Bill Text

Bill Information

PDF |Add To My Favorites |Track Bill | print page

AB-1782 Automated license plate recognition information: usage and privacy policy.(2019-2020)

SHARE THIS:share this bill in Facebookshare this bill in Twitter
Date Published: 05/24/2019 09:00 PM
AB1782:v95#DOCUMENT

Amended  IN  Assembly  May 24, 2019
Amended  IN  Assembly  April 30, 2019
Amended  IN  Assembly  April 10, 2019
Amended  IN  Assembly  March 25, 2019

CALIFORNIA LEGISLATURE— 2019–2020 REGULAR SESSION

Assembly Bill
No. 1782


Introduced by Assembly Member Chau

February 22, 2019


An act to amend Sections 1798.90.51 1798.90.5, 1798.90.51, and 1798.90.53 of the Civil Code, relating to personal information.


LEGISLATIVE COUNSEL'S DIGEST


AB 1782, as amended, Chau. Automated license plate recognition information: usage and privacy policy.
Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate reader technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law authorizes the department to share that data with law enforcement agencies for specified purposes and requires both an ALPR operator and an ALPR end-user, as those terms are defined, to implement a usage and privacy policy regarding that ALPR information, as specified. Existing law requires that the usage and privacy policy implemented by an ALPR operator and an ALPR end-user include the length of time ALPR information will be retained, and the process the ALPR operator and ALPR end-user will utilize to determine if and when to destroy retained ALPR information.
This bill would delete the requirement that the usage and privacy policy implemented by an ALPR operator and an ALPR end-user include the retention and destruction information described above, and would instead require those usage and privacy policies to include a procedure to ensure the destruction of all nonanonymized ALPR information no more than 60 days from the date of collection, except as provided. The bill would also require that the usage and privacy policy implemented by an ALPR operator and an ALPR end-user include a procedure to ensure that all ALPR information that is shared with an organization or individual, not including a law enforcement agency, outside of the entity that generated that information is sufficiently anonymized anonymized, as defined, to protect the privacy of the license plate holder.
Vote: MAJORITY   Appropriation: NO   Fiscal Committee: YES   Local Program: NO  

The people of the State of California do enact as follows:


SECTION 1.

 Section 1798.90.5 of the Civil Code is amended to read:

1798.90.5.
 The following definitions shall apply for purposes of this title:
(a) “Anonymize” means to redact the images of the registration plates and the characters they contain from the ALPR information so that the ALPR information does not identify, or does not provide a reasonable basis from which to identify, an individual.

(a)

(b) “Automated license plate recognition end-user” or “ALPR end-user” means a person that accesses or uses an ALPR system, but does not include any of the following:
(1) A transportation agency when subject to Section 31490 of the Streets and Highways Code.
(2) A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if the person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections.
(3) A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code.

(b)

(c) “Automated license plate recognition information,” or “ALPR information” means information or data collected through the use of an ALPR system.

(c)

(d) “Automated license plate recognition operator” or “ALPR operator” means a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.

(d)

(e) “Automated license plate recognition system” or “ALPR system” means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.

(e)

(f) “Person” means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.

(f)

(g) “Public agency” means the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency.

SECTION 1.SEC. 2.

 Section 1798.90.51 of the Civil Code is amended to read:

1798.90.51.
 An ALPR operator shall do all of the following:
(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b) (1) Implement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an internet website, the usage and privacy policy shall be posted conspicuously on that internet website.
(2) The usage and privacy policy shall, at a minimum, include all of the following:
(A) The authorized purposes for using the ALPR system and collecting ALPR information.
(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.
(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.
(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G) A procedure to ensure the destruction of all nonanonymized ALPR information no more than 60 days from the date of collection, except as authorized pursuant to Section 2413 of the Vehicle Code. Code or if the ALPR operator is a law enforcement agency and the ALPR information is being used as evidence or for the investigation of a felony.
(H) A procedure to ensure that all ALPR information that is shared with an organization or individual, not including a law enforcement agency, outside of the entity that generated that information is sufficiently anonymized to protect the privacy of the license plate holder.

SEC. 2.SEC. 3.

 Section 1798.90.53 of the Civil Code is amended to read:

1798.90.53.
 An ALPR end-user shall do all of the following:
(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b) (1) Implement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an internet website, the usage and privacy policy shall be posted conspicuously on that internet website.
(2) The usage and privacy policy shall, at a minimum, include all of the following:
(A) The authorized purposes for accessing and using ALPR information.
(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.
(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G) A procedure to ensure the destruction of all nonanonymized ALPR information no more than 60 days from the date of collection, except as authorized pursuant to Section 2413 of the Vehicle Code. Code or if the ALPR end-user is a law enforcement agency and the ALPR information is being used as evidence or for the investigation of a felony.
(H) A procedure to ensure that all ALPR information that is shared with an organization or individual, not including a law enforcement agency, outside of the entity that generated that information is sufficiently anonymized to protect the privacy of the license plate holder.