title
An ordinance amending Section 13.08.080 of the Metropolitan Code of Laws to pertaining to the use of License Plate Scanner (LPR) Technology in the public rights of way.
body
WHEREAS, license plate scanner technology has been deployed safely and effectively across the country, including in Tennessee; and
WHEREAS, license plate scanner technology is an objective tool used to identify the letters and numbers contained on a publicly displayed, government issued, license plate; and
WHEREAS, it is in the public interest to permit the use of this technology subject to a reasonable privacy framework that ensures the protection of civil liberties.
NOW, THEREFORE, BE IT ENACTED BY THE COUNCIL OF THE METROPOLITAN GOVERNMENT OF NASHVILLE AND DAVIDSON COUNTY:
Section 1. That Section 13.08.080 of the Metropolitan Code is hereby amended by deleting the existing language in subsection G and substituting in lieu thereof:
G. Except as provided in subsection I. of this section, any department of the Metropolitan Government, either directly or through contractors acting at the department’s direction, wishing to acquire or enter into an agreement to acquire license plate scanner (LPR) technology and/or install or operate them onto or within the public rights of way, shall comply with the following requirements and restrictions:
1. A usage and privacy policy shall be implemented in order to ensure that the collection, use, maintenance, sharing, and dissemination of LPR information is consistent with respect for individuals' privacy and civil liberties. The usage and privacy policy shall be posted on the department’s website, and shall include the following:
(a) i. The authorized purposes for using the LPR system and collecting LPR information, which shall be limited to the following:
(1) investigating and prosecuting felony offenses and criminal offenses associated with violent crimes including gun violence, homicide, and assault; and reckless driving including illegal drag racing activity at speeds in excess of 70 miles per hour; (2) identification and recovery of stolen vehicles and stolen license plates;
(3) detecting civil traffic or parking offenses;
(4) operating a smart parking or curb management program; and
(5) assisting in missing persons cases including Amber and Silver Alerts.
ii. The use of an LPR system and collection of LPR information is not authorized and shall not be used for any purpose other than those listed in this section. This prohibition includes, but is not limited to the use of LPR for the following:
(1) the general surveillance of any individual;
(2) the identification of a vehicle for the purposes of repossession of the vehicle;
(3) the determination of whether a vehicle’s license plate is expired;
(4) the determination of whether a motorist has a valid driver’s license; or
(5) the determination of whether a motorist is insured.
iii. An LPR system authorized under this section shall not be capable of facial recognition.
iv. Law Enforcement Agencies, the Parking Enforcement Patrol, NDOT, and their contractors must have reasonable suspicion that a felony offense, or a traffic or parking offenses, has occurred before examining collected license plate reader data that was collected more than one hour prior to the examination. Further, Law Enforcement Officers shall not examine license plate reader data that was collected more than one hour prior to the examination in order to generate reasonable suspicion.
v. Whenever a license plate reader alerts on a plate, law enforcement, before taking any action, must confirm visually that a plate matches the number and state identified in the alert, that the alert is still active by calling dispatch, whether the alert pertains to the registrant of the car and not the car itself, and that the license plate is on the list for one of the authorized purposes listed in this section. Once confirmed, a query shall be initiated in the National Crime Information Center (NCIC) database by authorized individuals.
(b) A description of the employees or contractors who are authorized to use or access the LPR system or to collect LPR information.
(c) A description of the steps taken to restrict the information obtained through the LPR system to that which is strictly necessary to implement the purposes in subsection G.1(a) of this section and limited to the contents of only the license plate and, to the extent possible, excluding identifying information of the driver and passengers.
(d) A description of how the LPR system will be monitored to ensure the security of the information obtained.
(e) The purposes of, process for, and restrictions on the sharing of LPR information to other persons, which must be in accordance with the purposes identified in subsection G.1(a) of this section.
(f) A description of the measures used to ensure the accuracy of LPR information and to correct data errors.
