Government agencies would limit surveillance technology and data use

Government entities would be barred from using automated license plate readers or mass-surveillance technology unless another part of state law allows it. The rule would cover state agencies, public institutions, local governments, and other Ohio government bodies. Government entities also could not collect, use, sell, transfer, or share data captured by these systems. They could not make related contracts with private vendors or obtain the data from outside data-sharing networks, except for legally required databases or authorized transfers from private people or businesses. Existing systems would have to stop operating within 30 days after this section takes effect. The 30-day shutdown period would begin when this section takes effect.

Government entities would generally have to delete captured surveillance data, and courts could not use that data or impose a monetary penalty based on it unless listed exceptions apply. The rules would cover data captured by automated license plate readers or mass-surveillance technology in civil and criminal matters. An agency could keep data needed for an ongoing investigation, trial, or lawsuit, or when federal law, state law, or a court order forbids deletion. Courts could admit the data when it came from a valid warrant, an authorized private transfer, or an exemption in the proposed law. Citations, fines, fees, and other monetary obligations based on inadmissible data would be void. The evidence and monetary-penalty rules would apply beginning on the effective date of the relevant section.

People harmed by prohibited surveillance or data use could sue, and the attorney general could seek court orders against violations. An affected individual could sue over unlawful monitoring, data handling, unlawful access, or a citation or fine based on inadmissible data. A successful individual plaintiff could receive attorney fees, court costs, court orders, actual or punitive damages, and specified statutory damages. The proposed statutory damages include $1,000 for some violations, $5,000 for some unlawful data access, or three times an improperly imposed monetary obligation. The attorney general could seek injunctions and civil penalties of up to $10,000 per day for violating an injunction. The text also provides criminal penalties for knowingly violating certain restrictions. A person could bring a lawsuit for conduct occurring after the relevant section takes effect.