Limits how long license plate data is kept

Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate reader technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law authorizes the department to share that data with law enforcement agencies for specified purposes and requires both an ALPR operator and an ALPR end-user, as those terms are defined, to implement a usage and privacy policy regarding that ALPR information, as specified. Existing law requires that the usage and privacy policy implemented by an ALPR operator or an ALPR end-user include the length of time ALPR information will be retained and the process the ALPR operator and ALPR end-user will utilize to determine if and when to destroy retained ALPR information.

This bill would prohibit those usage and privacy policies from including a length of time longer than 2 weeks that ALPR information will be retained and would require those usage and privacy policies to include the process utilized to determine if and when to destroy ALPR information retained for 2 weeks or less.

Existing law requires an ALPR operator to maintain reasonable security procedures and practices. Under existing law, the reasonable security procedures and practices must include operational, administrative, technical, and physical safeguards to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

This bill would additionally require those procedures and practices to include an annual audit to review ALPR end-user searches during the previous year and the destruction of all ALPR information retained for longer than 2 weeks.

Existing law requires an ALPR operator that accesses or provides access to ALPR information to maintain a record of that access and require that ALPR information only be used for the authorized purposes described in the usage and privacy policy.

This bill would additionally require an ALPR operator that accesses or provides access to ALPR information to conduct an annual audit to review ALPR end-user searches during the previous year and to confirm that all ALPR information retained for longer than 2 weeks has been routinely destroyed.

This bill would require the Department of Justice, on or before July 1, 2021, to draft and make available on its internet website a policy template and would permit local law enforcement agencies to use the template as a model for their ALPR policies. The bill would also require the Department of Justice to develop and issue guidance to help local law enforcement agencies identify and evaluate the types of data they are currently storing in their ALPR database systems.