HF4661

Purpose

Clarify and strengthen how Automated License Plate Readers (ALPRs) are used by law enforcement in Minnesota, especially regarding data sharing with third-party service providers. The bill aims to improve transparency, accountability, and privacy protections by adding clearer definitions, auditing requirements, access controls, and oversight.

Key Definitions

• Automated license plate reader (ALPR): A device (mounted on a patrol vehicle or placed in a stationary spot) that records data or photographs of vehicles/plates to compare with law enforcement databases for investigations. Includes devices owned or operated by non-government entities if the data are shared with a law enforcement agency. Excludes traffic safety camera systems.
• Share / Sharing access or accessing: Any action by which ALPR data are made available to or queryable by another person or entity, including through third-party platforms, databases, or multiagency/nationwide search capabilities.
• Third-party service provider: An outside entity that a law enforcement agency contracts with or uses to collect, create, receive, maintain, or disseminate the agency’s ALPR data on the agency’s behalf.
• Traffic safety camera system: A system defined separately in statute (not considered an ALPR under this section).

Main Provisions

• Definitions and scope (Sec. 1)

  • Updates define ALPR, sharing, and third-party service providers to cover data sharing with non-government partners when used by law enforcement.
  • Makes clear that traffic safety camera systems are distinct from ALPRs.

• Auditing and oversight (Sec. 2)

  • Biennial independent audits: LEAs must conduct independent audits every two years to verify data classification, data use, destruction per requirements, and overall compliance with ALPR data laws.
  • Access for audits: Auditors must have full access to all records, logs, audit trails, query histories, and systems containing ALPR data, including those maintained by third-party providers.
  • Consequences for noncompliance: If serious or ongoing noncompliance is found, the commissioner of administration may order additional audits or remedial actions; data may be suspended if a pattern of noncompliance is identified until authorized to reinstate.
  • Public results: Audit results are public. A summary report is due to appropriate legislative bodies within 30 days after each audit, and the commissioner reviews the results.

• Access controls and data handling (Sec. 3)

  • Authorization to access: LEA personnel must obtain written authorization from the chief of police, sheriff, or head of the agency (or designee) to access ALPR data for a legitimate, specified, documented law enforcement purpose.
  • Suspect-based access: Access must be based on reasonable suspicion that data relate to an active criminal investigation, with a documented factual basis and case/incident reference.
  • Role-based access and audit trails: Access rights must be limited to role-based levels, aligned with duties and training, and all queries/actions must be recorded in a data audit trail. Audit trails are public to the extent allowed by law.
  • External access and third parties: Access by anyone outside the agency (including third-party providers) must be authorized in writing by the agency head or designee. The agency remains responsible for ensuring full compliance, even when a third-party provider is involved.

Significant Changes to Existing Law

• Introduces explicit requirements for independent biennial audits of ALPR data practices, including access to data held by third-party providers.
• Requires public reporting of audit results to legislative committees and relevant data/privacy bodies.
• Tightens control over access to ALPR data with written authorizations, documented reasonable-suspicion basis, and role-based access limitations.
• Establishes data audit trails for all ALPR data queries/updates/accesses/disseminations, with public-facing aspects where permissible.
• Allows suspension of ALPR operations if there is a pattern of substantial noncompliance, until authorized to resume.
• Expands definitions to include sharing and third-party providers, clarifying that ALPR data can be shared with non-government entities when necessary for enforcement.

Oversight and Accountability

• The commissioner of administration has oversight authority to order additional audits or remedial actions if needed.
• Public audit results increase transparency about how ALPR data are used and destroyed.
• The bill places responsibilities on the LEA leadership to ensure compliance, including with third-party providers.

Overall Impact

• Strengthens privacy protections and accountability for ALPR data.
• Increases transparency through public audits and reporting.
• Tightens control over who can access ALPR data and under what circumstances.
• Enhances coordination with third-party service providers while maintaining agency responsibility for compliance.

Relevant Terms - ALPR (Automated license plate reader) - Automated license plate reader data - Third-party service provider - Share / sharing access - Traffic safety camera system - Data practices - Biennial independent audit - Data classification - Data audit trail - Access authorization - Written authorization - Reasonable suspicion - Active criminal investigation - Role-based access - Data dissemination - Audit logs - Commissioner of administration - Public audit results