BILL ANALYSIS                                                                                                                                                                                                    



                                                                      SB 34


                                                                    Page  1





          Date of Hearing:   July 7, 2015


                ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION


                                  Mike Gatto, Chair


          SB  
          34 (Hill) - As Amended July 2, 2015


          SENATE VOTE:  25-12


          SUBJECT:  Automated license plate recognition systems: use of  
          data.


          SUMMARY:  Imposes a variety of security, privacy and public  
          hearing requirements on the use of automated license plate  
          recognition (ALPR) systems, as well as a private right of action  
          and provisions for remedies.  Specifically, this bill:  


          1)Requires that data collected through the use or operation of  
            an ALPR system be treated as personal information for purposes  
            of existing data breach notification laws applying to  
            agencies, persons, or businesses that conduct business in  
            California and own or license computerized data including  
            personal information.

          2)Requires an ALPR operator and ALPR end-user to maintain  
            reasonable security procedures and practices, including  
            operational, administrative, technical, and physical  
            safeguards, to protect information from unauthorized access,  
            destruction, use, modification, or disclosure.









                                                                      SB 34


                                                                    Page  2





          3)Requires an ALPR operator and ALPR end-user to implement and  
            maintain a usage and privacy policy, as specified, which shall  
            be available in writing to the public, and conspicuously  
            posted on the operator or end-user's website if one exists. 

          4)Requires the ALPR operator usage and privacy policy to  
            include, at a minimum, all of the following:

               a)     The authorized purposes for using the ALPR system  
                 and collecting ALPR information.



               b)     A description of the job title or other designation  
                 of the employees and independent contractors, and their  
                 training requirements, who are authorized to use the ALPR  
                 system or collect and access ALPR information.

               c)     A description of how the use of how the ALPR system  
                 will be monitored for compliance with privacy laws.





               d)     The purposes of, process for, and restrictions on,  
                 the sale, sharing, or transfer of ALPR information to  
                 other persons.



               e)     The title of the official custodian, or owner, of  
                 the ALPR system responsible for implementing the policy.



               f)     A description of the reasonable measures that will  
                 be used to ensure the accuracy of ALPR information and a  
                 process to correct data errors.








                                                                      SB 34


                                                                    Page  3








               g)     The length of time ALPR information will be  
                 retained, and the process the ALPR operator will utilize  
                 to determine if and when to destroy retained ALPR  
                 information.



          5)Requires ALPR operators to maintain a record of access to ALPR  
            information, including the date and time of access, the  
            license plate number which was queried, the username of the  
            person who accessed the information, and the purpose for  
            accessing the information.

          6)Requires the ALPR end-user's usage and privacy policy to  
            include, at a minimum, all of the following:

               a)     The authorized purposes for accessing and using ALPR  
                 information.



               b)     A description of the job title or other designation  
                 of the employees and independent contractors, and their  
                 training requirements, who are authorized to access and  
                 use ALPR information.



               c)     A description of how the use of ALPR systems will be  
                 monitored to ensure the security of the information  
                 accessed or used, and compliance with privacy laws and  
                 the process for periodic system audits, as specified.



               d)     The purposes of, process for, and restrictions on,  








                                                                      SB 34


                                                                    Page  4





                 the sale, sharing, or transfer of ALPR information to  
                 other persons.



               e)     The title of the official custodian, or owner, of  
                 the ALPR information responsible for implementing this  
                 section.



               f)     A description of the reasonable measures that will  
                 be used to ensure the accuracy of ALPR information and a  
                 process to correct data errors.



               g)     The length of time ALPR information will be  
                 retained, and the process the ALPR end-user will utilize  
                 to determine if and when to destroy retained ALPR  
                 information.

          7)Allows an individual who has been harmed by a violation of  
            these requirements to bring a civil action against a person  
            who knowingly caused the violation.  

