| Old | New | Differences | |
|---|---|---|---|
| 1 | - | ||
| 1 | + | Amended IN Senate March 26, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Senate Bill No. 274Introduced by Senator CervantesFebruary 04, 2025An act to amend Sections 1798.90.51, 1798.90.53, and 1798.90.54 of, and to add Section 1798.90.56 to, the Civil Code, relating to personal information.LEGISLATIVE COUNSEL'S DIGESTSB 274, as amended, Cervantes. Automated license plate recognition systems.Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.This bill would state the intent of the Legislature to enact legislation that, among other things, imposes privacy protection requirements on cities, counties, and entities that use ALPR data. would, in compliance with specified laws, prohibit a public agency from entering into a contract to share ALPR information with a foreign jurisdiction or data broker, as defined, for immigration enforcement purposes, continuing any contract to share ALPR information with a foreign jurisdiction or data broker if the public agency knows that the ALPR information is being used for immigration enforcement purposes, using an ALPR system to gather geolocation data at specified locations for immigration enforcement purposes, and, if the public agency is a law enforcement agency, collecting or retaining ALPR information unless that information is related to a criminal investigation or to an individual suspected of a crime. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information. The bill would also require an ALPR operator or ALPR end user that is a law enforcement agency to establish a maximum data retention period for ALPR information.Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information.This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented that usage and privacy policy.The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NOYES Local Program: NOYES Bill TextThe people of the State of California do enact as follows:SECTION 1. This act shall be known as the Automated License Plate Recognition (ALPR) Data Accountability Act.SEC. 2. Section 1798.90.51 of the Civil Code is amended to read:1798.90.51. An ALPR operator shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for using the ALPR system and collecting ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR operator is a law enforcement agency, establish a maximum data retention period for ALPR information.SEC. 3. Section 1798.90.53 of the Civil Code is amended to read:1798.90.53. An ALPR end-user shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for accessing and using ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR end-user is a law enforcement agency, establish a maximum data retention period for ALPR information.SEC. 4. Section 1798.90.54 of the Civil Code is amended to read:1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with subdivision (b) of Section 1798.90.51 or subdivision (b) of Section 1798.90.53, as applicable.SEC. 5. Section 1798.90.56 is added to the Civil Code, immediately following Section 1798.90.55, to read:1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any of the following:(1) Enter into a contract to share ALPR information with a foreign jurisdiction for immigration enforcement purposes, or continue any contract to share ALPR information with a foreign jurisdiction if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(2) Enter into a contract to share ALPR information with a data broker, as defined in Section 1798.99.80, for immigration enforcement purposes, or continue any contract to share ALPR information with a data broker, as defined in Section 1798.99.80, if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(3) Use an ALPR system to gather geolocation data at public schools, public libraries, health facilities operated by the state or a political subdivision of the state, courthouses, facilities owned by the Division of Labor Standards Enforcement, the Agricultural Labor Relations Board, or the Division of Workers Compensation, and shelters for immigration enforcement purposes.(4) If the public agency is a law enforcement agency, collect or retain ALPR information, unless that ALPR information is related to a criminal investigation or to an individual suspected of a crime.(b) For purposes of this section, foreign jurisdiction means any other state, the District of Columbia, territories or possessions of the United States, and foreign states, provinces, or countries.SEC. 6. The Legislature finds and declares that Section 2 of this act amending Section 1798.90.51 of the Civil Code, Section 3 of this act amending Section 1798.90.53 of the Civil Code, and Section 5 of this act adding Section 1798.90.56 to the Civil Code, address a matter of statewide concern rather than a municipal affair as that term is used in Section 5 of Article XI of the California Constitution. Therefore, Sections 2, 3, and 5 of this act apply to all cities, including charter cities.SEC. 7. If the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code.SECTION 1.It is the intent of the Legislature to enact legislation that imposes privacy protection requirements on cities, counties, and entities that use automatic license plate recognition (ALPR) data and prohibit public agencies from selling or sharing ALPR information or information in collaboration with private contractors, fusion centers in California, for the purposes of the arrest, imprisonment, detainment, or deportation for immigration enforcement purposes. | |
