Bill Text: CA AB1782 | 2019-2020 | Regular Session | Amended

California Assembly Bill 1782 (Prior Session Legislation)

NOTE: There are more recent revisions of this legislation. Read Latest Draft

Bill Title: Personal information: contact tracing.

Spectrum: Partisan Bill (Democrat 2-0)

Status: (Engrossed - Dead) 2020-08-20 - In committee: Held under submission. [AB1782 Detail]

Download: California-2019-AB1782-Amended.html

Amended IN Assembly April 30, 2019

Amended IN Assembly April 10, 2019

Amended IN Assembly March 25, 2019

CALIFORNIA LEGISLATURE— 2019–2020 REGULAR SESSION

Assembly Bill

No. 1782

Introduced by Assembly Member Chau

February 22, 2019

An act to amend ~~Section~~ Sections 1798.90.51 and 1798.90.53 of the Civil Code, relating to personal information.

LEGISLATIVE COUNSEL'S DIGEST

AB 1782, as amended, Chau. Automated license plate recognition information: usage and privacy policy.

Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate reader technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law authorizes the department to share that data with law enforcement agencies for specified purposes and requires both an ALPR operator and an ALPR end-user, as those terms are defined, to implement a usage and privacy policy regarding that ALPR information, as specified. Existing law requires that the usage and privacy policy implemented by an ALPR operator and an ALPR end-user include the length of time ALPR information will be retained, and the process the ALPR operator and ALPR end-user will utilize to determine if and when to destroy retained ALPR information.

This bill would ~~require~~ delete the requirement that the usage and privacy policy implemented by an ALPR operator and an ALPR end-user include the retention and destruction information described above, and would instead require those usage and privacy policies to include a procedure to ensure the destruction of all nonanonymized ALPR information no more than 60 days from the date of collection, except as provided. The bill would also require that the usage and privacy policy implemented by an ALPR operator and an ALPR end-user include a procedure to ensure that all ALPR information that is shared with an ~~agency, organization, or individual~~ organization or individual, not including a law enforcement agency, outside of the entity that generated that information is sufficiently anonymized to protect the privacy of the license plate holder.

Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO

The people of the State of California do enact as follows:

SECTION 1.

Section 1798.90.51 of the Civil Code is amended to read:

1798.90.51.

An ALPR operator shall do all of the following:

(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

(b) (1) Implement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an ~~Internet Web site,~~ internet website, the usage and privacy policy shall be posted conspicuously on that ~~Internet Web site.~~ internet website.

(2) The usage and privacy policy shall, at a minimum, include all of the following:

(A) The authorized purposes for using the ALPR system and collecting ALPR information.

(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.

(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.

(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.

(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.

(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.

~~(G)The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.~~
(G) A procedure to ensure the destruction of all nonanonymized ALPR information no more than 60 days from the date of collection, except as authorized pursuant to Section 2413 of the Vehicle Code.
(H) A procedure to ensure that all ALPR information that is shared with an organization or individual, not including a law enforcement agency, outside of the entity that generated that information is sufficiently anonymized to protect the privacy of the license plate holder.

SECTION 1.SEC. 2.

Section 1798.90.53 of the Civil Code is amended to read:

1798.90.53.

An ALPR end-user shall do all of the following:

(b) (1) Implement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an internet website, the usage and privacy policy shall be posted conspicuously on that internet website.

(2) The usage and privacy policy shall, at a minimum, include all of the following:

(A) The authorized purposes for accessing and using ALPR information.

(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.

(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.

(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.

(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.

(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.

(G) A procedure to ensure the destruction of all nonanonymized ALPR information no more than 60 days from the date of collection, except as authorized pursuant to Section 2413 of the Vehicle Code.

(H) A procedure to ensure that all ALPR information that is shared with an ~~agency, organization, or individual~~ organization or individual, not including a law enforcement agency, outside of the entity that generated that information is sufficiently anonymized to protect the privacy of the license plate holder.