          8)Authorizes a court to award any or all of the following  
            remedies:

               a)     Actual damages, but not less than liquidated damages  
                 in the amount of two thousand five hundred dollars  
                 ($2,500);

               b)     Punitive damages upon proof of willful or reckless  
                 disregard of the law;

               c)     Reasonable attorney's fees and other litigation  
                 costs reasonably incurred; and,









                                                                      SB 34


                                                                    Page  5







               d)     Other preliminary and equitable relief as the court  
                 determines to be appropriate.



          9)Requires that a public agency that operates or intends to  
            operate an ALPR system to provide an opportunity for public  
            comment at a public meeting of the agency's governing body  
            before implementing the program. 
          10)Prohibits a public agency from selling, sharing or  
            transferring ALPR information, except to another public agency  
            and only as permitted by law, although data hosting services  
            are exempted. 

          11)Defines the terms "automated license plate recognition  
            end-user," "automated license plate recognition information,"  
            "automated license plate recognition operator," "automated  
            license plate recognition system," "person," and "public  
            agency."
          


          EXISTING LAW:   


          1)Provides, pursuant to the California Constitution, that all  
            people have inalienable rights, including the right to pursue  
            and obtain privacy.  (Cal. Const., art. I, Sec. 1.)



          2)Permits the California Highway Patrol (CHP) to retain license  
            plate data captured by a license plate reader for no more than  
            60 days, except in circumstances when the data is being used  
            as evidence or for all felonies being investigated, including,  
            but not limited to, auto theft, homicides, kidnapping,  
            burglaries, elder and juvenile abductions, Amber Alerts, and  








                                                                      SB 34


                                                                    Page  6





            Blue Alerts.  (Vehicle Code (VC) Section 2413(b)



          3)Prohibits the CHP from selling ALPR data for any purpose and  
            making it available to an agency that is not a law enforcement  
            agency or an individual who is not a law enforcement officer.   
            The data may be used by a law enforcement agency only for  
            purposes of locating vehicles or persons when either is  
            reasonably suspected of being involved in the commission of a  
            public offense.  (VC 2413(c))



          4)Requires the CHP to monitor internal use of the ALPR data to  
            prevent unauthorized use.  (VC 2413(d))



          5)Requires the CHP to report to the Legislature its ALPR  
            practices and usage, including the number of ALPR data  
            disclosures, a record of the agencies to which data was  
            disclosed and for what purpose, and any changes in policy that  
            affect privacy concerns.  (VC 2413(e))

          6)Requires, pursuant to the Data Breach Protection Law, a public  
            agency, or a person or business conducting business in  
            California, that owns or licenses computerized data that  
            includes personal information to disclose a breach of the  
            security of the system or data following discovery or  
            notification of the security breach, to any California  
            resident whose unencrypted personal information was, or is  
            reasonably believed to have been, acquired by an unauthorized  
            person.  (Civil Code (CC) Section 1798.29; CC 1798.82)


          FISCAL EFFECT:  According to the Senate Appropriations  
          Committee: 









                                                                      SB 34


                                                                    Page  7






           Potentially significant local law enforcement agency costs to  
            comply with the provisions of this measure, to the extent  
            those entities wish to operate ALPR systems. As the use or  
            access of ALPR systems is not a mandated activity, the  
            implementation of additional security, privacy, and access  
            protocols and procedures are estimated to be non-reimbursable  
            by the state.
              
           Potential periodic minor to significant costs to public  
            (State/Local) and private ALPR operators, to issue data breach  
            notifications.  Private entities and public agencies are  
            already subject to data breach notification law, so costs  
            would be dependent on the frequency and size of data breaches  
            specific to unencrypted ALPR data, and the process of  
            notification utilized by each agency.  
          COMMENTS:   


           1)Purpose of this bill  . This bill is intended to bring greater  
            transparency to the use of ALPR systems by requiring operators  
            and end-users, as defined, to adopt an ALPR usage and privacy  
            policy, and also requiring public agencies to hold a public  
            hearing before utilizing an ALPR system.  This bill is  
            author-sponsored. 



           2)Author's statement  .  According to the author, "While at least  
            seven other states have already passed laws to regulate  
            automatic license plate reader (ALPR) systems, current  
            California law has not kept up with the rapid adoption of the  
            technology.  Except for the California Highway Patrol (CHP)  
            and transportation agencies, current California law doesn't  
            require any privacy safeguards or establish any protocols for  
            the use of ALPR systems." 











