Automated License Plate Reader Accountability and Privacy Protection Act

Model Policy

1. Section 1. Definitions. For Purposes of this Section:
   • (a) “Automated license plate recognition system” means a system of one or more mobile or fixed cameras combined with computer algorithms or other technology capable of converting images of license plates into computer-readable data.
   • (b) “Automated license plate recognition data” means an image, license plate number, date, time, location, vehicle characteristic, or other information collected or generated by an automated license plate recognition system.
   • (c) “Historical search” means a search, query, analysis, or other examination of automated license plate recognition data previously collected and stored by an automated license plate recognition system.
   • (d) “Law enforcement agency” means an agency that has as its primary mission the prevention and detection of crime and enforcement of the penal, criminal, traffic, and motor vehicle laws of this state and employs law enforcement officers.
   • (e) “Investigative order” means an order issued by a judge pursuant to subsection (3).
   • (f) “Derived data” means information, inference, profile, identifier, association, prediction, or analytical result created or inferred from automated license plate recognition data, whether generated by a person, algorithm, artificial intelligence system, or other automated process.
   • (g) “Vehicle fingerprint” means an identifier or profile generated from the visual appearance or characteristics of a motor vehicle, including make, model, color, damage, modifications, decals, accessories, cargo, or other distinguishing characteristics, whether or not a license plate number is visible or identified.
   • (h) “Hot list” means a list, database, alert, or other designation used by an automated license plate recognition system to generate a notification when a specified license plate or vehicle is detected.
   • (i) “Provider” means a person or entity that owns, operates, hosts, maintains, supplies, or provides access to an automated license plate recognition system or automated license plate recognition data on behalf of, under contract with, or for use by a law enforcement agency.
   • (j) “Search” or “query” includes any manual or automated request, filter, analysis, comparison, lookup, or other operation performed against stored automated license plate recognition data or derived data.
2. Judicial Authorization Required. Except as otherwise provided in this section, a law enforcement agency may not conduct a historical search of automated license plate recognition data unless the search is authorized by:
   • (a) A search warrant issued upon probable cause; or
   • (b) An investigative order issued pursuant to subsection (3).
3. Investigative Order.
   • (a) A judge may issue an investigative order authorizing a narrowly tailored historical search upon a sworn application establishing specific and articulable facts giving reasonable grounds to believe that:
     1. A felony, violent misdemeanor, or offense involving a missing or endangered person has occurred, is occurring, or is about to occur;
     2. The requested information is relevant and material to the investigation; and
     3. The requested search is reasonably limited by time, geographic area, license plate information, vehicle description, direction of travel, or other objective criteria reasonably related to the investigation.
   • (b) An investigative order may authorize a search intended to identify an unknown vehicle associated with an offense, including a search using:
     1. A partial license plate number;
     2. Vehicle make, model, or color;
     3. A distinguishing characteristic of a vehicle;
     4. A specified geographic area;
     5. A specified period of time; or
     6. Other objective vehicle characteristics reasonably related to the investigation.
   • (c) An investigative order may not authorize a search whose purpose is to determine or reconstruct the historical movements, locations, associations, or pattern of travel of a known person or known vehicle as described in subsection 4. Such a search requires a search warrant supported by probable cause.
   • (d) An application and order under this subsection may be submitted, reviewed, signed, and transmitted electronically in the same manner authorized by law for search warrants.
4. Known Person or Vehicle. A law enforcement agency seeking historical automated license plate recognition data, for the purpose of determining or reconstructing the locations, movements, associations, or pattern of travel of a known person or known vehicle must obtain a search warrant based upon probable cause.
5. Exemptions. Judicial authorization is not required:
   • (a) To receive or act upon a real-time or critical alert concerning:
     1. A stolen vehicle or stolen license plate;
     2. A person for whom an arrest warrant is outstanding;
     3. An AMBER Alert, Silver Alert, Purple Alert, or other state or federally authorized public safety alert;
     4. A missing, kidnapped, or endangered person; or
     5. A vehicle entered into a law enforcement hot list based upon a specific and documented lawful law enforcement purpose.
   • (b) When a law enforcement officer reasonably believes that immediate access is necessary to prevent imminent death or serious bodily injury, locate a kidnapped or missing endangered person, apprehend a fleeing suspect who poses an imminent threat to the public, or respond to another exigent circumstance recognized by law.