| 2 | 2 | ||
| 3 | - | ||
| 3 | + | Amended IN Senate March 26, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Senate Bill No. 274Introduced by Senator CervantesFebruary 04, 2025An act to amend Sections 1798.90.51, 1798.90.53, and 1798.90.54 of, and to add Section 1798.90.56 to, the Civil Code, relating to personal information.LEGISLATIVE COUNSEL'S DIGESTSB 274, as amended, Cervantes. Automated license plate recognition systems.Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.This bill would state the intent of the Legislature to enact legislation that, among other things, imposes privacy protection requirements on cities, counties, and entities that use ALPR data. would, in compliance with specified laws, prohibit a public agency from entering into a contract to share ALPR information with a foreign jurisdiction or data broker, as defined, for immigration enforcement purposes, continuing any contract to share ALPR information with a foreign jurisdiction or data broker if the public agency knows that the ALPR information is being used for immigration enforcement purposes, using an ALPR system to gather geolocation data at specified locations for immigration enforcement purposes, and, if the public agency is a law enforcement agency, collecting or retaining ALPR information unless that information is related to a criminal investigation or to an individual suspected of a crime. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information. The bill would also require an ALPR operator or ALPR end user that is a law enforcement agency to establish a maximum data retention period for ALPR information.Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information.This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented that usage and privacy policy.The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NOYES Local Program: NOYES | |
| 4 | 4 | ||
| 5 | - | ||
| 5 | + | Amended IN Senate March 26, 2025 | |
| 6 | 6 | ||
| 7 | - | Amended IN Senate April 10, 2025 | |
| 8 | 7 | Amended IN Senate March 26, 2025 | |
| 9 | 8 | ||
| 10 | 9 | CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION | |
| 11 | 10 | ||
| 12 | 11 | Senate Bill | |
| 13 | 12 | ||
| 14 | 13 | No. 274 | |
| 15 | 14 | ||
| 16 | 15 | Introduced by Senator CervantesFebruary 04, 2025 | |
| 17 | 16 | ||
| 18 | 17 | Introduced by Senator Cervantes | |
| 19 | 18 | February 04, 2025 | |
| 20 | 19 | ||
| 21 | 20 | An act to amend Sections 1798.90.51, 1798.90.53, and 1798.90.54 of, and to add Section 1798.90.56 to, the Civil Code, relating to personal information. | |
| 22 | 21 | ||
| 23 | 22 | LEGISLATIVE COUNSEL'S DIGEST | |
| 24 | 23 | ||
| 25 | 24 | ## LEGISLATIVE COUNSEL'S DIGEST | |
| 26 | 25 | ||
| 27 | 26 | SB 274, as amended, Cervantes. Automated license plate recognition systems. | |
| 28 | 27 | ||
| 29 | - | Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.This bill would, in compliance with specified laws, prohibit a public agency from entering into a contract to share ALPR information with a foreign jurisdiction or data broker, as defined, for immigration enforcement purposes, continuing any contract to share ALPR information with a foreign jurisdiction or data broker if the public agency knows that the ALPR information is being used for immigration enforcement purposes, using an ALPR system to gather geolocation data at specified locations for immigration enforcement purposes, and, if the public agency is a law enforcement agency, collecting or | |
| 28 | + | Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.This bill would state the intent of the Legislature to enact legislation that, among other things, imposes privacy protection requirements on cities, counties, and entities that use ALPR data. would, in compliance with specified laws, prohibit a public agency from entering into a contract to share ALPR information with a foreign jurisdiction or data broker, as defined, for immigration enforcement purposes, continuing any contract to share ALPR information with a foreign jurisdiction or data broker if the public agency knows that the ALPR information is being used for immigration enforcement purposes, using an ALPR system to gather geolocation data at specified locations for immigration enforcement purposes, and, if the public agency is a law enforcement agency, collecting or retaining ALPR information unless that information is related to a criminal investigation or to an individual suspected of a crime. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information. The bill would also require an ALPR operator or ALPR end user that is a law enforcement agency to establish a maximum data retention period for ALPR information.Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information.This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented that usage and privacy policy.The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. | |
