SOP 103.74: Use of License Plate Reader Systems

I. Introduction and Summary:

This policy establishes requirements for the lawful, secure, and accountable use of License Plate Reader (LPR) Systems by Georgia Department of Corrections, (GDC) Office of Professional Standards (OPS) personnel. LPR Systems shall be used only for official Law Enforcement Purposes by authorized, trained personnel. Access, requests, Alerts, dissemination, equipment, auditing, security, and record retention shall be documented and managed as provided in this policy.

II. Authority:

A. O.C.G.A. § 35-1-22;

B. GDC Standard Operating Procedures (SOPs): 103.02, Intelligence Unit; 103.10, Evidence Handling and Crime Scene Processing; 104.47, Employee Standards of Conduct; and 204.11, Use of Video Recording Equipment; and

C. Applicable Georgia Crime Information Center (GCIC), National Crime Information Center (NCIC), and Criminal Justice Information Services (CJIS) security requirements.

III. Definitions:

As used in this SOP, these terms are defined as follows.

A. Alert - A visual or auditory notice generated when an LPR system identifies a potential match between a Read and a plate on a Hot List.

B. Audit Trail - The electronic or written record documenting a user's access to and activity within an LPR system.

C. Authorized User - GDC personnel who have received required training and have been granted access to an LPR system based on official duties.

D. Captured License Plate Data - The geographic coordinates, date and time, photograph, license plate number, vehicle image, and any other data captured by or derived from an automated license plate recognition system or other source.

E. External Agency - A law enforcement agency or other entity outside the GDC through which personnel may request or obtain access to an LPR System or related data.

F. Hit - A Read that potentially matches a license plate on a Hot List or a plate manually entered for a documented investigation.

G. Hot List - A list of license plate numbers associated with stolen or wanted vehicles, persons of interest, public-safety Alerts, or other documented law enforcement investigations. Hot List information may originate from GCIC, NCIC, another law enforcement agency, or an authorized manual entry.

H. Law Enforcement Purpose - The investigation of an offense or activity initiated by a law enforcement agency or officer acting in the performance of official duties.

I. License Plate Reader (LPR) System - One or more fixed, mobile, or portable cameras combined with computer algorithms that convert license plate images into computer-Readable data.

J. License Plate Reader System Administrator (LPR Administrator) - Personnel designated by OPS to oversee authorization, deployment, operation, security, auditing, and records associated with an LPR system. This role includes the duties assigned to an LPR Administrator under this policy.

K. LPR Date Query Log - A record of a search, query, or access involving Captured License Plate Data.

L. Read - A digital image of a license plate or vehicle and associated metadata captured by an LPR system.

IV. Statement of Policy and Applicable Procedures:

A. General Requirements.

1. LPR systems, associated equipment, accounts, databases, and data are GDC resources and shall be used only for legitimate, official Law Enforcement Purposes.

2. Use shall comply with applicable law, this policy, other GDC policies, and the terms of any approved agreement. Users shall not access data for personal, political, commercial, discriminatory, retaliatory, or other unauthorized purposes.

3. Only Authorized Users who have completed application-specific training may operate an LPR system or access data. Users shall access only the information necessary for their assigned duties.

4. Users shall not share accounts, passwords, authentication devices, or access links. Activity performed through a user account is attributable to that user.

5. A result, Alert, or Hit is not independently conclusive and shall not be the sole basis for enforcement action. Personnel shall corroborate information through lawful investigative methods.

6. Misuse, unauthorized disclosure, false-pretense access, or attempted unauthorized access shall be reported immediately and may result in loss of access, disciplinary action, criminal investigation, or prosecution.

B. Administration and Oversight.

1. OPS shall designate an LPR Administrator and may designate trained personnel to assist with administration.

2. The LPR Administrator shall:

a. Approve, provision, periodically review, and promptly revoke user access based on training, assignment, and operational need;

b. Establish protocols for access, requests, collection, storage, preservation, security, retention, deletion, dissemination, and manual Hot List entries;

c. Maintain an inventory of GDC-owned or GDC-controlled LPR equipment showing assignment and location;

d. Ensure repairs, installation, software changes, and hardware changes are performed only by authorized personnel or vendors;

e. Ensure vendor contracts comply with GDC policy, applicable law, security controls, audit requirements, and lawful destruction of GDC data;

f. Maintain or ensure the maintenance of request, query, manual-entry, dissemination, incident, and audit records; and

g. Authorize nontraditional deployments and unusual requests consistent with GDC policy and operational need.

C. Authorized Access, Requests, and Documentation.

1. Personnel shall access LPR Systems directly through a GDC-approved account or submit a request through the LPR Administrator.

2. Except when immediate action is required by exigent circumstances, each inquiry shall be associated with an ACISS Case Management System Tip/Task or Case File Report before access or submission of the request, and shall document the requester, date and time, specific Law Enforcement Purpose, the application or data source used, and the action taken or result obtained, regardless of whether a suspect is developed, identified, arrested, or prosecuted.

3. The LPR Administrator shall maintain a log of requests and ensure logs are retained in ACISS Case Management System.

4. Under exigent circumstances, personnel may make an otherwise authorized inquiry before an ACISS Case Management System Tip/Task or Case File Report case number is available. The user shall notify the immediate supervisor as soon as practicable and complete the required ACISS Case Management System Tip/Task or Case File Report without unnecessary delay.

