
Page 1
Background: A recent report by the American Civil Liberties
Union (ACLU), You Are Being Tracked: How License Plate Readers
are Being Used to Record Americans' Movements (July 17, 2013),
noted:
A little noticed surveillance technology, designed to
track the movements of every passing driver, is fast
proliferating on America's streets. Automatic license
plate readers, mounted on police cars or on objects like
road signs and bridges, use small, high-speed cameras to
photograph thousands of plates per minute. The
information captured by the readers - including the
license plate number, and the date, time, and location of
every scan - is being collected and sometimes pooled into
regional sharing systems. As a result, enormous databases
of innocent motorists' location information are growing
rapidly. This information is often retained for years or
even indefinitely, with few or no restrictions to protect
privacy rights.
The documents paint a startling picture of a technology
deployed with too few rules that is becoming a tool for
mass routine location tracking and surveillance. License
plate readers can serve a legitimate law enforcement
purpose when they alert police to the location of a car
associated with a criminal investigation. But such
instances account for a tiny fraction of license plate
scans, and too many police departments are storing
millions of records about innocent drivers. Moreover,
private companies are also using license plate readers
and sharing the information they collect with police with
little or no oversight or privacy protections. A lack of
regulation means that policies governing how long our
location data is kept vary widely.
Automatic license plate readers have the potential to
create permanent records of virtually everywhere any of
us has driven, radically transforming the consequences of
leaving home to pursue private life, and opening up many
opportunities for abuse. The tracking of people's
location constitutes a significant invasion of privacy,
SB 893 (Hill)
Page 2
which can reveal many things about their lives, such as
what friends, doctors, protests, political events, or
churches a person may visit.
Existing law restricts the use of ALPR technology by the
California Highway Patrol (CHP). Pursuant to AB 115 (Committee
on Budget) Chapter 38/2011, the transportation budget trailer
bill, the CHP is authorized to retain data captured by ALPR
systems for no more than 60 days except in circumstances when
the data is being used as evidence or for felony investigations.
Further, the CHP is prohibited from selling the data for any
purpose or making the data available to any agency or person
other than law enforcement agencies or officers. (Vehicle Code �
2413(b) and (c))
This bill seeks to strengthen California residents' fundamental
right to privacy by placing limitations on the use of
information and data collected by ALPR systems.
Proposed Law: This bill would place restrictions on the use of
ALPR systems by both public and private sector users, as
follows:
Requires retained ALPR data to consist only of a license
plate number, date and time of capture, and geographical
location.
Prohibits private commercial ALPR operators from
trespassing onto private property to collect ALPR data
without first obtaining written consent of the landowner.
Prohibits any public agency from sharing ALPR data with any
private entity or individual absent a court order.
Prohibits any person authorized to access or distribute
ALPR data from further disclosing or otherwise providing
that information to any other person.
Requires specific data security protocols for the storage
of ALPR data and requires entities that use or store ALPR
data to keep an access log.
Adds ALPR information and data to the list of personal
information subject to California's data breach notification
law.
Establishes that ALPR data alone may not be used to
establish probable cause for a search or arrest warrant.
Creates a private right of action to enforce these
restrictions and allows for the recovery of actual or
statutory damages, attorney's fees, and costs of suit.
SB 893 (Hill)
Page 3
Provides that an "ALPR operator" does not include the CHP
when subject to VC � 2413 or a transportation agency when
subject to Streets and Highway Code � 31490.
Staff Comments: The provisions of this bill impose significant
new requirements on both public and private sector ALPR
operators, as defined, with regard to data and information
collected, retained, and accessed through the use of ALPR
systems. Because the provisions of this bill specifically
exclude the CHP and transportation agencies from the definition
of an "ALPR operator," no fiscal impact to those agencies is
estimated for the entirety of Section 3 of the bill.
Costs to ALPR operators would consist of workload associated
with the development and implementation of policies and
procedures to use, access, and properly safeguard the ALPR data,
additional administrative costs for developing and maintaining
access logs, as well as staff training. To the extent
information technology hardware/software purchases or
enhancements are required to comply with the provisions of this
measure could also result in significant new one-time and
ongoing costs.
As the usage of ALPR systems is not a mandated activity on local
agencies, any restrictions put on its use or access would not
appear to be reimbursable by the state. Simply put, local
agencies could choose to stop utilizing ALPR systems. However,
whether the costs to local agencies would be subject to
reimbursement by the state cannot be known with certainty, and
would ultimately be subject to determination by the Commission
on State Mandates (CSM) should a test claim be filed.
To the extent the limitations on ALPR data sharing and
distribution impact the ability of local agencies to identify
and collect outstanding parking fines, the indirect impact of
the restrictions on ALPR data could result in a significant loss
in local revenues for parking fine collections potentially in
the millions of dollars. Staff notes that although the state
penalty assessment (PC � 1464(a)) and state surcharge (PC �
1465.7) are not imposed on parking offenses generally, to the
extent a parking violation rises to the level of being assessed
a fine associated with a notice to appear (i.e., for violations
associated with disabled access, VC � 22507.8), state levies
would apply, resulting in a potential loss in revenue to the
SB 893 (Hill)
Page 4
General Fund. The number and value of uncollected parking fines
that would potentially be impacted by this measure is unknown,
but could be significant.
By adding ALPR data to the list of information subject to
California's data breach notification law, public and private
entities could incur costs periodically to issue notices in the
event of an ALPR data breach, as specified. State costs, which
are estimated to include costs for CHP and transportation
agencies, would be dependent on the frequency and size of data
breaches specific to ALPR data, and the method of notification
utilized by each agency. Under existing law, should the cost to
provide the notifications exceed $250,000, or if the breach
affected more than 500,000 persons, an entity could utilize one
of several methods of notification including posting a notice on
the entity's website, which would only incur minor costs.
Author amendments do the following:
Delete the provision prohibiting public agencies from
disclosing, distributing, selling, accessing, or otherwise
providing for another purpose, information or data
collected through the use or operation of an ALPR system to
any private entity or individual, as specified.
Delete the provision specifying that a person authorized
to access or distribute information or data collected
through the use or operation of an ALPR system shall not
further disclose or distribute that information to another
person for any purpose.
Specify that an individual who has been harmed by a
violation of this title may bring a civil action in court,
as specified, against a person who knowingly caused that
violation.