In December 2012 I noted that NOPD had no stated policy regarding its use or retention of data gathered through license plate scanners. Then, in July 2013, I noted that the ACLU had released a nationwide study on law enforcement use of the technology. The results of the study were not very encouraging if you are concerned about privacy and transparency.
Well, I am happy to announce that I recently discovered that NOPD finally has a policy! Policy 462 of the New Orleans Police Department Policy Manual of December 15, 2014 covers Automated License Plate Readers (ALPR). The policy begins on page 376 of the PDF if you want to read the entire policy, and also picks back up on page 891.
- The technology can only be used for official and legitimate law enforcement purposes.
- In the event of any real-time alerts generated by the technology, officers are urged to verify the validity of the alert before taking enforcement actions.
- Access to data gathered by the system is controlled.
- Under the policy, data is allowed to remain on the reader for 30 days, and once downloaded to the main server it is retained for up to 180 days (6 months) unless the data is identified as evidence or subject to records requests.
- The policy allows for all data to be shared with other law enforcement agencies.
- The policy also mentions that images are gathered but treats them the same as other license plate-only data that is gathered.
- The policy does not include any public reporting of the use of the technology beyond what is mentioned in the policy.
I am concerned about #1 because data could be stored for 7 months under this policy. It is impossible to know if this is too long of a retention period absent further information from NOPD that retaining info for up to 7 months is necessary. I am of the opinion that the shortest possible retention periods are to be preferred.
Number 2 concerns me because the policy does not specify any limitations on sharing data with other agencies other than the requirement that it be for legitimate law enforcement purposes. The policy should require that the agency shared with also maintain a policy of short retention periods and controlled access.
Concern #3 could be addressed by a clarification of how images are stored, what they are used for, and the extent of detail included in images. Are we talking headshots of drivers and passengers, or just images of the vehicle surrounding the license plate?
Finally, #4 concerns me because while the policy requires regular internal audits, it does not allow the public to know how much data is gathered, how many crimes are solved with the data, how long data should be stored for, how many false alerts are generated, or primary neighborhoods the technology is deployed in, etc.. The ACLU recommends at least an annual public reporting, and I’m happy to agree with that at the moment.
In any event, I am pleased to finally see a written policy on the use of license plate scanners. This is a good first step in transparency and privacy, but it should be just that: a first step.