D. LPR Operation, Alerts, and Hot Lists.

1. LPR data transmissions shall use GDC-approved encrypted connections, including an encrypted virtual private network when required by GDC information-security standards.

2. Before initiating a stop or other enforcement action based on an LPR Alert, personnel shall:

a. Visually confirm that the observed license plate, including the alphanumeric characters and jurisdiction of issuance, matches the plate identified by the system; and

b. Confirm the current status of the plate or associated record through GCIC/NCIC, the communications center, an approved mobile data query, or another authoritative source.

3. This verification requirement does not prevent immediate action reasonably necessary to address a verifiable emergency or protect GDC personnel or public safety. Verification shall occur as soon as circumstances permit.

4. If an Alert cannot be verified, personnel shall reject or clear the Alert and shall not rely on it as the basis for enforcement action.

5. A manual Hot List entry shall be supported by a legitimate Law Enforcement Purpose and shall include the ACISS Case Management System Tip/Task or Case File Report number, reason for entry, entering user, date, and review or expiration date. The entry shall be removed when no longer needed.

6. Nontraditional LPR deployments, including special operations or planned criminal investigation deployments, require advance approval from the LPR Administrator unless exigent circumstances make advance approval impracticable.

E. External Agency Access, Assistance, and Dissemination.

1. Personnel shall not access LPR Systems or data through an External Agency unless a current memorandum of understanding or other agreement has been approved by the Commissioner or authorized designee.

2. Authorized External Agency access shall be routed through the LPR

Administrator. Personnel shall not use accounts, passwords, authentication devices, or access links issued to another agency or person.

3. When the GDC receives a request from another law enforcement agency, personnel shall confirm a legitimate Law Enforcement Purpose and document in a ACISS Case Management System Tip/Task or Case File Report the requesting agency, case number or incident number, requesting officer's name and contact information, data requested, and disposition of the request.

4. Captured License Plate Data and other investigative information may be shared only with a law enforcement agency for a documented Law Enforcement Purpose and only to the extent authorized by law, agreement, and GDC policy.

5. Dissemination outside the GDC shall be recorded in a dissemination log maintained by the LPR Administrator or designee.

6. If exigent circumstances require immediate use of an otherwise authorized external source before normal routing can occur, personnel shall notify the immediate supervisor as soon as practicable and promptly complete the required ACISS Case Management System Tip/Task or Case File Report.

F. Data Security, Preservation, and Confidentiality.

1. Captured License Plate Data is FOR OFFICIAL USE ONLY. Access shall be controlled through unique credentials, role-based permissions, and GDCapproved devices and networks.

2. Personnel shall not download, copy, photograph, transmit, or store Captured License Plate Data on personal devices, personal accounts, unapproved removable media, or unapproved cloud services.

3. Information with evidentiary value, including information that may inculpate or exculpate a person, shall be preserved in accordance with GDC evidence procedures, discovery obligations, litigation holds, and applicable records requirements.

4. Suspected compromise, unauthorized access, loss, alteration, or disclosure shall be reported immediately through supervisory and information-security channels and affected access shall be suspended when appropriate.

G. Training.

1. The LPR Administrator shall coordinate initial and annual refresher training appropriate to LPR systems through OPS In-Service training.

2. Training shall address authorized purposes, applicable law and policy, account security, query documentation, Alert verification, data limitations, privacy and civil-rights considerations, dissemination, retention, incident reporting, and equipment operation when applicable.

3. Training completion shall be documented before access is granted and shall be reviewed during annual access recertification.

H. Audits and Compliance Review.

1. The LPR Administrator or their designee shall conduct a quarterly audit of Captured License Plate Data use and LPR-related investigative applications.

2. The audit shall review any flagged activity for user authorization, ACISS Case Management System Tip/Task or Case File Report documentation, lawful purpose, query reason, Alert disposition, manual Hot List entries, External Agency access, dissemination, and retention compliance.

3. Written audit results shall be provided to the Director of OPS or authorized designee. Violations, suspicious activity, or material control failures shall be reported immediately and referred for corrective, disciplinary, administrative, or criminal review as appropriate.

4. The LPR Administrator shall periodically review this policy, vendor agreements, training, user access, and technology capabilities to ensure continuing compliance with the law and GDC requirements.

I. Data Retention and Destruction.

1. Captured License Plate Data shall be stored immediately upon collection and shall not be accessed except for a Law Enforcement Purpose.

2. Captured License Plate Data shall be destroyed no later than 30 months after original collection unless the data are retained for a documented Law Enforcement Purpose, including an active investigation, prosecution, discovery obligation, evidentiary preservation, or litigation hold. \

3. Data retained beyond 30 months shall be linked to the applicable case, purpose, preservation decision, and custodian and shall be reviewed periodically. When the authorized purpose ends and no other legal hold applies, the data shall be destroyed in an approved manner.

4. Vendors or other persons holding GDC data shall follow the same access, security, retention, audit, and destruction requirements applicable to the GDC.

5. Other investigative-application records shall be retained and disposed of under the applicable approved records retention schedule and any legal hold.

V. Attachments:

Attachment 1: License Plate Reader System Acknowledgement Form

VI. Record Retention of Forms Relevant to this Policy:

Upon completion, Attachment 1 shall be maintained in the employee’s personnel file. Captured License Plate Reader Data shall be retained for no more than 30 months, unless the data is associated with an ACISS Case Management System Tip/Task or Case File Report or preservation notice, in which case the data will be retained in accordance with the applicable retention period.