| 30 | 29 | ||
| 31 | 30 | Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system. | |
| 32 | 31 | ||
| 33 | - | This bill would, in compliance with specified laws, prohibit a public agency from entering into a contract to share ALPR information with a foreign jurisdiction or data broker, as defined, for immigration enforcement purposes, continuing any contract to share ALPR information with a foreign jurisdiction or data broker if the public agency knows that the ALPR information is being used for immigration enforcement purposes, using an ALPR system to gather geolocation data at specified locations for immigration enforcement purposes, and, if the public agency is a law enforcement agency, collecting or | |
| 32 | + | This bill would state the intent of the Legislature to enact legislation that, among other things, imposes privacy protection requirements on cities, counties, and entities that use ALPR data. would, in compliance with specified laws, prohibit a public agency from entering into a contract to share ALPR information with a foreign jurisdiction or data broker, as defined, for immigration enforcement purposes, continuing any contract to share ALPR information with a foreign jurisdiction or data broker if the public agency knows that the ALPR information is being used for immigration enforcement purposes, using an ALPR system to gather geolocation data at specified locations for immigration enforcement purposes, and, if the public agency is a law enforcement agency, collecting or retaining ALPR information unless that information is related to a criminal investigation or to an individual suspected of a crime. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program. | |
| 34 | 33 | ||
| 35 | 34 | Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. | |
| 36 | 35 | ||
| 37 | 36 | This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information. The bill would also require an ALPR operator or ALPR end user that is a law enforcement agency to establish a maximum data retention period for ALPR information. | |
| 38 | 37 | ||
| 39 | 38 | Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. | |
| 40 | 39 | ||
| 41 | - | This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to | |
| 40 | + | This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented that usage and privacy policy. | |
| 42 | 41 | ||
| 43 | 42 | The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities. | |
| 44 | 43 | ||
| 45 | 44 | The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. | |
| 46 | 45 | ||
| 47 | 46 | This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. | |
| 48 | 47 | ||
| 49 | 48 | ## Digest Key | |
| 50 | 49 | ||
| 51 | 50 | ## Bill Text | |
| 52 | 51 | ||
| 53 | - | The people of the State of California do enact as follows:SECTION 1. This act shall be known as the Automated License Plate Recognition (ALPR) Data Accountability Act.SEC. 2. Section 1798.90.51 of the Civil Code is amended to read:1798.90.51. An ALPR operator shall do all | |
| 52 | + | The people of the State of California do enact as follows:SECTION 1. This act shall be known as the Automated License Plate Recognition (ALPR) Data Accountability Act.SEC. 2. Section 1798.90.51 of the Civil Code is amended to read:1798.90.51. An ALPR operator shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for using the ALPR system and collecting ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR operator is a law enforcement agency, establish a maximum data retention period for ALPR information.SEC. 3. Section 1798.90.53 of the Civil Code is amended to read:1798.90.53. An ALPR end-user shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for accessing and using ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR end-user is a law enforcement agency, establish a maximum data retention period for ALPR information.SEC. 4. Section 1798.90.54 of the Civil Code is amended to read:1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with subdivision (b) of Section 1798.90.51 or subdivision (b) of Section 1798.90.53, as applicable.SEC. 5. Section 1798.90.56 is added to the Civil Code, immediately following Section 1798.90.55, to read:1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any of the following:(1) Enter into a contract to share ALPR information with a foreign jurisdiction for immigration enforcement purposes, or continue any contract to share ALPR information with a foreign jurisdiction if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(2) Enter into a contract to share ALPR information with a data broker, as defined in Section 1798.99.80, for immigration enforcement purposes, or continue any contract to share ALPR information with a data broker, as defined in Section 1798.99.80, if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(3) Use an ALPR system to gather geolocation data at public schools, public libraries, health facilities operated by the state or a political subdivision of the state, courthouses, facilities owned by the Division of Labor Standards Enforcement, the Agricultural Labor Relations Board, or the Division of Workers Compensation, and shelters for immigration enforcement purposes.