top
Santa Cruz IMC
Santa Cruz IMC
Indybay
Indybay
Indybay
Regions
Indybay Regions North Coast Central Valley North Bay East Bay South Bay San Francisco Peninsula Santa Cruz IMC - Independent Media Center for the Monterey Bay Area North Coast Central Valley North Bay East Bay South Bay San Francisco Peninsula Santa Cruz IMC - Independent Media Center for the Monterey Bay Area California United States International Americas Haiti Iraq Palestine Afghanistan
Topics
Newswire
Features
From the Open-Publishing Calendar
From the Open-Publishing Newswire
Indybay Feature

ACLU Questions Council and Chief of Police on Automatic License Plate Readers

by ACLU Santa Cruz County
Status of Surveillance Technology a Concern
Dear Santa Cruz City Councilmembers and Chief Vogel:

I am writing on behalf of the Board of the Santa Cruz Chapter of the American Civil Liberties Union of Northern California. I assume you're aware of the recent enactment of SB 34, effective January 1, 2016, which establishes new rules for the use of Automated License Plate Readers (ALPRs). For your information, at the bottom of this email is a portion of the official Summary of the bill and of Section 4 of the bill, which contains the requirements that are the reason for this email.

First, we would like some information. The SCPD previously reported that it had received funds that it intended to use for both fixed and mobile ALPR units, but we don't know if the SCPD has yet acquired and/or begun using the equipment. Please let us know the status of the purchase and use. Second, and whatever the status of the purchase and use of the ALPRs, the new law imposes some important requirements on those who operate ALPRs and those who use the information. There are two requirements that are of most interest to us:

(1) The law ​will ​require both operators and end-users of ALPR systems (as defined in the statute, but which clearly includes the SCPD), to implement a usage and privacy policy with specific elements and to make the policy available to the public in writing and on the agency's website. See new Civil Code Sections 1798.90.51 and 1798.90.53. Has the SCPD developed a usage and privacy policy? I don't see any mention of it on the SCPD website. If the policy has not yet been implemented, we would greatly appreciate the opportunity to provide input before it is finalized.

(2) The law provides: "A public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the​ public agency before implementing the program." See Civil Code Section 1798.90.55 (emphasis added). Here, the City Council is the appropriate governing body. Even if the SCPD has not yet implemented​ ​an ALPR system, it clearly intends to​,​ and, therefore, ​the statute will require the council to schedule ​
a meeting for receiving public comment. Has such a meeting been scheduled and, if not, please let us know when the required meeting is scheduled. We would appreciate as much advance notice as possible to enable us to make a meaningful presentation.​

Thank you for your prompt attention to this important matter.​ I look forward to hearing from you.

​Peter Gelblum, Chair

OFFICIAL SUMMARY
This bill would impose specified requirements on an “ALPR operator” as defined, including, among others, maintaining reasonable security procedures and practices to protect ALPR information and implementing a usage and privacy policy with respect to that information, as specified. The bill would impose similar requirements on an “ALPR end-user,” as defined.

The bill would require an ALPR operator that accesses or provides access to ALPR information to maintain a specified record of that access and require that ALPR information only be used for authorized purposes.

The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.

The bill would require a public agency, as defined, that operates or intends to operate an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program. The bill would also prohibit a public agency from selling, sharing, or transferring ALPR information, except to another public agency, as specified.




TITLE 1.81.23. COLLECTION OF LICENSE PLATE INFORMATION

1798.90.5. The following definitions shall apply for purposes of this title:
(a) “Automated license plate recognition end-user” or “ALPR end-user” means a person that accesses or uses an ALPR system, but does not include any of the following:
(1) A transportation agency when subject to Section 31490 of the Streets and Highways Code.
(2) A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if the person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections.
(3) A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code.
(b) “Automated license plate recognition information,” or “ALPR information” means information or data collected through the use of an ALPR system.
(c) “Automated license plate recognition operator” or “ALPR operator” means a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(d) “Automated license plate recognition system” or “ALPR system” means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
(e) “Person” means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.
(f) “Public agency” means the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency.

1798.90.51. An ALPR operator shall do all of the following:
(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b) (1) Implement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2) The usage and privacy policy shall, at a minimum, include all of the following:
(A) The authorized purposes for using the ALPR system and collecting ALPR information.
(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.
(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.
(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.

1798.90.52. If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall do both of the following:
(a) Maintain a record of that access. At a minimum, the record shall include all of the following:
(1) The date and time the information is accessed.
(2) The license plate number or other data elements used to query the ALPR system.
(3) The username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.
(4) The purpose for accessing the information.
(b) Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy required by subdivision (b) of Section 1798.90.51.

1798.90.53. An ALPR end-user shall do all of the following:
(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b) (1) Implement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2) The usage and privacy policy shall, at a minimum, include all of the following:
(A) The authorized purposes for accessing and using ALPR information.
(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.
(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.

1798.90.54.

(a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.
(b) The court may award a combination of any one or more of the following:
(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).
(2) Punitive damages upon proof of willful or reckless disregard of the law.
(3) Reasonable attorney’s fees and other litigation costs reasonably incurred.
(4) Other preliminary and equitable relief as the court determines to be appropriate.

1798.90.55. Notwithstanding any other law or regulation:
(a) A public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program.
(b) A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information.
Add Your Comments
Listed below are the latest comments about this post.
These comments are submitted anonymously by website visitors.
TITLE
AUTHOR
DATE
Trip Weir
Sat, Nov 28, 2015 6:35AM
We are 100% volunteer and depend on your participation to sustain our efforts!

Donate

$110.00 donated
in the past month

Get Involved

If you'd like to help with maintaining or developing the website, contact us.

Publish

Publish your stories and upcoming events on Indybay.

IMC Network