(g) The length of time LPR information will be retained, limited to the terms outlined in subsection G.4 of this section.
2. The installation and maintenance of LPR hardware and software, as well as LPR data access, retention, and security, shall be managed by an LPR Custodian (“Custodian”) designated by the department using the LPR system, who will assign personnel under their command to administer the day to day operation of the LPR system as defined below. The Custodian’s name shall be provided on the department’s website. The Custodian shall be the administrator of the LPR system and shall be responsible for developing guidelines and procedures regarding the department’s use of its LPR system, including, but not limited to:
(a) Establishing and maintaining reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect LPR information from unauthorized access, destruction, use, modification, or disclosure;
(b) Maintaining a list of the name and job title of all users who are authorized to use or access the department’s LPR system;
(c) Developing training requirements for and ensuring training of authorized users on the operations of, and usage and privacy policy for the department’s LPR system;
(d) Developing procedures and a regular timetable for conducting audits of LPR system usage, including audits of user searches;
(e) Developing procedures for, and ensuring the proper retention and destruction of, the agency’s LPR data;
(f) Ensuring that this policy and its related procedures are posted conspicuously on the department’s public website; and
(g) Managing the relationship with the LPR provider, which shall include ensuring that:
i. The provider meets all contractual obligations;
ii. The system is maintained as per Service Level Agreements;
iii. Log retention is adequate; and
iv. Data ownership is clearly understood.
3. Access and use of the department’s LPR system is strictly restricted to the authorized users, as outlined below:
(a) Authorized users must receive appropriate supervisory approval, as determined by the Custodian, prior to receiving LPR system access.
(b) Access shall only be approved for designated personnel whose roles require them to use the LPR system, and LPR system access shall be further limited to those tasks within the employee’s job responsibilities. Access shall be limited to no more than ten authorized users per department.
(c) Personnel authorized to use the department’s LPR system as defined in subsection G.3.(b) of this section shall be specifically trained in the system and the usage and privacy policy prior to receiving account access. This training shall include, but not be limited to:
i. Applicable local, state, and federal laws;
ii. Applicable policies, including the usage and privacy policy;
iii. Functionality of the equipment;
iv. Authorized and prohibited uses;
v. Accessing data;
vi. Safeguarding password information and data;
vii. Data sharing policies and procedures; and
viii. Reporting breaches, errors, and other issues.
(d) Authorized user accounts which are inactive for a period of nine months will be disabled automatically. Authorized users with disabled accounts must be retrained in the LPR system, usage, and privacy policies prior to having their accounts reinstated.
(e) Users found to have used the LPR system without authorization, with improper credentials, or in a manner not authorized by these policies shall have their access immediately revoked and may face disciplinary action in accordance with applicable civil service policies, up to and including termination.
(f) To the extent consistent with state or federal law, to ensure compliance with the provisions of this section or to investigate complaints of misuse of an LPR or LPRs, the district attorney general, or a designee, or the public defender, or a designee, may examine and audit any LPR, any file used to store LPR data, and any records pertaining to the use of LPRs. If the district attorney general or the public defender believes that an LPR or LPRs have been used in violation of this section, either or both may send a letter to the Metro Council requesting suspension of the use of an LPR or LPRs for the purposes of investigation, to prevent ongoing violations, or to deter future violations. The Metro Council may grant such a request by resolution. Nothing in this section shall be construed as limiting the authority of the district attorney general to prosecute any crime involving LPR. This includes, but is not limited to, tampering with evidence, which is a class C felony punishable under Tennessee law with a term of imprisonment of three to fifteen years and a fine not to exceed $10,000.
4. (a) LPR data, including but not limited to license plate number, vehicle description, location and date/time stamp shall not be retained for more than 10 days, unless it is evidence in a criminal offense or civil traffic or parking offense, subject to a properly issued warrant, subpoena, public records request or court order, or where the department has been instructed to preserve such data by the Metropolitan Department of Law in relation to pending litigation or anticipated litigation.
