...Title
Automated License Plate Readers.
...Recommendations
1. Internal Controls for Automatic License Plate Readers. (Mayor, Foley, Candelas, and Casey)
a. Direct the City Manager to:
1. Strengthen departmental and Citywide policies and explore technological controls that prohibit access of any law enforcement database such as Automated License Plate Readers (ALPR) from personally owned devices.
2. Coordinate with San José Police Department (SJPD) and the Information Technology Department to strengthen audits of individual user inquiries, including increasing frequency and number of user-level audits with annual reporting to the Public Safety, Finance, and Strategic Support Committee, to identify:
a. Access without legitimate law enforcement purpose.
b. Suspicious search activity.
c. Violations of City of San José ALPR Policy.
3. Pursue State legislation establishing criminal penalties for unauthorized access or improper information sharing, including potential amendments to Penal Code 13302 and Penal Code 502.
4. Report unauthorized disclosure or data leaks of ALPR data via information memo.
2. Automated License Plate Reader Data Access and Safeguards. (Kamei, Tordillos, Cohen, and Mulcahy)
a. Direct the City Attorney, in coordination with the City Manager, to develop and present to City Council a draft ordinance defining and prohibiting the unauthorized access, use, or disclosure of Automated License Plate Reader (ALPR) data, including potential civil and criminal penalties for violations thereof, and, to the extent legally permissible, authorizing a private right of action against individuals responsible for such violations for individuals harmed by the unauthorized disclosure or misuse of ALPR data, with appropriate safeguards and enforcement considerations.
b. Direct the City Manager to:
1. Prohibit access to ALPR systems and data through personal devices;
2. Restrict off-duty access to ALPR systems except for defined law enforcement purposes; and
3. Incorporate said prohibitions and restrictions into applicable City and Police Department policies and procedures.
c. Direct the City Manager to evaluate additional authentication, access control, and auditing safeguards for ALPR systems, including: multi-factor authentication and automated tools to identify potentially unauthorized access or use, and to return to City Council with implementation options, associated costs, and any facilitating policy changes.
d. Direct the City Manager, in coordination with the City Attorney, the Independent Police Auditor (IPA), Information Technology Department (ITD), and San José Police Department (SJPD) to explore developing a process that enables the IPA to act as an independent auditor for ALPR practices, within the scope of the IPA's role under the charter. The IPA, ITD, and SJPD should establish and return to City Council with the audit methodology, scope, frequency, and procedures, with appropriate safeguards.
[Referred from 9/30/26 - Item C.2 (ROGC 26-349) and Item C.3 (ROGC 26-345)]