BILL ANALYSIS                                                                                                                                                                                                    



                                                                      SB 34


                                                                    Page  1





          Date of Hearing:   June 22, 2015


                        ASSEMBLY COMMITTEE ON TRANSPORTATION


                                 Jim Frazier, Chair


          SB  
          34 (Hill) - As Amended April 22, 2015


          SENATE VOTE:  25-12


          SUBJECT:  Automated license plate recognition systems: use of  
          data.




          


          SUMMARY:  Establishes provisions on the usage of automatic  
          license plate recognition (ALPR) data and expands the meaning of  
          "personal information" to include information or data collected  
          through the use or operation of an ALPR system, as specified.  
          Specifically, this bill: 

          1)Specifies that a person's information collected through the  
            use or operation of an ALPR system by a person or business is  
            considered personal information for purposes of personal data  
            collection or customer records, as specified.  

          2)Defines an ALPR system as a system of one or more mobile or  
            fixed cameras combined with computer algorithms to read and  
            convert images of registration plates and the characters they  








                                                                      SB 34


                                                                    Page  2





            contain into computer-readable data.



          3)Defines ALPR information to mean information or data collected  
            through the use of an ALPR system. 

          4)Defines an ALPR end-user as a person that accesses or uses  
            ALPR information and an ALPR operator as a person that  
            operates an ALPR system, or that stores or maintains ALPR  
            information.  Specifies, a "person" may include a law  
            enforcement agency, government agency, private entity, or  
            individual.  

          5)Specifies that an ALPR end-user or operator does not include a  
            transportation agency, as defined.  



          6)Requires that ALPR operators ensure that ALPR information is  
            protected with reasonable operational, administrative,  
            technical, and physical safeguards to ensure its  
            confidentiality and integrity.



          7)Requires that ALPR operators implement and maintain reasonable  
            security procedures and practices in order to protect ALPR  
            information from unauthorized access, destruction, use,  
            modification, or disclosure. 



          8)Requires that ALPR operators and end users implement and  
            maintain a usage and privacy policy in order to ensure that  
            the collection, use, maintenance, sharing, and dissemination  
            of ALPR information is consistent with respect for an  
            individuals' privacy and civil liberties.









                                                                      SB 34


                                                                    Page  3







          9)Requires the ALPR operator and end-user's usage and privacy  
            policy contain a minimum set of information, as specified. 



          10)Requires ALPR operators that access or provide access to ALPR  
            information to maintain a record of that access.  The record  
            must include the date and time of access, the license plate  
            number which was queried, the name of the person who accessed  
            the information and if possible, the organization or entity  
            with whom the person is affiliated, and the purpose for  
            accessing the information. 



          11)Allows an individual who has been harmed by a violation of  
            this title to bring a civil action against a person who  
            knowingly caused the violation.  The court can award damages  
            which are stipulated in this bill. 



          12)Requires a public agency that considers using an ALPR system  
            to provide an opportunity for public comment at a regularly  
            scheduled public meeting of the governing body of the agency  
            before it implements the program of ALPR use.

          EXISTING LAW:   


          1)Requires any agency, person, or business that is conducting  
            business within the state that owns or licenses compuerized  
            data that includes personal information, to disclose any  
            breach of security of the system or data following the  
            discovery of the security breach to any person within the  
            state whose personal information was or suspected to be  
            acquired by an unauthorized person, as specified. 








                                                                      SB 34


                                                                    Page  4







          2)Defines "personal information" for the abovementioned purposes  
            to include an individual's first and last name, or first  
            initial and last name, in combination with one or more  
            designated data elements relating to social security numbers,  
            driver's license numbers, financial accounts, and medical  
            information.  


          3)Prohibits a transporation agency from selling or otherwise  
            providing to any other person or entity personally  
            identifiable information of any person who subscribes to an  
            electronic toll or transit fare collection system or uses a  
            tolling faciltiy that employs an electronic toll collection  
            system, as specfied.  


          4)Requires a transportation agency that employs an electronic  
            toll collection or an electronic transit fare collection  
            system to establish a privacy policy regarding the collection  
            and use of personally identifiable information and provide  
            subscribers of that system a copy of the privacy policy, as  
            specified. 