   • (c) To access information concerning a vehicle owned, leased, or operated by the requesting law enforcement agency.
   • (d) When the registered owner or lawful operator of the vehicle voluntarily consents to the search. An agency relying upon paragraph (b) shall document the facts supporting emergency access and the searches performed. Such documentation must be reviewed by a shift commander or higher-ranking officer as soon as practicable.
6. Hot Lists and Real-Time Alerts.
   • (a) A law enforcement agency may enter, maintain, or cause a license plate or vehicle to be entered into a hot list only when the agency has a specific and documented lawful law enforcement purpose.
   • (b) Each hot-list entry must identify:
     1. The law enforcement agency responsible for the entry;
     2. The officer or authorized user making or requesting the entry;
     3. The case, incident, warrant, alert, or investigation number associated with the entry;
     4. The lawful basis and purpose for the entry;
     5. The date and time the entry was made; and
     6. The date upon which the entry expires or must be reviewed
   • (c) A hot-list entry may not be based solely upon a person’s political, religious, journalistic, expressive, or associational activity protected by the United States Constitution or the State Constitution.
   • (d) A hot-list entry must be removed promptly when the lawful basis for the entry no longer exists.
   • (e) Except for an entry associated with an active arrest warrant, stolen vehicle or stolen license plate, missing or endangered person, or state or federally authorized public safety alert, a hot-list entry must expire no later than 30 days after entry unless an authorized law enforcement officer documents a continuing lawful basis for renewal. Each renewal may not exceed 30 days.
   • (f) A law enforcement agency may not use a hot list or real-time alert functionality for the purpose of circumventing the judicial authorization required for historical or prospective tracking under this section.
7. Prospective Tracking.
   • (a) Except as otherwise provided in subsection (5), a law enforcement agency may not establish or use an automated alert, persistent query, watch, notification, or other automated process designed to identify the future locations or movements of a known person or known vehicle over time unless authorized by a search warrant based upon probable cause.
   • (b) A warrant issued under this subsection must specify the person, vehicle, or license plate to be monitored and the period for which monitoring is authorized.
   • (c) Nothing in this subsection prohibits a real-time or critical alert authorized under subsection (5) or a hot-list entry maintained in accordance with subsection (6).
8. Mass, Reverse, and Association Searches.
   • (a) Except pursuant to a search warrant or an investigative order satisfying the requirements of subsection (3), a law enforcement agency may not use automated license plate recognition data to:
     1. Identify all or substantially all vehicles present within a specified geographic area during a specified period;
     2. Identify vehicles present at multiple specified locations or events;
     3. Identify vehicles that traveled with, followed, preceded, or were repeatedly located near another vehicle;
     4. Determine associations or relationships among persons or vehicles;
     5. Identify vehicles based primarily upon presence at a place associated with constitutionally protected political, religious, journalistic, expressive, or associational activity; or
     6. Conduct a bulk export or bulk analysis of automated license plate recognition data.
   • (b) An investigative order authorizing a search under this subsection must describe with particularity the geographic area, period, vehicle characteristics, or other objective criteria to be searched and must be narrowly tailored to the investigation.
   • (c) A search whose purpose is to determine or reconstruct the historical movements, locations, associations, or pattern of travel of a known person or known vehicle requires a search warrant based upon probable cause.
9. Automated Analysis and Derived Data.
   • (a) The requirements and limitations of this section apply to derived data and vehicle fingerprints to the same extent that they apply to automated license plate recognition data.
   • (b) A law enforcement agency or provider may not use automated license plate recognition data to create or maintain a persistent profile of a person’s movements, associations, habits, activities, or pattern of life except pursuant to a search warrant based upon probable cause.
   • (c) A provider may not use automated license plate recognition data or derived data to train, test, validate, or improve an artificial intelligence or machine-learning model except as necessary to provide the automated license plate recognition functionality contracted for by the law enforcement agency and only using data in compliance with this section.
   • (d) Automated license plate recognition data may not be combined with facial recognition data, biometric data, commercial location data, or other personally identifiable tracking data for the purpose of identifying or tracking a person except pursuant to a search warrant or as otherwise expressly authorized by law.