(b) Any data unrelated to an ongoing investigation, or pending or anticipated litigation shall be automatically deleted after 10 days.
(c) Users who wish to preserve LPR data for longer than 10 days shall make a written request to their supervisor including the investigation number and purpose for preservation and, upon approval, such LPR data will be preserved along with a note in the record stating the reason for preservation and related investigation number.
(d) LPR data retained by the Metropolitan Government shall not include any personally identifiable information.
(e) To the extent permitted by state law, the Metropolitan Government shall not sell LPR data for any purpose and shall not share any LPR data, except as provided in subsection G.6.
5. The LPR Custodian shall perform an audit of the LPR system and its access history on a regular basis, not less than one time per year. The department shall maintain an audit trail of access to the system for a period of not less than three years, which will include the following:
(a) The date and time the information is accessed.
(b) The license plate number or other data elements used to query the LPR system, if such data elements are not deleted per subsection G.4 of this section. Data exempt from deletion under subsection G.4., such as data that will be used as evidence in a felony offense or traffic or parking offense, must be preserved for the audit trail pursuant to this subsection.
(c) The username of the person who accessed the information.
(d) The purpose for accessing the information.
(e) To the extend consistent with state or federal law, access to review the Metropolitan Nashville Police Department audit trail shall be provided to the District Attorney, Public Defender, and Chair of the Community Oversight Board.
6. To the extent consistent with state or federal law, the department’s stored LPR data may only be shared with other law enforcement agencies using the following procedures:
(a) The agency making the request for the LPR data shall submit in writing:
i. The name of the agency;
ii. The name and title of the person requesting the information;
iii. The intended purpose of obtaining the information; and
iv. An agreement to adhere to the applicable provisions of this usage and privacy policy.
(b) The request shall be reviewed and approved by the Custodian before the requested access is granted.
(c) If the requested search generates results, the Custodian or his or her designee must verify that the results are relevant to the request made prior to sharing the LPR data.
(d) The department shall not share any data with any agency that uses that data in a manner broader than allowed by this subsection G.6. Data may only be shared for the purposes outlined in subsection G.1(a).
(e) Records of all approved requests, including a record of which account was used to provide the search results, must be maintained for a period not less than three years.
7. To protect against racial and ethnic bias in the use of LPRs, any time a motor vehicle is stopped based on data analysis performed by an LPR:
(a) The law enforcement officer who effectuated the stop shall record and provide to their precinct for record keeping and reporting purposes:
i. The date, time, and precise location of the stop;
ii. Any investigative or enforcement actions that were taken subsequent to the stop, including without limitation: an arrest; a search of a vehicle, driver, or passenger; the issuance of a new ticket, fine, or fee; or the enforcement of an existing ticket, fine, or fee;
iii. The self identified race(s) and ethnicities of the driver of the stopped motor vehicle, if voluntarily provided by the driver following the law enforcement officer’s request.
(b) The race and ethnicity identification categories provided to the driver for selection by the law enforcement officer shall be the same as those under present use by the United States Office of Management and Budget (OMB).
(c) No later than March 1 of each year, the Metropolitan Nashville Police Department (MNPD) shall report to the Metropolitan Council, and shall make publicly available upon the MNPD website, all of the data collected pursuant to this subsection Section G.7(a), by precinct, from the previous calendar year. The reported data shall include no other personally identifiable information.
(d) In addition to the reporting requirement in Subsection G.7(c), during the six month pilot program referenced in subsection G.14, the MNPD shall report to the Metropolitan Council the information required by this subsection G.7(d) every two months. If a resolution is approved to fully implement the MNPD’s use of LPR technology, the MNPD shall report such information to the Metropolitan Council every three months. Each report submitted by the MNPD shall contain the following information, compiled since the end date of its most recent report:
i. The number of LPRs in use.
ii. The number of matches made by the LPR, including number of matches read correctly and any misread.
iii. The number of matches that identified vehicles and individuals sought by law enforcement and that resulted in stops of vehicles or individuals.
iv. The number of matches that resulted in searches of vehicles and individuals, releases, arrests, or other outcomes.
v. Other information requested by the Metropolitan Council by resolution.
