Illinois agencies would face limits on license plate reader use

Law enforcement agencies and government entities would use, operate, or access license plate reader systems only for listed purposes and would be barred from several other uses. The rules cover license plate reader systems and captured data used by law enforcement agencies, government entities, vendors, and contractors. Law enforcement uses would include specified missing-person alerts, government databases, stolen vehicles, hit-and-run crashes, outstanding felony warrants, and forcible felonies. Government uses would include electronic toll collection, parking enforcement, and controlling access to secured areas. The systems could not be used for immigration enforcement, facial recognition, or surveillance based only on protected traits, lawful events, political activity, or access to lawful health care. Access and sharing would generally require an authorized purpose, a valid case file and declaration, a criminal warrant based on probable cause, or a court disclosure order. The rules would apply when the Act becomes law.

Agencies would generally delete captured plate data within three days and would have to limit disclosure and preserve data only under specified legal procedures. The rules cover captured plate data collected by or for law enforcement agencies and government entities, including data held by vendors. Data could be kept longer when needed for listed investigations, tolls, parking, secured-area access, foreign-entity investigations, a preservation request, or a valid criminal warrant. A written preservation request could hold specified data for 30 days while a court order is sought. A court order for longer retention would require specific facts supporting probable cause that the data matters to an ongoing felony, missing-person matter, prosecution, or defense. Captured plate data would not be a public record and generally could be disclosed only to the registered vehicle owner or with that person's written consent, subject to listed exceptions. The three-day deletion rule would apply to authorized captured data, while a preservation request could hold specified data for 30 days and requires a court application within five days.

Agencies using license plate readers would provide public notice, adopt privacy and security policies, publish annual reports, and face penalties for violations. The requirements cover law enforcement agencies and government entities that own, operate, or access license plate readers or captured plate data, plus vendors that violate the Act. Before use, an agency would hold a public presentation with an opportunity for questions and comments and publish a privacy policy. The policy would address authorized uses, sharing, retention, employee access, training, security, audits, and discipline. Annual reports would list system use, vendors, data requests, sharing, unauthorized uses, breaches, and audits. Violations could lead to employee discipline, temporary use bans, canceled vendor contracts, and private lawsuits seeking damages, fees, or court orders. Annual public reports would begin on the first April after the Act becomes law, with agencies reporting by April 1 and the Secretary of State publishing a statewide report by May 1.