(4) If the public agency is a law enforcement agency, collect or retain ALPR information, unless that ALPR information is related to a criminal investigation or to an individual suspected of a crime.(b) For purposes of this section, foreign jurisdiction means any other state, the District of Columbia, territories or possessions of the United States, and foreign states, provinces, or countries.SEC. 6. The Legislature finds and declares that Section 2 of this act amending Section 1798.90.51 of the Civil Code, Section 3 of this act amending Section 1798.90.53 of the Civil Code, and Section 5 of this act adding Section 1798.90.56 to the Civil Code, address a matter of statewide concern rather than a municipal affair as that term is used in Section 5 of Article XI of the California Constitution. Therefore, Sections 2, 3, and 5 of this act apply to all cities, including charter cities.SEC. 7. If the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code.SECTION 1.It is the intent of the Legislature to enact legislation that imposes privacy protection requirements on cities, counties, and entities that use automatic license plate recognition (ALPR) data and prohibit public agencies from selling or sharing ALPR information or information in collaboration with private contractors, fusion centers in California, for the purposes of the arrest, imprisonment, detainment, or deportation for immigration enforcement purposes. | |
| 54 | 53 | ||
| 55 | 54 | The people of the State of California do enact as follows: | |
| 56 | 55 | ||
| 57 | 56 | ## The people of the State of California do enact as follows: | |
| 58 | 57 | ||
| 59 | 58 | SECTION 1. This act shall be known as the Automated License Plate Recognition (ALPR) Data Accountability Act. | |
| 60 | 59 | ||
| 61 | 60 | SECTION 1. This act shall be known as the Automated License Plate Recognition (ALPR) Data Accountability Act. | |
| 62 | 61 | ||
| 63 | 62 | SECTION 1. This act shall be known as the Automated License Plate Recognition (ALPR) Data Accountability Act. | |
| 64 | 63 | ||
| 65 | 64 | ### SECTION 1. | |
| 66 | 65 | ||
| 67 | - | SEC. 2. Section 1798.90.51 of the Civil Code is amended to read:1798.90.51. An ALPR operator shall do all | |
| 66 | + | SEC. 2. Section 1798.90.51 of the Civil Code is amended to read:1798.90.51. An ALPR operator shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for using the ALPR system and collecting ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR operator is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 68 | 67 | ||
| 69 | 68 | SEC. 2. Section 1798.90.51 of the Civil Code is amended to read: | |
| 70 | 69 | ||
| 71 | 70 | ### SEC. 2. | |
| 72 | 71 | ||
| 73 | - | 1798.90.51. An ALPR operator shall do all | |
| 72 | + | 1798.90.51. An ALPR operator shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for using the ALPR system and collecting ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR operator is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 74 | 73 | ||
| 75 | - | 1798.90.51. An ALPR operator shall do all | |
| 74 | + | 1798.90.51. An ALPR operator shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for using the ALPR system and collecting ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR operator is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 76 | 75 | ||
| 77 | - | 1798.90.51. An ALPR operator shall do all | |
| 76 | + | 1798.90.51. An ALPR operator shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for using the ALPR system and collecting ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR operator is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 78 | 77 | ||
| 79 | 78 | ||
| 80 | 79 | ||
| 81 | - | 1798.90.51. An ALPR operator shall do all | |
| 80 | + | 1798.90.51. An ALPR operator shall do all of the following: | |
| 82 | 81 | ||
| 83 | - | (a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure, including the following: | |
| 82 | + | (a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following: | |
| 84 | 83 | ||
| 85 | 84 | (1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees. | |
| 86 | 85 | ||
| 87 | 86 | (2) Requiring data security training and data privacy training for all employees that access ALPR information. | |
| 88 | 87 | ||
| 89 | - | (b) (1) Implement a usage and privacy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an internet website, the usage and privacy policy shall be posted conspicuously on that internet website. | |
| 88 | + | (b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website. | |
| 90 | 89 | ||
| 91 | 90 | (2) The usage and privacy policy shall, at a minimum, include all of the following: | |
| 92 | 91 | ||