8. Failure of an employee to comply with this subsection G shall be grounds for disciplinary action in accordance with applicable civil service policies, up to and including termination.
9. LPR data shall only be disclosed in accordance with state and federal law.
10. LPR data obtained from a privately owned or operated LPR system may be used for the purposes authorized in subsection G.1., provided the data is voluntarily provided by the owners or operators of said LPR systems. The Custodian shall develop policies and procedures for requesting, protecting, and retaining this data that are consistent with the intent of subsections G.2., G.3., and G.4.
11. Any device or service necessary to effectuate the provisions of this subsection G shall be procured pursuant to the provisions of Title 4 of the Metropolitan Code of Laws, the Procurement Code.
12. An LPR technology deployment policy shall be developed and implemented by the MNPD to help prevent misuse of LPR technology to track and unfairly target vulnerable communities. Placement of fixed LPR technology in the public right of way shall be limited to major and collector streets as defined in the Nashville Next Major and Collector Street Plan, and the location of LPR devices shall be distributed equitably across the north, south, east, and west quadrants of the county.
13. A data verification policy shall be developed and implemented by MNPD to help prevent erroneous and potentially dangerous stops based upon incorrect or outdated information. The policy shall require independent verification of the information yielded from a hot list and real time updating of hot list data, as well as a comparison of the accuracy of the hot list data with the accuracy of the LPR images. Hot lists shall be transferred daily and be capable of updating by an operator/officer in the field. The LPR system, both for fixed and mobile LPR units, shall function in such a manner so as to notify an officer when a license plate on the hot list is observed in real time. Historical LPR data shall be searched to determine the date and time a license plate number contained on a hot list passed a certain camera. For purposes of this subsection G., “hot list” means the list of license plate numbers law enforcement agencies have identified as being relevant for the investigation and/or prosecution of a criminal offense.
14. Prior to the full implementation of a department’s LPR system, there shall be a six month pilot program beginning the first day that the LPR system is operational and in use by the department to determine whether the continued use of LPR technology is appropriate. At least two weeks prior to the conclusion of the pilot program period, the department shall submit a report to the Council on the efficacy of the program, compliance with the provisions of this section, and any policies implemented in order to carry out the use of the LPR system. This report shall be posted on the department’s website. At the end of the six month pilot program, the use of LPR technology by a department shall cease unless the Metropolitan Council approves the full implementation of the department’s use of LPR technology upon adoption of a resolution.
Section 2. That Section 13.08.080 of the Metropolitan Code is hereby amended by adding the following new subsection I.:
I. In addition to the provisions of subsection G. of this section, license plate scanner technology shall be allowed if all of the follow requirements are met:
(a) The license plate scanner is used solely and exclusively in conjunction with a vehicle emissions sensor as part of an emissions inspection program authorized under local, state or federal law;
(b) The data from the license plate scanner and vehicle emissions sensor is used solely and exclusively for purposes of determining compliance with vehicle emissions standards;
(c) A determination by the vehicle emissions sensor that a vehicle identified by the license plate scanner is not in compliance with applicable emissions standards shall not lead to any penalty or punitive action against the registered vehicle owner;
(d) No fewer than two such license plate scanners shall be in operation within Davidson County at any given time; and
(e) Data that can be used to pair a specific vehicle's license plate number, VIN, or other unique identifier with a specific geographic location shall not be recorded.
Section 3. This ordinance shall take effect from and after its enactment, the welfare of The Metropolitan Government of Nashville and Davidson County requiring it.
