Automated license plate reader provisions updated to address the role of third-party service providers.

A bill for an act

relating to government data practices; updating automated license plate reader

provisions to address the role of third-party service providers; amending Minnesota

Statutes 2024, section 13.824, subdivisions 1, 6, 7.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2024, section 13.824, subdivision 1, is amended to read:

Subdivision 1.

Definitions.

(a) For purposes of this section, the following terms have

the meanings given.

(b) "Automated license plate reader" means an electronic device mounted on a law

enforcement vehicle or positioned in a stationary location that is capable of recording data

on, or taking a photograph of, a vehicle or its license plate and comparing the collected data

and photographs to existing law enforcement databases for investigative purposes. Automated

license plate reader includes a device that is owned or operated by a person who is not a

government entity to the extent that data collected by the reader are shared with a law

enforcement agency. Automated license plate reader does not include a traffic safety camera

system.

(c)
new text begin
"Share," "sharing," "access," or "accessing" means any act by which a law enforcement

agency makes automated license plate reader data available to, or permits querying of such

data by, another person or entity, including through a third-party service provider's platform

or database or through any networked, multiagency, or nationwide search capability.
new text end

new text begin

(d) "Third-party service provider" means an entity that a law enforcement agency

contracts with or utilizes to collect, create, receive, maintain, or disseminate the agency's

automated license plate reader data on the agency's behalf.

new text end

new text begin

(e)
new text end
"Traffic safety camera system" has the meaning given in section
169.011, subdivision

85a.

Sec. 2.

Minnesota Statutes 2024, section 13.824, subdivision 6, is amended to read:

Subd. 6.

Biennial audit.

(a) In addition to the log required under subdivision 5, the law

enforcement agency must maintain records showing the date and time automated license

plate reader data were collected and the applicable classification of the data. The law

enforcement agency shall arrange for an independent, biennial audit of the records to

determine whether data currently in the records are classified, how the data are used, whether

they are destroyed as required under this section, and to verify compliance with subdivision

7. If the commissioner of administration believes that a law enforcement agency is not

complying with this section or other applicable law, the commissioner may order a law

enforcement agency to arrange for additional independent audits. Data in the records required

under this paragraph are classified as provided in subdivision 2.

(b)
new text begin
The law enforcement agency shall ensure that the independent auditor has complete

access to all records, logs, audit trails, query histories, and systems containing automated

license plate reader data, including those maintained by or accessible to the law enforcement

agency through any third-party service provider, as necessary to complete the audit required

by paragraph (a). Failure to provide the auditor with necessary access constitutes

noncompliance with this section and may result in an order from the commissioner of

administration requiring additional audits or other remedial action.
new text end

new text begin

(c)
new text end
The results of the audit are public. The commissioner of administration shall review

the results of the audit. If the commissioner determines that there is a pattern of substantial

noncompliance with this section by the law enforcement agency, the agency must

immediately suspend operation of all automated license plate reader devices until the

commissioner has authorized the agency to reinstate their use. An order of suspension under

this paragraph may be issued by the commissioner, upon review of the results of the audit,

review of the applicable provisions of this chapter, and after providing the agency a

reasonable opportunity to respond to the audit's findings.

deleted text begin

(c)
deleted text end
new text begin
(d)
new text end
A report summarizing the results of each audit must be provided to the

commissioner of administration, to the chairs and ranking minority members of the

committees of the house of representatives and the senate with jurisdiction over data practices

and public safety issues, and to the Legislative Commission on Data Practices and Personal

Data Privacy no later than 30 days following completion of the audit.

Sec. 3.

Minnesota Statutes 2024, section 13.824, subdivision 7, is amended to read:

Subd. 7.

Authorization to access data.

(a) A law enforcement agency must comply

with sections
13.05, subdivision 5
, and
13.055
in the operation of automated license plate

readers, and in maintaining automated license plate reader data.

(b) The responsible authority for a law enforcement agency must establish written

procedures to ensure that law enforcement personnel have access to the data only if authorized

in writing by the chief of police, sheriff, or head of the law enforcement agency, or their

designee, to obtain access to data collected by an automated license plate reader for a

legitimate, specified, and documented law enforcement purpose. Consistent with the

requirements of paragraph (c), each access must be based on a reasonable suspicion that

the data are pertinent to an active criminal investigation and must include a record of the

factual basis for the access and any associated case number, complaint, or incident that is

the basis for the access.

(c) The ability of authorized individuals to enter, update, or access automated license

plate reader data must be limited through the use of role-based access that corresponds to

the official duties or training level of the individual and the statutory authorization that

grants access for that purpose. All queries and responses, and all actions in which data are

entered, updated, accessed, shared, or disseminated, must be recorded in a data audit trail.

Data contained in the audit trail are public, to the extent that the data are not otherwise

classified by law.

new text begin

(d) Each access to or query of a law enforcement agency's automated license plate reader

data by a person outside the agency, including any query made through or facilitated by a

third-party service provider, must be authorized in writing by the chief of police, sheriff,

or head of that law enforcement agency, or their designee. The law enforcement agency

under whose authority the automated license plate reader data was collected remains

responsible for ensuring full compliance with this subdivision, regardless of whether the

agency uses a third-party service provider to manage access to the data.

new text end