                                                                      SB 34


                                                                    Page  8





            "Not only has the law failed to keep up with the quick  
            adoption of ALPR, but the entities using ALPR have also been  
            slow in crafting their own internal policies. For example,  
            according to the International Association of Chiefs of  
            Police, only 48% of police agencies across the country have  
            developed policies that govern ALPR use and privacy."





           3)Automated License Plate Reader technology .  An ALPR system is  
            one or more mobile or fixed cameras combined with computer  
            algorithms that can read and convert images of automobile  
            registration plates and the characters they contain into  
            computer-readable data showing the license plate itself, as  
            well as the time, date and place of the picture.  ALPR systems  
            can also provide a "contextual" photo of the car itself,  
            making information about car make and model, distinguishing  
            features, state of registration, and driver and passage  
            potentially available as well.   

          It is important to note that while ALPR does not identify a  
            specific person by itself and is not considered "personally  
            identifiable information", it can be linked to an identifiable  
            person through a registration database, like that operated by  
            the Department of Motor Vehicles.



            ALPR systems operate by automatically scanning any license  
            plate within range.  Some ALPR systems can scan up to 2,000  
            license plates per minute.  In the private sector, ALPR  
            systems are used to monitor parking facilities and assist  
            repossession companies in identifying vehicles, and even gated  
            communities use ALPRs to monitor and regulate access.  

            When used by law enforcement, each scanned license plate is  
            checked against a variety of databases, such as the federal  








                                                                      SB 34


                                                                    Page  9





            AMBER Alert for missing children, or the National Crime  
            Information Center, which aggregates 21 different databases  
            tracking categories such as stolen property, sex offenders,  
            immigration violators, gang affiliates, and known violent  
            persons.  If one of the license plates photographed by the  
            system gets a hit based on a match with one of the databases  
            or some other 'hot list', the ALPR system can alert the law  
            enforcement officer in real time so she or he can take action.

            According to a May 16, 2014, article in the Los Angeles Times  
            entitled "Use of license plate photo databases is raising  
            privacy concerns", the ALPR business is booming: "The industry  
            is growing rapidly.  A 2010 study showed a third of large  
            police departments using plate readers. In 2012, the most  
            recent data available, a survey found more than 70% of the  
            nation's police departments had the scanners."

            A 2014 report by the American Civil Liberties Union of  
            Northern California (ACLU) found that, of 60 cities and 58  
            counties surveyed, a total of 57 combined had ALPR systems -  
            but only 16 of those jurisdictions had a public policy  
            governing their use, and only eight had hearings with public  
            input before deploying the systems.  And while the ACLU  
            estimates known public spending on ALPR systems to be nearly  
            $15 million, it maintains that "[t]he resulting data is almost  
            certainly just the tip of the iceberg, especially since  
            surveillance technology acquired through outside resources  
            (such as federal government grants, police foundations or  
            surveillance vendors) may sidestep some or all of the normal  
            local decision-making process."

            According to the National Conference on State Legislatures,  
            ALPR bills have been introduced or are pending in at least 17  
            other states in 2015.

           4)Law enforcement use of ALPR systems  .  ALPR systems can be used  
            to serve four specific public safety goals: (a) crime  
            analysis; (b) alert law enforcement officials that a license  
            plate number on a "hot list" is nearby; (c) monitor the  








                                                                      SB 34


                                                                    Page  10





            movements of vehicles operated by individuals with travel  
            restrictions; and (d) identify criminal conduct that was  
            otherwise unnoticed.  Hot lists may be compiled by the local  
            law enforcement agency utilizing the ALPR system or by other  
            state or federal government agencies. The purpose of these  
            lists is to signal a law enforcement official that a vehicle  
            displaying a license plate number that is included on a hot  
            list is near an ALPR camera.