Agenda Analysis
Analysis
This ordinance, as amended, amends Section 13.08.080 of the Metropolitan Code to provide for and regulate the usage of license plate reader (LPR) technology. The Code currently prohibits the operation of LPRs installed onto or within the public right-of-way except for use in conjunction with a vehicle emissions sensor as part of an emissions inspection program authorized under local, state or federal law. This ordinance would replace the provisions of subsection G. of Section 13.08.080 entirely. The ordinance preserves the existing emissions inspection program exception, and adds a new comprehensive regulatory structure for other uses of LPR technology.
The ordinance would require departments, either directly or through contractors, who want to use LPRs to implement a usage and privacy policy that would be posted on the department’s website. The policy must be designed “to ensure that the collection, use, maintenance, sharing, and dissemination of LPR information is consistent with respect for individuals' privacy and civil liberties.” The data collected could only be used for the following purposes:
• investigating and prosecuting felony offenses and criminal offenses associated with violent crimes
• detecting traffic or parking offenses
• operating a smart parking or curb management program
• assisting in missing persons cases including Amber and Silver Alerts
Law enforcement agencies, the parking enforcement patrol, NDOT, and their contractors must have reasonable suspicion that a felony offense, or a traffic or parking offenses, has occurred before examining any LPR data that was collected more than one hour prior to the examination. Prior to taking any action, law enforcement officers must also confirm visually that a plate matches the number and state identified in the alert, confirm that the alert is still active by calling dispatch and, determine whether the alert pertains to the registrant of the car and not the car itself.
The usage policy must also provide a description of the employees or contractors who are authorized to use or access the LPR system or to collect LPR information, and the steps that will be taken to ensure the security of the information and exclude identifying information of the driver and passengers to the extent possible. The policy must include the purposes of and restrictions on sharing LPR data, the measures used to ensure the accuracy of the data, and the length of time the data will be retained.
The installation and maintenance of LPR hardware and software, as well as LPR data access, retention, and security, would be managed by an LPR Custodian. The custodian would be responsible for assigning the personnel who will administer the day-to-day operation of the LPR system, and to develop guidelines and procedures for the further implementation of this ordinance. This will include establishing and maintaining security procedures and practices, maintaining a list of the name and job title of all authorized users, training requirements, audit procedures, and a data retention policy. This policy and its related procedures must be posted conspicuously on the department’s public website.
The ordinance also includes specific restrictions on the access and use of the department’s LPR system, such as supervisor approval and limiting access to those tasks that fall within the specific user’s job responsibilities. All users must be specifically trained regarding the LPR system and the usage/privacy policy prior to receiving account access. Users found to have used the LPR system without authorization would have their access immediately revoked and may face disciplinary action in accordance with applicable civil service policies, up to and including termination.
LPR data could not be retained for more than 10 days unless it is evidence in a criminal offense or civil traffic or parking offense, subject to a properly issued warrant, subpoena, public records request or court order, or where a litigation hold has been placed by the Department of Law. T.C.A. § 55-10-302 provides that any LPR data collected by any governmental entity may not be stored “for more than 90 days” unless the data is retained or stored as part of an ongoing investigation, and in that case, the data must be destroyed at the conclusion of the investigation or criminal action. Thus, the state law does not prevent local governments from having a shorter retention period.
The ordinance requires the LPR custodian to perform an audit at least once per year of the LPR system and the access history. The ordinance also provides some limitations on the sharing of LPR data with other law enforcement agencies. The ordinance further provides that LPR data obtained by Metro from a privately owned or operated LPR system could only be used for the purposes outlined above.
Law enforcement officers who stop vehicles based upon LPR data must complete a written record that includes the following:
• The date, time, and precise location of the stop;
• Any investigative or enforcement actions that were taken as a result of the stop; and
• The self-identified race(s) and ethnicities of the driver of the stopped motor vehicle if voluntarily provided by the driver at the request of the officer.