| 93 | 92 | (A) The authorized purposes for using the ALPR system and collecting ALPR information. | |
| 94 | 93 | ||
| 95 | - | (B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors. | |
| 94 | + | (B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors. | |
| 96 | 95 | ||
| 97 | 96 | (C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws. | |
| 98 | 97 | ||
| 99 | 98 | (D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons. | |
| 100 | 99 | ||
| 101 | 100 | (E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section. | |
| 102 | 101 | ||
| 103 | 102 | (F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors. | |
| 104 | 103 | ||
| 105 | 104 | (G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information. | |
| 106 | 105 | ||
| 107 | 106 | (c) If the ALPR operator is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 108 | 107 | ||
| 109 | - | ||
| 110 | - | ||
| 111 | - | SEC. 3. Section 1798.90.53 of the Civil Code is amended to read:1798.90.53. An ALPR end-user shall do all both of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an internet website, the usage and privacy policy shall be posted conspicuously on that internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for accessing and using ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.(c)If the ALPR end-user is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 108 | + | SEC. 3. Section 1798.90.53 of the Civil Code is amended to read:1798.90.53. An ALPR end-user shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for accessing and using ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR end-user is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 112 | 109 | ||
| 113 | 110 | SEC. 3. Section 1798.90.53 of the Civil Code is amended to read: | |
| 114 | 111 | ||
| 115 | 112 | ### SEC. 3. | |
| 116 | 113 | ||
| 117 | - | 1798.90.53. An ALPR end-user shall do all | |
| 114 | + | 1798.90.53. An ALPR end-user shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for accessing and using ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR end-user is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 118 | 115 | ||
| 119 | - | 1798.90.53. An ALPR end-user shall do all | |
| 116 | + | 1798.90.53. An ALPR end-user shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for accessing and using ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR end-user is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 120 | 117 | ||
| 121 | - | 1798.90.53. An ALPR end-user shall do all | |
| 118 | + | 1798.90.53. An ALPR end-user shall do all of the following:(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following:(1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.(2) Requiring data security training and data privacy training for all employees that access ALPR information.(b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website.(2) The usage and privacy policy shall, at a minimum, include all of the following:(A) The authorized purposes for accessing and using ALPR information.(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.(G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.(c) If the ALPR end-user is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 122 | 119 | ||
| 123 | 120 | ||
| 124 | 121 | ||
| 125 | - | 1798.90.53. An ALPR end-user shall do all | |
| 122 | + | 1798.90.53. An ALPR end-user shall do all of the following: | |
| 126 | 123 | ||
| 127 | - | (a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure, including the following: | |
| 124 | + | (a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. disclosure, including the following: | |
| 128 | 125 | ||
| 129 | 126 | (1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees. | |
| 130 | 127 | ||
| 131 | 128 | (2) Requiring data security training and data privacy training for all employees that access ALPR information. | |
| 132 | 129 | ||
| 133 | - | (b) (1) Implement a usage and privacy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an internet website, the usage and privacy policy shall be posted conspicuously on that internet website. | |
| 130 | + | (b) (1) Implement a usage and privacy policy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, internet website, the usage and privacy policy shall be posted conspicuously on that Internet Web site. internet website. | |
| 134 | 131 | ||
| 135 | 132 | (2) The usage and privacy policy shall, at a minimum, include all of the following: | |
| 136 | 133 | ||
| 137 | 134 | (A) The authorized purposes for accessing and using ALPR information. | |
| 138 | 135 | ||
| 139 | - | (B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors. | |
| 136 | + | (B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. information, and for what purpose. The policy shall identify the training requirements necessary for those authorized employees and independent contractors. | |
| 140 | 137 | ||
| 141 | 138 | (C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits. | |
| 142 | 139 | ||
| 143 | 140 | (D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons. | |