          FISCAL EFFECT:  Unknown


          COMMENTS:  ALPR is a common public safety enforcement method  
          that utilizes optical character recognition to read vehicle  
          license plates.  ALPR systems typically use infrared lighting  
          and a variety of algorithms to take a picture of a license  
          plate, identify any text, and determine the proper letter/number  
          sequence on the plate.  This technology also allows an ALPR  
          camera to capture license plate images at any time of the day or  
          night.  Once a license plate is scanned, in most cases, the  
          license plate sequence is then checked against a variety of  
          databases to determine if the vehicle is stolen, has outstanding  








                                                                      SB 34


                                                                    Page  5





          tickets, or whether the registered owner possesses outstanding  
          arrest warrants.  If a "hit" occurs, the ALPR system alerts the  
          appropriate law enforcement entity.  While many law enforcement  
          and local government entities utilize ALPR technology, ALPR  
          hardware and systems are generally developed and managed by  
          non-governmental entities.  


          Aside for the California Highway Patrol and local transportation  
          agencies, existing law is silent on how government agencies and  
          businesses manage and protect the data gathered by ALPR systems.  
           The author introduced this bill to institute a number usage and  
          privacy standards for the operation of ALPR systems within the  
          state.  Additionally, the author notes that this bill also  
          provides an opportunity for public input on the usage and  
          standards of ALPR system that are used by government entities,  
          something the author contends most government entities do not  
          practice.  


          With the use of ALPR technology by government agencies and  
          private industry becoming commonplace, states are now discussing  
          how to best use and manage the data collected through these  
          systems.  According to the National Conference of State  
          Legislators (NCSL), 18 states have introduced legislation  
          attempting to establish or revise standards and privacy  
          requirements related to ALPR systems.  Additionally, 9 states  
          have enacted laws in some form that address the use and  
          management of data collected through ALPR systems.   


          Furthermore, while the discussion of ALPR standards is ongoing  
          at the state level, privacy concerns surrounding to the  
          collection of personal information remains a key policy issue  
          that has been raised by a number of stakeholders.  According to  
          a 2013 study conducted by the American Civil Liberties Union  
          (ACLU), the ACLU found that an estimated one percent of ALPR  
          scans resulted in a "hit" while the other 99% of data had no  
          relation to criminal activity.    Thus, when an ALPR system is  








                                                                      SB 34


                                                                    Page  6





          used by law enforcement, whether or not a "hit" occurs, all  
          license plate scans are transmitted and checked by databases  
          that aggregate and store license plate data.  This data that is  
          collected, for example, may be used to by law enforcement to  
          investigate and enforce the law; however, minimal, if any,  
          requirements exist on how this data is managed, stored,  
          retained, accessed, or shared.  


          SB 34 aims to establish a minimal set of privacy standards for  
          personal data collected by a person or entity using ALPR  
          technology.  SB 34 further exempts transportation agencies  
          involved in automatic toll and transit fare collection from the  
          provisions specified in this bill as existing law sets privacy  
          standards for personal data collected using ALPR technology for  
          these purposes.  The author asserts SB 34 will put in place  
          regulations for businesses and agencies which currently do not  
          have any policies regarding the use of ALPR data and exempt  
          transportation agencies which are already regulated by existing  
          law. 


          Previous legislation: SB 893 (Hill) of 2014, would have placed  
          restrictions on the use of ALPR technology by both public and  
          private sector users.  SB 893 died on the Senate Inactive File.


          AB 179 (Bocanegra, Chapter 375, Statutes of 2013) prohibits  
          transportation agencies and other entities that employ an  
          electronic transit fare collection system (ETFC) for the payment  
          of transit fares from selling or providing to third parties any  
          personally identifiable information obtained through a person's  
          participation in an ETFC, with certain exceptions.


          SB 1330 (Simitian) of 2011, would have placed restrictions on  
          the use of automated license plate recognition technology by  
          private entities, including restrictions on the retention, use,  
          and sale of such data.  SB 1330 would have also restricted the  








                                                                      SB 34


                                                                    Page  7





          ability for a person to transfer ALPR data to a law enforcement  
          agency absent a search warrant or other specified circumstances.  
           SB 1330 died on the Senate Floor.


          SB 1268 (Simitian, Chapter 489, Statutes of 2010) prohibits  
          transportation agencies from selling, or providing to any other  
          person, the personally identifiable information of either  
          subscribers of an electronic toll collection system or anyone  
          who uses a toll bridge, lane, or highway that utilizes an  
          electronic toll collection system.


          Double referral: This bill will be referred to the Assembly  
          Privacy and Consumer Protection Committee should it pass out of  
          this committee. 





          REGISTERED SUPPORT / OPPOSITION:




          Support


          Bay Area Civil Liberties Coalition 


          California Civil Liberties Council 


          Media Alliance 


          Small Business California 








                                                                      SB 34


                                                                    Page  8









          Opposition


          None on file




          Analysis Prepared by:Manny Leon / TRANS. / (916)  
          319-2093