10. Private Systems and Privately Collected Data.
    • (a) The requirements and limitations of this section apply to automated license plate recognition data obtained, accessed, searched, requested, or received by a law enforcement agency regardless of whether the data was originally collected by:
      1. A law enforcement agency;
      2. Another governmental entity;
      3. A private property owner;
      4. A homeowners’ association or community association;
      5. A business or other private entity;
      6. A provider of automated license plate recognition services; or
      7. Any other person or entity.
    • (b) A law enforcement agency may not obtain, search, access, request, or receive privately collected automated license plate recognition data under circumstances in which the agency would be prohibited from obtaining, searching, or accessing substantially equivalent data maintained by the agency itself.
    • (c) A private entity’s voluntary agreement to provide a law enforcement agency direct, standing, blanket, unrestricted, or automatic access to historical automated license plate recognition data does not exempt the agency from the requirements of this section
    • (d) Nothing in this subsection prohibits a private person from voluntarily providing law enforcement with information concerning a specific crime, suspicious incident, emergency, or other event personally known to or observed by that person.
11. Governmental Deployment of Automated License Plate Recognition Systems.
    • (a) Except for a temporary deployment associated with a specific criminal investigation, emergency, special event, or public safety operation, a county, municipality, special district, or law enforcement agency may not install or operate a fixed automated license plate recognition system on public property or within a public right-of-way unless the deployment has been approved at a publicly noticed meeting by the governing body having jurisdiction over the property or right-of-way.
      (b) Before approval, the law enforcement agency requesting deployment shall disclose:
      1. The general number and proposed locations of the systems;
      2. The law enforcement purpose for the deployment;
      3. The provider, if any;
      4. The anticipated annual cost;
      5. The applicable data retention period; and
      6. The agency’s policies governing access, sharing, auditing, and security.
    • (c) Approval under this subsection does not require disclosure of information that would compromise the location of a covert investigative device, an active criminal investigation, or law-enforcement-sensitive security information.
    • (d) Temporary deployment under paragraph (a) may not exceed 30 days unless extended for an additional 30-day period upon written approval of the head of the law enforcement agency or his or her designee. Continued permanent deployment requires approval under paragraph (a).
    • (e) Nothing in this subsection supersedes the authority of the Department of Transportation concerning installation of an automated license plate recognition system within the right-of-way of the State Highway System.
12. Interagency Access and Disclosures.
    • (a) A law enforcement agency may not disclose automated license plate recognition data to another agency, provide another agency access to such data, or permit another agency to search an automated license plate recognition system under its control unless:
      1. The request relates to a specific and documented law enforcement investigation or other purpose expressly authorized by this section;
      2. The requested access or disclosure complies with the warrant, investigative order, or exception requirements of this section; and
      3. The request is approved by a shift commander or higher-ranking officer of the agency providing the information or access.
    • (b) Approval under paragraph (a) must be documented and must identify:
      1. The requesting agency;
      2. The requesting officer or authorized user;
      3. The approving officer;
      4. The applicable case, incident, or investigation number;
      5. The purpose of the request;
      6. The legal authority for the search or disclosure; and
      7. The date and time of approval.
    • (c) A law enforcement agency may not provide another agency standing, blanket, unrestricted, or automatic access to its historical automated license plate recognition data.
    • (d) An agency receiving automated license plate recognition data may not further disclose the data or provide another agency access to the data except in compliance with this subsection.
    • (e) This subsection does not prohibit immediate interagency access or disclosure when reasonably necessary to prevent imminent death or serious bodily injury, locate a kidnapped or missing endangered person, apprehend a fleeing suspect who poses an imminent threat to the public, or respond to another exigent circumstance recognized by law. Any disclosure or access under this paragraph must be documented and reviewed by a shift commander or higher-ranking officer as soon as practicable.
    • (f) For purposes of this subsection, disclosure or access to automated license plate recognition data by a federal agency, an agency of another state or political subdivision thereof, a multijurisdictional task force, fusion center, contractor, private entity, or other third party constitutes an interagency disclosure and is subject to the requirements and limitations of this section.
    • (g) A law enforcement agency of this state may not disclose or provide access to automated license plate recognition data if the requesting entity seeks the information for a purpose for which a law enforcement agency of this state would be prohibited from obtaining, searching, or using the information under this section.