          The databases built and maintained for law enforcement use are  
            large and growing.  According to the author, "A database that  
            is maintained on behalf of various northern California law  
            enforcement agencies reportedly has over 100 million unique  
            license plate scans.  A database maintained on behalf of San  
            Diego law enforcement agencies reportedly has well over 49  
            million license plate scans.  A company that maintains an ALPR  
            database for private companies, such as insurance companies,  
            collections agencies, and private investigators, has over 1  
            billion license plate scans."



            The provision of these systems and related database services  
            are also big business.  The LA Times article made mention of  
            one of the most well-known companies in this space,  
            Livermore-based Vigilant Solutions.  "Vigilant in particular  
            has seen its appeal among law enforcement officers grow  
            because it can offer police departments access to a trove of  
            more than 2 billion scans, maintained by an affiliated  
            company, Digital Recognition Network.  That database is fed by  
            cameras attached to vehicles driven by repossession agents  
            roving the nation's roadways.  The two companies have 160  
            employees.  Vigilant reports having more than 3,500 law  
            enforcement clients that either use the company's cameras or  
            access its data. Digital Recognition Network has more than 250  
            customers.  A Vigilant representative estimated that the  
            entire industry brings in as much as $500 million a year."

           5)Existing ALPR restrictions on law enforcement  . A 2011  








                                                                      SB 34


                                                                    Page  11





            transportation budget trailer bill restricted the use of ALPR  
            technology by the California Highway Patrol (CHP).  Pursuant  
            to AB 115 (Committee on Budget), Chapter 38, Statutes of 2011,  
            the CHP is only authorized to retain data captured by ALPR  
            systems for 60 days, except where the data is being used for  
            felony investigations or as evidence.  The CHP is also  
            prohibited from selling the data for any purpose or making the  
            data available to an agency or person other than law  
            enforcement agencies or officers.  The data may only be used  
            by law enforcement agencies for purposes of locating vehicles  
            or persons reasonably suspected of being involved in the  
            commission of a public offense.  The CHP is required to  
            monitor the internal use of ALPR data to prevent unauthorized  
            use, and to regularly report to the Legislature on its ALPR  
            practices and uses.



           6)Privacy concerns related to the use of ALPR systems  .   
            According to a 2009 report by the International Association of  
            Chiefs of Police, "LPR systems have the potential to reveal to  
            the government individuals' driving habits.  As LPR systems  
            become more widespread, and as law enforcement agencies  
            improve their information sharing capabilities, the potential  
            to monitor where and when a particular vehicle has traveled is  
            enhanced. Recording driving habits could implicate First  
            Amendment concerns." 

          "Specifically, LPR systems have the ability to record vehicles'  
            attendance at locations or events that, although lawful and  
            public, may be considered private.  For example, mobile LPR  
            units could read and collect the license plate numbers of  
            vehicles parked at addiction counseling meetings, doctors'  
            offices, health clinics, or even staging areas for political  
            protests. 

          "Several prominent privacy groups view information concerning  
            individuals' locations as inherently prone to abuses,  
            including expanding data uses beyond the original purposes of  








                                                                      SB 34


                                                                    Page  12





            collection, sharing data with third parties beyond reasonable  
            expectations, and heightening individuals' vulnerability to  
            crime."  

          The ACLU's July 2013 report "You Are Being Tracked" puts the  
            concern more bluntly: "Automatic license plate readers have  
            the potential to create permanent records of virtually  
            everywhere any of us has driven, radically transforming the  
            consequences of leaving home to pursue private life, and  
            opening up many opportunities for abuse.  The tracking of  
            people's location constitutes a significant invasion of  
            privacy, which can reveal many things about their lives, such  
            as what friends, doctors, protests, political events, or  
            churches a person may visit.  In our society, it is a core  
            principle that the government does not invade people's privacy  
            and collect information about citizens' innocent activities  
            just in case they do something wrong.  Clear regulations must  
            be put in place to keep the government from tracking our  
            movements on a massive scale."

           7)Proposed Committee amendments  .  According to the California  
            Bankers Association, the current language contained in the  
            definition of an ALPR end-user was intended to exempt the  
            financial services industry (because it is already regulated  
            under the federal Gramm-Leach-Bliley Act for data security) -  
            but the language still requires adherence to the privacy  
            policy of an ALPR operator. 