| 144 | 141 | ||
| 145 | 142 | (E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section. | |
| 146 | 143 | ||
| 147 | 144 | (F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors. | |
| 148 | 145 | ||
| 149 | 146 | (G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information. | |
| 150 | 147 | ||
| 151 | 148 | (c) If the ALPR end-user is a law enforcement agency, establish a maximum data retention period for ALPR information. | |
| 152 | 149 | ||
| 153 | - | ||
| 154 | - | ||
| 155 | - | SEC. 4. Section 1798.90.54 of the Civil Code is amended to read:1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall annually audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with subdivision (b) of Section 1798.90.51 or subdivision (b) of Section 1798.90.53, as applicable. | |
| 150 | + | SEC. 4. Section 1798.90.54 of the Civil Code is amended to read:1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with subdivision (b) of Section 1798.90.51 or subdivision (b) of Section 1798.90.53, as applicable. | |
| 156 | 151 | ||
| 157 | 152 | SEC. 4. Section 1798.90.54 of the Civil Code is amended to read: | |
| 158 | 153 | ||
| 159 | 154 | ### SEC. 4. | |
| 160 | 155 | ||
| 161 | - | 1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall | |
| 156 | + | 1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with subdivision (b) of Section 1798.90.51 or subdivision (b) of Section 1798.90.53, as applicable. | |
| 162 | 157 | ||
| 163 | - | 1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall | |
| 158 | + | 1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with subdivision (b) of Section 1798.90.51 or subdivision (b) of Section 1798.90.53, as applicable. | |
| 164 | 159 | ||
| 165 | - | 1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall | |
| 160 | + | 1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.(b) The court may award a combination of any one or more of the following:(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).(2) Punitive damages upon proof of willful or reckless disregard of the law.(3) Reasonable attorneys fees and other litigation costs reasonably incurred.(4) Other preliminary and equitable relief as the court determines to be appropriate.(c) The Department of Justice shall audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with subdivision (b) of Section 1798.90.51 or subdivision (b) of Section 1798.90.53, as applicable. | |
| 166 | 161 | ||
| 167 | 162 | ||
| 168 | 163 | ||
| 169 | 164 | 1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm. | |
| 170 | 165 | ||
| 171 | 166 | (b) The court may award a combination of any one or more of the following: | |
| 172 | 167 | ||
| 173 | 168 | (1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500). | |
| 174 | 169 | ||
| 175 | 170 | (2) Punitive damages upon proof of willful or reckless disregard of the law. | |
| 176 | 171 | ||
| 177 | 172 | (3) Reasonable attorneys fees and other litigation costs reasonably incurred. | |
| 178 | 173 | ||
| 179 | 174 | (4) Other preliminary and equitable relief as the court determines to be appropriate. | |
| 180 | 175 | ||
| 181 | - | (c) The Department of Justice shall | |
| 176 | + | (c) The Department of Justice shall audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with subdivision (b) of Section 1798.90.51 or subdivision (b) of Section 1798.90.53, as applicable. | |
| 182 | 177 | ||
| 183 | - | SEC. 5. Section 1798.90.56 is added to the Civil Code, immediately following Section 1798.90.55, to read:1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any | |
| 178 | + | SEC. 5. Section 1798.90.56 is added to the Civil Code, immediately following Section 1798.90.55, to read:1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any of the following:(1) Enter into a contract to share ALPR information with a foreign jurisdiction for immigration enforcement purposes, or continue any contract to share ALPR information with a foreign jurisdiction if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(2) Enter into a contract to share ALPR information with a data broker, as defined in Section 1798.99.80, for immigration enforcement purposes, or continue any contract to share ALPR information with a data broker, as defined in Section 1798.99.80, if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(3) Use an ALPR system to gather geolocation data at public schools, public libraries, health facilities operated by the state or a political subdivision of the state, courthouses, facilities owned by the Division of Labor Standards Enforcement, the Agricultural Labor Relations Board, or the Division of Workers Compensation, and shelters for immigration enforcement purposes.(4) If the public agency is a law enforcement agency, collect or retain ALPR information, unless that ALPR information is related to a criminal investigation or to an individual suspected of a crime.(b) For purposes of this section, foreign jurisdiction means any other state, the District of Columbia, territories or possessions of the United States, and foreign states, provinces, or countries. | |