13. Audit and Accountability.
    • (a) An automated license plate recognition system must automatically generate a tamper-resistant electronic audit record for each:
      1. Search or query;
      2. Access or viewing of stored data;
      3. Addition, modification, renewal, or removal of a hot-list entry;
      4. Export, download, or copying of data;
      5. Disclosure or transmission of data to another person, agency, or entity;
      6. Administrative access to the system; and
      7. Attempted access denied because the user lacked authorization.
    • (b) Each audit record must contain, to the extent applicable:
      1. The identity and unique user identifier of the person accessing the system;
      2. The employing or requesting agency;
      3. The date and time of the activity;
      4. The case, incident, or investigation number;
      5. The stated purpose of the activity;
      6. The warrant, investigative order, consent, emergency, or other legal authority relied upon;
      7. The search criteria used;
      8. The nature of any data accessed, exported, or disclosed;
      9. The identity of any recipient of exported or disclosed data; and
      10. The identity of any supervisory officer whose approval was required.
    • (c) Audit records must be protected against alteration or deletion by ordinary system users.
    • (d) Audit records must be retained for not less than 5 years notwithstanding deletion of the underlying automated license plate recognition data.
    • (e) Each law enforcement agency using an automated license plate recognition system shall establish procedures for periodic supervisory review of audit records and investigation of suspected unauthorized access or use.
    • (f) A provider may not disable, alter, conceal, or permit a user to circumvent the audit requirements of this subsection.
    • (g) The Department of Law Enforcement shall conduct audits of any agency with access to driver, vehicle, or license plate information, including information accessed through automated license plate recognition systems or other comparable systems. Such audits shall ensure compliance with applicable privacy protections, access restrictions, and requirements governing the use and disclosure of personal information. Such audits must be conducted every two years and include a review of access and usage records of supervisory personnel and higher-ranking officials of any agency with access to such systems from the preceding two years. Audits shall be conducted by each state’s police agency or equivalent highest law enforcement agency.
14. Annual Transparency Report.
    • (a) On or before March 1 of each year, each law enforcement agency operating or accessing an automated license plate recognition system shall publish on its website a report concerning its use of such systems during the preceding calendar year.
    • (b) The report must include:
      1. The number of automated license plate recognition cameras operated by or on behalf of the agency;
      2. The number of historical searches conducted;
      3. The number of searches conducted pursuant to search warrants;
      4. The number conducted pursuant to investigative orders;
      5. The number of emergency or exigent-circumstance searches;
      6. The number of prospective tracking warrants obtained;
      7. The number of hot-list entries created by the agency;
      8. The number of interagency requests for data made and received;
      9. The number of disclosures to federal or out-of-state agencies;
      10. The number of confirmed incidents of unauthorized access, use, or disclosure;
      11. The number of disciplinary actions resulting from violations of this section; and
      12. The name of each automated license plate recognition provider under contract with the agency and the total amount paid to each provider during the reporting period.
    • (c) Information reported under this subsection must be aggregated and may not identify a person, license plate, privately owned or leased vehicle, location associated with a particular privately owned or leased vehicle, confidential informant, law enforcement officer, or active investigation.
    • (d) Nothing in this subsection requires disclosure of information otherwise confidential or exempt from disclosure under state or federal law.
15. Individual Rights of Access.
    • (a) Upon written request, an individual who is the registered owner or lessee of a motor vehicle is entitled to inspect and obtain a copy of any audit record maintained pursuant to this section showing that the individual’s license plate or vehicle was searched through an automated license plate recognition system.
    • (b) Except as provided in paragraph (d), the information provided must identify, to the extent maintained by the agency:
      1. The date and time of each search;
      2. The law enforcement agency that conducted or requested the search;
      3. The legal authority relied upon for the search, including whether the search was conducted pursuant to a search warrant, investigative order, consent, emergency exception, or other authority provided by this section; and
      4. The case, incident, or investigation number associated with the search.
    • (c) The identity of an individual law enforcement officer or any information otherwise confidential or exempt from disclosure under state or federal law need not be disclosed.