          To effect that change, the Committee and author may wish to  
            consider the following amendments:



          At Civil Code Section 1798.90.5 (a)(2), strike the words "(B)  
          The person has agreed to comply with and is subject to the  
          privacy policy of the ALPR operator providing the information."

          At Civil Code Section 1798.90.5 (a)(3), strike the words ", if  
          the person has agreed to comply with and is subject to the  








                                                                      SB 34


                                                                    Page  13





          privacy policy of the ALPR operator providing the information"



          At Civil Code Section 1798.90.52, renumber the existing language  
          under subdivision (a), and add the following language as (b):  
          "Require that the ALPR information only be used for the  
          authorized purposes described in the usage and privacy policy  
          required by section 1798.90.51(b)."


             
            Additionally, representatives of law enforcement have pointed  
            out that, in addition to data hosting services, law  
            enforcement occasionally contracts with private towing  
            companies to impound vehicles.  It was not the intent of the  
            section prohibiting sale or sharing of information by public  
            agencies to interfere with such activity, and so the following  
            amendment would exempt towing services as well:

                 At Civil Code Section 1798.90.55(b), after the word  
            "hosting" add "and towing"
           


          8)Previous legislation  .  SB 893 (Hill), of 2014, would have  
            placed restrictions on the use of ALPR technology by both  
            public-sector and private-sector users, in a manner similar to  
            this bill.  SB 893 failed passage on the Senate Floor.   
            
            SB 1330 (Simitian) of 2011 would have placed restrictions on  
            the use of license plate recognition (LPR) technology by  
            private entities, including restrictions on the retention,  
            use, and sale of such data.  SB 1330 failed passage on the  
            Senate Floor.
            


            AB 115 (Committee on Budget), Chapter 38, Statutes of 2011,  








                                                                      SB 34


                                                                    Page  14
                               




            allows the California Highway Patrol (CHP) to retain data  
            captured by ALPR systems for no more than 60 days, and also  
            prohibits the CHP from selling ALPR data or making it  
            available to anyone other than law enforcement agencies.





            SB 854 (Committee on Budget and Fiscal Review) of 2010 would  
            have authorized the California Highway Patrol to retain ALPR  
            data for not more than 72 hours unless the data is being used  
            as evidence or for a legitimate law enforcement purpose, and  
            also would have prohibited CHP from selling ALPR data or  
            making the data available to an agency that is not a law  
            enforcement agency or an individual that is not a law  
            enforcement officer.  SB 854 failed passage on the Senate  
            Floor.



            AB 1614 (Committee on Budget and Fiscal Review) of 2010 would  
            have authorized the California Highway Patrol to retain ALPR  
            data for not more than 72 hours unless the data is being used  
            as evidence or for a legitimate law enforcement purpose, and  
            also would have prohibited CHP from selling ALPR data or  
            making the data available to an agency that is not a law  
            enforcement agency or an individual that is not a law  
            enforcement officer.  AB 1614 died on the Senate Floor.

           9)Potential chaptering conflicts with other bills  .  Because this  
            bill would amend the code sections related to California's  
            data breach notification law, it presents a potential  
            chaptering conflict with four other measures: AB 259  
            (Dababneh), AB 739 (Irwin), AB 964 (Chau), and SB 570  
            (Jackson).  











                                                                      SB 34


                                                                    Page  15





           10)Double referral  .  This bill was double-referred to the  
            Assembly Transportation Committee, where it was heard on June  
            22, 2015 and passed out on a 13-1 vote. 
          REGISTERED SUPPORT / OPPOSITION:




          Support


          Bay Area Civil Liberties Coalition


          California Civil Liberties Advocacy


          Citizens for Criminal Justice Reform California


          Conference of California Bar Associations


          Media Alliance


          Small Business California




          Opposition


          None received.












                                                                      SB 34


                                                                    Page  16





          Analysis Prepared by:Hank Dempsey / P. & C.P. / (916)  
          319-2200