BILL ANALYSIS                                                                                                                                                                                                    

                                                                      SB 34  

                                                                    Page  1

          Date of Hearing:  August 19, 2015


                                 Jimmy Gomez, Chair

          SB 34  
          (Hill) - As Amended July 13, 2015

          |Policy       |Transportation                 |Vote:|13 - 1       |
          |Committee:   |                               |     |             |
          |             |                               |     |             |
          |             |                               |     |             |
          |             |Privacy and Consumer           |     |11 - 0       |
          |             |Protection                     |     |             |
          |             |                               |     |             |
          |             |                               |     |             |
          |             |                               |     |             |
          |             |                               |     |             |
          |             |                               |     |             |

          Urgency:  No  State Mandated Local Program:  NoReimbursable:  No


          This bill imposes security, privacy and public hearing  
          requirements on the use of automated license plate recognition  
          (ALPR) systems by public or private entities, and provides for a  


                                                                      SB 34  

                                                                    Page  2

          private right of action, and associated remedies, for violations  
          of the requirements. Specifically, this bill: 

          1)Requires that data collected through the use or operation of  
            an ALPR system be treated as personal information for purposes  
            of the state's existing data breach notification laws applying  
            to public agencies, persons, or businesses.

          2)Requires an ALPR operator and an ALPR end-user to implement  
            and maintain usage and privacy policies, as specified, to be  
            available in writing to the public, and conspicuously posted  
            on an operator or end-user's website.

          3)Requires ALPR operators to maintain a record of access to ALPR  
            information, including the date and time of access, the  
            license plate number which was queried, the username of the  
            person who accessed the information, and the purpose for  
            accessing the information.

          4)Allows an individual harmed by a violation of these  
            requirements to bring a civil action against a person who  
            knowingly caused the violation, and authorizes the court to  
            award specified remedies.

          5)Requires a public agency operating or intending to operate an  
            ALPR system to provide an opportunity for public comment at a  
            public meeting of the agency's governing body before  
            implementing the program. 

          6)Prohibits a public agency from selling, sharing or  
            transferring ALPR information, except to another public agency  
            and only as permitted by law, although data hosting services  
            are exempted.

          FISCAL EFFECT:


                                                                      SB 34  

                                                                    Page  3

          1)The state's Data Breach Protection Law requires a public  
            agency or California business that owns or licenses  
            computerized data containing personal information to disclose  
            a breach of the system's security or data to any California  
            resident whose unencrypted personal information was acquired  
            by an unauthorized person. If the costs to provide  
            notifications exceed $250,000, or if the breach affected more  
            than 500,000 persons, the agency or business can use one of  
            several alternative methods of notification, including posting  
            a notice on the entity's website.

          2)The CHP could incur unknown, but likely minor costs to provide  
            notifications in the event of a data breach. Because the  
            department's ALPR system contains several million plates at  
            any one time, it would likely use the less costly alternative  
            means of notification. Other provisions of the bill are  
            consistent with existing requirements placed on the CHP's use  
            of ALPR.

          3)Potentially significant, but nonreimbursable costs to comply  
            with the bill's requirements for those local law enforcement  
            agencies that elect to operate ALPR systems. Similar to the  
            CHP, local agencies could also incur notification-related  
            costs in the event of a data breach of their ALPR systems.


          1)Purpose. According to the author, "While at least seven other  
            states have already passed laws to regulate automatic license  
            plate reader (ALPR) systems, current California law has not  
            kept up with the rapid adoption of the technology.  Except for  
            the California Highway Patrol (CHP) and transportation  
            agencies, current California law doesn't require any privacy  
            safeguards or establish any protocols for the use of ALPR  


                                                                      SB 34  

                                                                    Page  4


            A 2014 report by the American Civil Liberties Union of  
            Northern California (ACLU) found that, of 60 cities and 58  
            counties surveyed, a total of 57 combined had ALPR systems -  
            but only 16 of those jurisdictions had a public policy  
            governing their use, and only eight had hearings with public  
            input before deploying the systems.

          2)Background. An ALPR system is one or more mobile or fixed  
            cameras combined with computer algorithms that can read and  
            convert images of automobile registration plates and the  
            characters they contain into computer-readable data showing  
            the license plate itself, as well as the time, date and place  
            of the picture.  ALPR systems can also provide a "contextual"  
            photo of the car itself, making information about car make and  
            model, distinguishing features, state of registration, and  
            driver and passage potentially available as well.   

          It is important to note that while ALPR does not identify a  
            specific person by itself and is not considered "personally  
            identifiable information", it can be linked to an identifiable  
            person through a registration database, like that operated by  
            the DMV.

            ALPR systems operate by automatically scanning any license  
            plate within range.  Some ALPR systems can scan up to 2,000  
            license plates per minute.  In the private sector, ALPR  
            systems are used to monitor parking facilities and assist  
            repossession companies in identifying vehicles, and even gated  
            communities use ALPRs to monitor and regulate access. 



                                                                      SB 34  

                                                                    Page  5

            When used by law enforcement, each scanned license plate is  
            checked against a variety of databases, such as the federal  
            AMBER Alert for missing children, or the National Crime  
            Information Center, which aggregates 21 different databases  
            tracking categories such as stolen property, sex offenders,  
            immigration violators, gang affiliates, and known violent  
            persons.  If one of the license plates photographed by the  
            system gets a hit based on a match with one of the databases  
            or some other 'hot list', the ALPR system can alert the law  
            enforcement officer in real time so she or he can take action.

          3)ALPR Restrictions on CHP. A 2011 transportation budget trailer  
            bill restricted the use of ALPR technology by the CHP by only  
            authorizing the department to retain data captured by ALPR  
            systems for 60 days, except where the data is being used for  
            felony investigations or as evidence.  The CHP is also  
            prohibited from selling the data for any purpose or making the  
            data available to an agency or person other than law  
            enforcement agencies or officers.  The data may only be used  
            by law enforcement agencies for purposes of locating vehicles  
            or persons reasonably suspected of being involved in the  
            commission of a public offense. The CHP is required to monitor  
            the internal use of ALPR data to prevent unauthorized use, and  
            to regularly report to the Legislature on its ALPR practices  
            and uses.

          4)Prior Legislation. SB 893 (Hill), of 2014, which was similar  
            to this bill, failed passage on the Senate Floor.   

          Analysis Prepared by:Chuck Nicol / APPR. / (916)  


                                                                      SB 34  

                                                                    Page  6