Police would face limits on tracking and keeping license plate data

Law enforcement agencies and vendors would have to follow rules for collecting, using, storing, and deleting vehicle camera data. The rules cover license plate reader systems used by local, regional, state, and campus police, and the vendors working under their contracts. Several types of traffic cameras and systems using facial or other biometric recognition are excluded. A vendor may share data with a third party only when the agency authorizes it in writing in the contract. Vendors may not sell the data or use it for unrelated commercial purposes, and they may not use it to develop unrelated technology. Agencies must delete data no later than six months after collection unless it is preserved as evidence in a criminal or civil matter, or another law allows it.

Police agencies would need a warrant for broad, sustained tracking or for piecing together a vehicle's past movements across multiple days and places. These limits apply to law enforcement agencies and authorized users reviewing stored license plate reader data. A warrant is not required for a focused review tied to an authorized police or safety purpose, such as checking a current alert or locating a vehicle reasonably believed connected to a crime, a missing person, or an urgent public danger.

Police agencies would have to audit their use of the systems each year, send results to State Police, and fix any violations found. The audit duty applies to each law enforcement agency that operates, maintains, accesses, or uses a covered system or its data. State Police could also audit an agency or its vendor. Agencies must send audit results to State Police within 30 days after each audit is completed.

Police agencies would have to give public notice before deploying a system, and vendors would need agency approval for temporary maintenance access. The notice duty applies to a police agency before it deploys a covered system; access limits apply to vendors working under agency contracts. The notice need not reveal camera locations or other details that could compromise police work or public safety. A vendor's access must end as soon as the approved work is complete; continuous remote access is barred. Public notice must appear at least 30 days before deployment.