| 184 | 179 | ||
| 185 | 180 | SEC. 5. Section 1798.90.56 is added to the Civil Code, immediately following Section 1798.90.55, to read: | |
| 186 | 181 | ||
| 187 | 182 | ### SEC. 5. | |
| 188 | 183 | ||
| 189 | - | 1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any | |
| 184 | + | 1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any of the following:(1) Enter into a contract to share ALPR information with a foreign jurisdiction for immigration enforcement purposes, or continue any contract to share ALPR information with a foreign jurisdiction if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(2) Enter into a contract to share ALPR information with a data broker, as defined in Section 1798.99.80, for immigration enforcement purposes, or continue any contract to share ALPR information with a data broker, as defined in Section 1798.99.80, if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(3) Use an ALPR system to gather geolocation data at public schools, public libraries, health facilities operated by the state or a political subdivision of the state, courthouses, facilities owned by the Division of Labor Standards Enforcement, the Agricultural Labor Relations Board, or the Division of Workers Compensation, and shelters for immigration enforcement purposes.(4) If the public agency is a law enforcement agency, collect or retain ALPR information, unless that ALPR information is related to a criminal investigation or to an individual suspected of a crime.(b) For purposes of this section, foreign jurisdiction means any other state, the District of Columbia, territories or possessions of the United States, and foreign states, provinces, or countries. | |
| 190 | 185 | ||
| 191 | - | 1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any | |
| 186 | + | 1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any of the following:(1) Enter into a contract to share ALPR information with a foreign jurisdiction for immigration enforcement purposes, or continue any contract to share ALPR information with a foreign jurisdiction if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(2) Enter into a contract to share ALPR information with a data broker, as defined in Section 1798.99.80, for immigration enforcement purposes, or continue any contract to share ALPR information with a data broker, as defined in Section 1798.99.80, if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(3) Use an ALPR system to gather geolocation data at public schools, public libraries, health facilities operated by the state or a political subdivision of the state, courthouses, facilities owned by the Division of Labor Standards Enforcement, the Agricultural Labor Relations Board, or the Division of Workers Compensation, and shelters for immigration enforcement purposes.(4) If the public agency is a law enforcement agency, collect or retain ALPR information, unless that ALPR information is related to a criminal investigation or to an individual suspected of a crime.(b) For purposes of this section, foreign jurisdiction means any other state, the District of Columbia, territories or possessions of the United States, and foreign states, provinces, or countries. | |
| 192 | 187 | ||
| 193 | - | 1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any | |
| 188 | + | 1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any of the following:(1) Enter into a contract to share ALPR information with a foreign jurisdiction for immigration enforcement purposes, or continue any contract to share ALPR information with a foreign jurisdiction if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(2) Enter into a contract to share ALPR information with a data broker, as defined in Section 1798.99.80, for immigration enforcement purposes, or continue any contract to share ALPR information with a data broker, as defined in Section 1798.99.80, if the public agency knows that the ALPR information is being used for immigration enforcement purposes.(3) Use an ALPR system to gather geolocation data at public schools, public libraries, health facilities operated by the state or a political subdivision of the state, courthouses, facilities owned by the Division of Labor Standards Enforcement, the Agricultural Labor Relations Board, or the Division of Workers Compensation, and shelters for immigration enforcement purposes.(4) If the public agency is a law enforcement agency, collect or retain ALPR information, unless that ALPR information is related to a criminal investigation or to an individual suspected of a crime.(b) For purposes of this section, foreign jurisdiction means any other state, the District of Columbia, territories or possessions of the United States, and foreign states, provinces, or countries. | |
| 194 | 189 | ||
| 195 | 190 | ||
| 196 | 191 | ||
| 197 | - | 1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any | |
| 192 | + | 1798.90.56. (a) In accordance with Chapter 17.1 (commencing with Section 7282) and Chapter 17.25 (commencing with Section 7284) of Division 7 of Title 1 of the Government Code, a public agency shall not do any of the following: | |