    • (d) An agency may temporarily withhold any information otherwise subject to disclosure under this subsection, including the existence of a search, if such information constitutes active criminal intelligence information or active criminal investigative information as defined in [STATE CODE].
    • (e) If information is withheld pursuant to paragraph (d), the agency shall cite the applicable statutory exemption but is not required to acknowledge the existence of a particular search, investigation, warrant, investigative order, or other law enforcement activity while such information remains active.
    • (f) Upon the information ceasing to constitute active criminal intelligence information or active criminal investigative information, the individual is entitled to obtain the audit information upon request in accordance with this subsection.
    • (g) An agency may not deny a request under this subsection solely because disclosure would reveal that the requesting individual’s license plate or vehicle was searched by a law enforcement agency.
    • (h) Nothing in this subsection requires disclosure of information otherwise made confidential or exempt by state or federal law.
16. Public Records and Individual Access. Public Records; Protection of Location and Search Information.
    • (a) Except as otherwise provided in this subsection, automated license plate recognition data, derived data, and information that identifies or could reasonably be used to identify a particular person, privately owned or leased motor vehicle, license plate, or the location or movements of a particular person or privately owned or leased motor vehicle are confidential and exempt.
    • (b) Except for a motor vehicle owned or leased by a governmental entity, a person may not obtain through a public records request information that would disclose whether a particular person, motor vehicle, or license plate was present at a particular location, traveled along a particular route, or was detected by an automated license plate recognition system.
    • (c) Automated license plate recognition data relating to a motor vehicle owned or leased by a governmental entity is not made confidential or exempt solely by this subsection and may be disclosed subject to any other confidentiality provision or exemption provided by state or federal law.
    • (d) Nothing in paragraph (c) requires disclosure of information that constitutes or would reveal:
      1. Active criminal intelligence information or active criminal investigative information;
      2. The identity or activities of an undercover law enforcement officer or confidential informant;
      3. A covert law enforcement operation or surveillance activity;
      4. Information the disclosure of which would jeopardize the safety of a law enforcement officer or another person;
      5. Information concerning a governmental vehicle when disclosure of its location or movements would reveal confidential security procedures, plans, operations, or vulnerabilities; or
      6. Information otherwise made confidential or exempt from disclosure by state or federal law.
    • (e) Audit records required by this section are public records only to the extent they may be disclosed without revealing:
      1. A license plate number or other vehicle identifier associated with a privately owned or leased motor vehicle;
      2. The identity of a person whose privately owned or leased vehicle or movements were the subject of a search;
      3. The location or movements of a particular person or privately owned or leased vehicle;
      4. Search criteria that would reasonably permit identification of such person or privately owned or leased vehicle;
      5. Active criminal intelligence information or active criminal investigative information; or
      6. Information otherwise confidential or exempt from disclosure under state or federal law.
    • (f) Nothing in this subsection limits the right of a registered owner or lessee to obtain audit information concerning his or her own motor vehicle pursuant to the Individual Rights of Access subsection of this section.
    • (g) An agency may satisfy a public records request for audit information by providing aggregated or redacted records sufficient to disclose the agency’s use of automated license plate recognition systems without revealing information made confidential and exempt by this subsection.
    • (h) Nothing in this subsection shall be construed to make confidential or exempt a record concerning a motor vehicle owned or leased by a governmental entity that would otherwise be subject to disclosure, except to the extent another confidentiality provision or exemption applies.
17. Data Security, Encryption, and United States Storage.
    • (a) A law enforcement agency and any provider that stores, processes, transmits, or maintains automated license plate recognition data shall implement reasonable administrative, technical, and physical safeguards designed to protect such data against unauthorized access, acquisition, disclosure, alteration, destruction, or use.
    • (b) Automated license plate recognition data, derived data, audit records, and credentials used to access an automated license plate recognition system must be encrypted:
      1. While transmitted over a network; and
      2. While stored electronically.
    • (c) Access to an automated license plate recognition system must:
      1. Require a unique user account for each authorized user;
      2. Require multifactor authentication;
      3. Be limited through role-based access controls to information and functions reasonably necessary for the user’s official duties; and
      4. Automatically terminate or disable credentials when the user’s authorization to access the system ends.
    • (d) Shared user accounts or shared credentials may not be used to access automated license plate recognition data.
