BILL ANALYSIS Ó SB 34 Page 1 Date of Hearing: August 19, 2015 ASSEMBLY COMMITTEE ON APPROPRIATIONS Jimmy Gomez, Chair SB 34 (Hill) - As Amended July 13, 2015 ----------------------------------------------------------------- |Policy |Transportation |Vote:|13 - 1 | |Committee: | | | | | | | | | | | | | | |-------------+-------------------------------+-----+-------------| | |Privacy and Consumer | |11 - 0 | | |Protection | | | | | | | | | | | | | |-------------+-------------------------------+-----+-------------| | | | | | | | | | | | | | | | ----------------------------------------------------------------- Urgency: No State Mandated Local Program: NoReimbursable: No SUMMARY: This bill imposes security, privacy and public hearing requirements on the use of automated license plate recognition (ALPR) systems by public or private entities, and provides for a SB 34 Page 2 private right of action, and associated remedies, for violations of the requirements. Specifically, this bill: 1)Requires that data collected through the use or operation of an ALPR system be treated as personal information for purposes of the state's existing data breach notification laws applying to public agencies, persons, or businesses. 2)Requires an ALPR operator and an ALPR end-user to implement and maintain usage and privacy policies, as specified, to be available in writing to the public, and conspicuously posted on an operator or end-user's website. 3)Requires ALPR operators to maintain a record of access to ALPR information, including the date and time of access, the license plate number which was queried, the username of the person who accessed the information, and the purpose for accessing the information. 4)Allows an individual harmed by a violation of these requirements to bring a civil action against a person who knowingly caused the violation, and authorizes the court to award specified remedies. 5)Requires a public agency operating or intending to operate an ALPR system to provide an opportunity for public comment at a public meeting of the agency's governing body before implementing the program. 6)Prohibits a public agency from selling, sharing or transferring ALPR information, except to another public agency and only as permitted by law, although data hosting services are exempted. FISCAL EFFECT: SB 34 Page 3 1)The state's Data Breach Protection Law requires a public agency or California business that owns or licenses computerized data containing personal information to disclose a breach of the system's security or data to any California resident whose unencrypted personal information was acquired by an unauthorized person. If the costs to provide notifications exceed $250,000, or if the breach affected more than 500,000 persons, the agency or business can use one of several alternative methods of notification, including posting a notice on the entity's website. 2)The CHP could incur unknown, but likely minor costs to provide notifications in the event of a data breach. Because the department's ALPR system contains several million plates at any one time, it would likely use the less costly alternative means of notification. Other provisions of the bill are consistent with existing requirements placed on the CHP's use of ALPR. 3)Potentially significant, but nonreimbursable costs to comply with the bill's requirements for those local law enforcement agencies that elect to operate ALPR systems. Similar to the CHP, local agencies could also incur notification-related costs in the event of a data breach of their ALPR systems. COMMENTS: 1)Purpose. According to the author, "While at least seven other states have already passed laws to regulate automatic license plate reader (ALPR) systems, current California law has not kept up with the rapid adoption of the technology. Except for the California Highway Patrol (CHP) and transportation agencies, current California law doesn't require any privacy safeguards or establish any protocols for the use of ALPR SB 34 Page 4 systems." A 2014 report by the American Civil Liberties Union of Northern California (ACLU) found that, of 60 cities and 58 counties surveyed, a total of 57 combined had ALPR systems - but only 16 of those jurisdictions had a public policy governing their use, and only eight had hearings with public input before deploying the systems. 2)Background. An ALPR system is one or more mobile or fixed cameras combined with computer algorithms that can read and convert images of automobile registration plates and the characters they contain into computer-readable data showing the license plate itself, as well as the time, date and place of the picture. ALPR systems can also provide a "contextual" photo of the car itself, making information about car make and model, distinguishing features, state of registration, and driver and passage potentially available as well. It is important to note that while ALPR does not identify a specific person by itself and is not considered "personally identifiable information", it can be linked to an identifiable person through a registration database, like that operated by the DMV. ALPR systems operate by automatically scanning any license plate within range. Some ALPR systems can scan up to 2,000 license plates per minute. In the private sector, ALPR systems are used to monitor parking facilities and assist repossession companies in identifying vehicles, and even gated communities use ALPRs to monitor and regulate access. SB 34 Page 5 When used by law enforcement, each scanned license plate is checked against a variety of databases, such as the federal AMBER Alert for missing children, or the National Crime Information Center, which aggregates 21 different databases tracking categories such as stolen property, sex offenders, immigration violators, gang affiliates, and known violent persons. If one of the license plates photographed by the system gets a hit based on a match with one of the databases or some other 'hot list', the ALPR system can alert the law enforcement officer in real time so she or he can take action. 3)ALPR Restrictions on CHP. A 2011 transportation budget trailer bill restricted the use of ALPR technology by the CHP by only authorizing the department to retain data captured by ALPR systems for 60 days, except where the data is being used for felony investigations or as evidence. The CHP is also prohibited from selling the data for any purpose or making the data available to an agency or person other than law enforcement agencies or officers. The data may only be used by law enforcement agencies for purposes of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense. The CHP is required to monitor the internal use of ALPR data to prevent unauthorized use, and to regularly report to the Legislature on its ALPR practices and uses. 4)Prior Legislation. SB 893 (Hill), of 2014, which was similar to this bill, failed passage on the Senate Floor. Analysis Prepared by:Chuck Nicol / APPR. / (916) 319-2081 SB 34 Page 6