...Title
Automated License Plate Reader Data Access and Safeguards. (Kamei, Tordillos, Cohen, and Mulcahy)
...Recommendations
1. Direct the City Attorney, in coordination with the City Manager, to develop and present to City Council a draft ordinance defining and prohibiting the unauthorized access, use, or disclosure of Automated License Plate Reader (ALPR) data, including potential civil and criminal penalties for violations thereof, and, to the extent legally permissible, authorizing a private right of action against individuals responsible for such violations for individuals harmed by the unauthorized disclosure or misuse of ALPR data, with appropriate safeguards and enforcement considerations.
2. Direct the City Manager to:
a. Prohibit access to ALPR systems and data through personal devices;
b. Restrict off-duty access to ALPR systems except for defined law enforcement purposes; and
c. Incorporate said prohibitions and restrictions into applicable City and Police Department policies and procedures.
3. Direct the City Manager to evaluate additional authentication, access control, and auditing safeguards for ALPR systems, including: multi-factor authentication and automated tools to identify potentially unauthorized access or use, and to return to City Council with implementation options, associated costs, and any facilitating policy changes.
4. Direct the City Manager, in coordination with the City Attorney, the Independent Police Auditor (IPA), Information Technology Department (ITD), and San José Police Department (SJPD) to explore developing a process that enables the IPA to act as an independent auditor for ALPR practices, within the scope of the IPA's role under the charter. The IPA, ITD, and SJPD should establish and return to City Council with the audit methodology, scope, frequency, and procedures, with appropriate safeguards.