    • (e) A law enforcement agency or provider shall promptly investigate suspected unauthorized access and comply with applicable state and federal breach-notification requirements.
    • (f) Automated license plate recognition data, derived data, audit records, system backups, replicated data, and metadata collected or maintained pursuant to a contract with a law enforcement agency of this state must be stored and processed only on information technology infrastructure physically located within the United States.
    • (g) A provider may not transfer, replicate, back up, mirror, or otherwise cause data described in paragraph (f) to be stored or processed outside the United States.
    • (h) Except when specifically authorized by the law enforcement agency for a documented cybersecurity or emergency purpose, administrative access to data described in paragraph (f) may not originate from outside the United States.
    • (i) A contract for automated license plate recognition services must expressly require compliance with this subsection.
18. Third-Party and Out-of-Jurisdiction Databases.
    • (a) A law enforcement agency may not obtain, search, request, purchase, receive, or otherwise access through a private vendor, another governmental entity, or an entity outside this state automated license plate recognition data that the agency would be prohibited from obtaining or searching directly under this section.
    • (b) A contract entered into or renewed by a law enforcement agency for automated license plate recognition services must require the provider to:
      1. Enforce the access limitations established by this section;
      2. Maintain audit records required by this section;
      3. Comply with the applicable retention and deletion requirements;
      4. Prevent unauthorized access to or disclosure of the data; and
      5. Prevent a user from circumventing the requirements of this section by accessing data maintained by another customer, agency, jurisdiction, or database.
    • (c) Automated license plate recognition data collected on behalf of a law enforcement agency remains under the control of the agency and may not be sold, licensed, monetized, commercially exploited, or used by a provider for a purpose unrelated to providing services to the agency.
    • (d) A provider may not create, maintain, sell, license, or disclose a commercial profile of a person or vehicle using automated license plate recognition data collected on behalf of a law enforcement agency.
    • (e) When automated license plate recognition data is required to be deleted under this section, the deletion requirement applies to all copies reasonably accessible to the agency or provider, including replicated databases, caches, exports, and derivative datasets. Data contained solely within disaster-recovery backups that cannot reasonably be individually deleted must be rendered inaccessible for ordinary use and permanently deleted in accordance with the provider’s ordinary backup-destruction cycle.
    • (f) Upon termination or expiration of a contract, the provider shall return or permanently delete all automated license plate recognition data and derived data belonging to the agency except to the extent retention is required by law.
19. Data Retention.
    • (a) Automated license plate recognition data that has not been identified as evidence or preserved pursuant to a criminal investigation, search warrant, investigative order, court order, or other lawful process must be permanently deleted no later than 30 days after collection.
    • (b) Data lawfully preserved as evidence may be retained in accordance with applicable law and records retention schedules.
    • (c) A law enforcement agency may not extend the retention period by transferring data to another governmental agency or private entity.
    • (d) The retention period established by this subsection applies regardless of whether automated license plate recognition data is maintained directly by a law enforcement agency or on its behalf by a provider.
    • (e) Except for data lawfully preserved pursuant to paragraph (b), automated license plate recognition data may not be retained in an identifiable or reasonably identifiable form after expiration of the applicable retention period.
    • (f) A provider may not avoid a deletion requirement by retaining a copy, derivative record, vehicle fingerprint, or other data from which deleted automated license plate recognition data can reasonably be reconstructed.
20. Prohibited Use. A person may not access, search, use, or disclose automated license plate recognition data:
    • (a) For a personal or non-law-enforcement purpose;
    • (b) To determine a person’s movements, associations, or activities based solely upon constitutionally protected political, religious, journalistic, expressive, or associational activity;
    • (c) For routine enforcement of parking violations or noncriminal traffic infractions;
    • (d) Outside the scope authorized by a warrant or investigative order;
    • (e) In a manner intended to circumvent the requirements of this section; or
    • (f) In a manner that violates personal privacy protections, including through unauthorized access, use, or disclosure of driver, vehicle, or license plate information obtained through automated license plate recognition technologies or databases.
