Local

California Law on Collection of License Plate Information

Requirements for operators and users of automated license plate recognition systems

Birdie Draper Collection Image — SDASM Archives

Last revised: January 2020

Title 1.81.23 of the California Civil Code regulates the use of automated license plate readers (ALPRs.)

Effective date: The requirements are effective since January 1st, 2016

As a general rule, any person that operates or use an ALPR system is subject to the law.

ALPR OPERATORS: An Automated License Plate Recognition Operators (or “ALPR operators”) is a person that operates an ALPR sytem. (See, Cal Civ. Code Sec. 1798.90.5(c))

  • A “person” is any natural person, public agency (i.e. state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency), partnership, firm, association, corporation, limited liability company, or other legal entity. (See, Cal Civ. Code Sec. 1798.90.5(e)&(f))
  • An “Automated license plate recognition system” or “ALPR system” means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. (See, Cal Civ. Code Sec. 1798.90.5(d))

Exceptions: A transportation agency subject to Section 31490 of the Streets and Highways Code is not considered an ALPR operator and, therefore, is not subject to the law. (See, Cal Civ. Code Sec. 1798.90.5(c))

ALPR END-USER: An Automated License Plate End-User (or “ALPR end user”) is a person that access or uses an ALPR sytem. (See, Cal Civ. Code Sec. 1798.90.5(a))

Exceptions: The following are not ALPR end-users:

  • A transportation agency subject to Section 31490 of the Streets and Highways Code (See, Cal Civ. Code Sec. 1798.90.5(a)(1))
  • A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if the person is subject to compliance with oversight by a state or federal regulatory agency with respect to those sections. (See, Cal Civ. Code Sec. 1798.90.5(a)(2))
  • A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 or Title 18 of the United States Code. (See, Cal Civ. Code Sec. 1798.90.5(a)(3))

The collection and use of information or data through the use of an ALPR system (“ALPR information”) by ALPR operators and ALPR users is regulated by the law. (See, Cal Civ. Code Sec. 1798.90.5(b))

The law requires ALPR operators to restrict the use and ensure the security of ALPR information, provide certain disclosures through notices, and maintain records of access.

(a) Security ALPR information: An ALPR operator shall “maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards” to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

See, Cal. Civ. Code Sec. 1798.90.51 (a)

(b) Implement a usage and privacy policy: ALPR operators must implement a usage and privacy policy to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties.

  • The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.

At the minimum, the usage and privacy policy shall include the following:

  • The authorized purposes for using the ALPR system and collecting ALPR information.
  • A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
  • A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.
  • The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
  • The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.
  • A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
  • The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.

See, Cal. Civ. Code Sec. 1798.90.51 (b)

(c) Maintain records of access: If an ALPR operator accesses or provides access to ALPR information, the ALPR operator must maintain a record of that access. At a minimum, the record shall include:

  • The date and time the information is accessed.
  • The license plate number or other data elements used to query the ALPR system.
  • The username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.
  • The purpose for accessing the information.

See, Cal. Civ. Code Sec. 1798.90.52.(a)

(d) Limitations on use: If an ALPR operator accesses or provides access to ALPR information, the ALPR operator must require that the ALPR information only be used for the authorized purposes described in the usage and privacy policy.

See, Cal. Civ. Code Sec. 1798.90.52.(b)

(a) Security of ALPR information: ALPR end-users must “maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards,” to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

See, Cal. Civ. Code Sec. 1798.90.53 (a)

(b) Implement a usage and privacy policy: ALPR end-users must maintain a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties.

  • The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.

At the minimum, the usage and privacy policy shall include the following:

  • The authorized purposes for accessing and using ALPR information.
  • A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
  • A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.
  • The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
  • The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
  • A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
  • The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.

See, Cal. Civ. Code Sec. 1798.90.53 (b)

A public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program.

A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law.

  • The provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information.

See, Cal. Civ. Code Sec. 1798.90.55

In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation (including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system) may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm. The court may award a combination of any one or more of the following:

  • Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).
  • Punitive damages upon proof of willful or reckless disregard of the law.
  • Reasonable attorney’s fees and other litigation costs reasonably incurred.
  • Other preliminary and equitable relief as the court determines to be appropriate.

See. Cal. Civ. Code Sec. 1798.90.54

Tags
Show More
Back to top button
Close