Government agencies would limit use of surveillance data

Government entities would delete captured surveillance data after the stated retention period. The rule covers data from automated license plate recognition systems and mass surveillance technology that government entities collect or receive. The data may be kept longer if it relates to an ongoing legal proceeding, cannot be deleted under federal or state law or a court order, or was obtained under a valid search warrant. Government entities could not knowingly sell, transfer, or share the data with a private person. Government entities could not knowingly share the data with another government entity unless that entity gets a search warrant. Government entities would delete covered data no later than 11 days after collecting or receiving it, for data captured after the section's effective date.

Government entities and their employees or agents would not operate covered surveillance systems within 500 feet of a place of worship or firearms retailer. The restriction covers automated license plate recognition systems and mass surveillance technology operated by government entities. The bill would exempt certain toll-collection cameras and traffic-law photo-monitoring devices when they meet the listed requirements. The toll-camera exemption would require use only for electronic toll billing, compliance with specified law, and no law-enforcement access without a warrant. The restriction would apply after the section's effective date.

Government entities using covered surveillance systems or data would adopt access policies, track data use, conduct monthly audits, and file yearly reports. The requirements cover government entities that operate automated license plate recognition systems or mass surveillance technology or collect related data. Access policies would limit data access to specified supervisors or oversight designees and record each access, review, or use. Annual reports would include scanning totals, enforcement results, sharing and warrant information, privacy-policy changes, and audit results. A person harmed by a prohibited sale, transfer, sharing, or nearby-system operation could sue for damages and other court-ordered relief, including attorney fees; government immunity would not be a defense. Government entities would submit the first annual report by the first January 1 after the effective date and every January 1 afterward. The attorney general would submit a combined summary by the following April 1 and each April 1 afterward.