21. Ordinary Law Enforcement Activities Unaffected. Nothing in this section prohibits a law enforcement officer from:
    • (a) Observing, photographing, recording, or checking a license plate or motor vehicle visible from a location where the officer is lawfully present;
    • (b) Conducting a lawful traffic stop;
    • (c) Checking a license plate through a criminal justice information system otherwise authorized by law;
    • (d) Conducting surveillance otherwise authorized by law; or
    • (e) Using information obtained independently of an automated license plate recognition database.
22. Penalties and Enforcement.
    • (a) A person who knowingly accesses, searches, uses, obtains, or discloses automated license plate recognition data in violation of this section commits a misdemeanor of the first degree, punishable as provided by applicable state law.
    • (b) A person who intentionally accesses, searches, uses, obtains, or discloses automated license plate recognition data in violation of this section:
      1. For personal or commercial gain;
      2. To stalk, harass, intimidate, threaten, or unlawfully discriminate against another person;
      3. To obtain information concerning a person with whom the violator has a personal, familial, financial, political, or business dispute;
      4. To conceal another violation of this section;
      5. By knowingly circumventing a technical or legal access restriction; or
      6. After having previously been convicted of a violation of this section, commits a felony of the third degree.
    • (c) A fine imposed under this subsection may be imposed in addition to any term of incarceration or other punishment authorized by law. Each unauthorized access, search, use, or disclosure of protected driver, vehicle, or license plate information constitutes a separate violation and is subject to the applicable penalties established under this section.
    • (d) Each law enforcement agency shall establish disciplinary procedures for an employee or authorized user who violates this section. A violation of this section by a certified law enforcement officer shall be referred to the Florida Criminal Justice Standards and Training Commission, or its equivalent in another state, for review and potential disciplinary action, including suspension or revocation of the officer’s certification, as authorized by law. Nothing in this paragraph limits any criminal, civil, or administrative remedy otherwise available by law.
    • (e) A provider that knowingly permits, directs, authorizes, facilitates, or engages in the access, retention, disclosure, sale, transfer, or use of automated license plate recognition data in violation of this section is subject to a civil penalty not exceeding, $50,000 for each violation. Each unlawful disclosure, sale, transfer, or use constitutes a separate violation.
      1. An officer, director, employee, agent, contractor, or other natural person acting on behalf of a provider who knowingly and willfully directs, authorizes, participates in, or causes conduct prohibited by this paragraph commits a felony of the third degree, punishable as provided by the applicable state law.
      2. A fine imposed upon a person under subparagraph 1. may be imposed in addition to any term of incarceration or other punishment authorized by law.
      3. A violation by a provider constitutes a material breach of any contract between the provider and a law enforcement agency of this state.
      4. In addition to any other remedy provided by law, a law enforcement agency may immediately suspend the provider’s access to automated license plate recognition data, require deletion of data unlawfully obtained or maintained, and terminate the provider’s contract.
      5. The Attorney General may bring an action to enforce the civil penalties provided by this paragraph.
    • (f) A contract entered into or renewed after the effective date of this act must authorize the law enforcement agency to suspend access, require corrective action, terminate the contract for material violations, and require the provider to permanently delete data maintained in violation of this section.
    • (g) Automated license plate recognition data obtained as a result of a material violation of the judicial authorization requirements of this section, and evidence directly derived from such data, is subject to suppression in a criminal proceeding upon motion of the defendant.
    • (h) Suppression is not required if the state establishes by a preponderance of the evidence that:
      1. The data would inevitably have been discovered by lawful means;
      2. The data was obtained from an independent lawful source; or
      3. The law enforcement officer obtaining or using the data acted in objectively reasonable reliance upon a search warrant or investigative order issued by a court of competent jurisdiction.
    • (i) A violation that is solely technical, clerical, or administrative and that did not result in access to data that would otherwise have been prohibited under this section does not constitute grounds for suppression.
    • (j) Nothing in this subsection limits a court’s authority to suppress evidence when suppression is otherwise required by the United States Constitution, the State Constitution, or other law.
23. Rule of Construction. This section shall be construed to regulate access to and use of aggregated automated license plate recognition data and may not be construed to create a reasonable expectation of privacy in a license plate or motor vehicle that is otherwise exposed to public view.

Section 2. The Department of State, in consultation with the Department of Law Enforcement, shall amend any applicable records retention schedules as necessary to conform to the requirements established by this act.

Section 3. Effective Date