| 198 | 193 | ||
| 199 | 194 | (1) Enter into a contract to share ALPR information with a foreign jurisdiction for immigration enforcement purposes, or continue any contract to share ALPR information with a foreign jurisdiction if the public agency knows that the ALPR information is being used for immigration enforcement purposes. | |
| 200 | 195 | ||
| 201 | - | ||
| 202 | - | ||
| 203 | 196 | (2) Enter into a contract to share ALPR information with a data broker, as defined in Section 1798.99.80, for immigration enforcement purposes, or continue any contract to share ALPR information with a data broker, as defined in Section 1798.99.80, if the public agency knows that the ALPR information is being used for immigration enforcement purposes. | |
| 204 | 197 | ||
| 205 | - | ||
| 206 | - | ||
| 207 | - | (3) | |
| 208 | - | ||
| 209 | - | ||
| 210 | - | ||
| 211 | - | (1) Use an ALPR system to gather geolocation data at public schools, public libraries, health facilities operated by the state or a political subdivision of the state, courthouses, facilities owned by the Division of Labor Standards Enforcement, the Agricultural Labor Relations Board, or the Division of Workers Compensation, and shelters for immigration enforcement purposes. | |
| 198 | + | (3) Use an ALPR system to gather geolocation data at public schools, public libraries, health facilities operated by the state or a political subdivision of the state, courthouses, facilities owned by the Division of Labor Standards Enforcement, the Agricultural Labor Relations Board, or the Division of Workers Compensation, and shelters for immigration enforcement purposes. | |
| 212 | 199 | ||
| 213 | 200 | (4) If the public agency is a law enforcement agency, collect or retain ALPR information, unless that ALPR information is related to a criminal investigation or to an individual suspected of a crime. | |
| 214 | - | ||
| 215 | - | ||
| 216 | - | ||
| 217 | - | (2) Retain ALPR information for more than 30 days, except in circumstances when the data is being used as evidence or for all felonies being investigated, including, but not limited to, auto theft, homicides, kidnapping, burglaries, elder and juvenile abductions, Amber Alerts, Blue Alerts, and Feather Alerts. | |
| 218 | 201 | ||
| 219 | 202 | (b) For purposes of this section, foreign jurisdiction means any other state, the District of Columbia, territories or possessions of the United States, and foreign states, provinces, or countries. | |
| 220 | 203 | ||
| 221 | 204 | SEC. 6. The Legislature finds and declares that Section 2 of this act amending Section 1798.90.51 of the Civil Code, Section 3 of this act amending Section 1798.90.53 of the Civil Code, and Section 5 of this act adding Section 1798.90.56 to the Civil Code, address a matter of statewide concern rather than a municipal affair as that term is used in Section 5 of Article XI of the California Constitution. Therefore, Sections 2, 3, and 5 of this act apply to all cities, including charter cities. | |
| 222 | 205 | ||
| 223 | 206 | SEC. 6. The Legislature finds and declares that Section 2 of this act amending Section 1798.90.51 of the Civil Code, Section 3 of this act amending Section 1798.90.53 of the Civil Code, and Section 5 of this act adding Section 1798.90.56 to the Civil Code, address a matter of statewide concern rather than a municipal affair as that term is used in Section 5 of Article XI of the California Constitution. Therefore, Sections 2, 3, and 5 of this act apply to all cities, including charter cities. | |
| 224 | 207 | ||
| 225 | 208 | SEC. 6. The Legislature finds and declares that Section 2 of this act amending Section 1798.90.51 of the Civil Code, Section 3 of this act amending Section 1798.90.53 of the Civil Code, and Section 5 of this act adding Section 1798.90.56 to the Civil Code, address a matter of statewide concern rather than a municipal affair as that term is used in Section 5 of Article XI of the California Constitution. Therefore, Sections 2, 3, and 5 of this act apply to all cities, including charter cities. | |
| 226 | 209 | ||
| 227 | 210 | ### SEC. 6. | |
| 228 | 211 | ||
| 229 | 212 | SEC. 7. If the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code. | |
| 230 | 213 | ||
| 231 | 214 | SEC. 7. If the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code. | |
| 232 | 215 | ||
| 233 | 216 | SEC. 7. If the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code. | |
| 234 | 217 | ||
| 235 | 218 | ### SEC. 7. | |
| 219 | + | ||
| 220 | + | ||
| 221 | + | ||
| 222 | + | It is the intent of the Legislature to enact legislation that imposes privacy protection requirements on cities, counties, and entities that use automatic license plate recognition (ALPR) data and prohibit public agencies from selling or sharing ALPR information or information in collaboration with private contractors, fusion centers in California, for the purposes of the arrest, imprisonment, detainment, or deportation for immigration enforcement purposes. |