ALPR Audit Guidance
Note: The Commissioner of Administration does not have any responsibility for reviewing body camera data audits.
Legislation related to law enforcement’s use of automated license plate reader (ALPR) data went into effect in 2015. Agencies using ALPRs when the new requirements went into effect on August 1, 2015, must arrange for independent, biennial audits beginning on August 1, 2017. Upon completion of the biennial audits, the agency must submit the results of the audit to the Commissioner of Administration for review. The Commissioner may order an agency to arrange for additional independent audits upon belief that the agency is not complying with the ALPR law.
The Commissioner may issue an order of suspension upon determining that there is a pattern of substantial noncompliance by the agency. Before issuing the order, the Commissioner will provide the agency with a reasonable opportunity to respond to the audit's findings. If the Commissioner issues an order of suspension, the agency must immediately suspend operation of all ALPR devices until the Commissioner has authorized the agency to reinstate use.
What will the Commissioner look for in the audit review?
The Commissioner will review the audit of the records described in Minnesota Statutes, section 13.824, subd. 6(a)-(b).
The law enforcement agency must maintain records showing the date and time automated license plate reader data were collected and the applicable classification of the data.
Records and Data Subject to the Biennial Audit
Whether data currently in the records are classified
- Whether data currently in the records are classified
- How the data are used
- Whether data are destroyed as required under section 13.824
- Verification of compliance with section 13.824, subd. 7
All data collected by an ALPR are private or nonpublic data unless the data are public under section 13.82, subd. 2, 3, or 6, or are active criminal investigative data under section 13.82, subd. 7.
The following checklist will assist agencies in preparing for the biennial audits.
- Document the date and time ALPR data were collected
- Document data classification of the ALPR data Minn. Stat. § 13.824, subd. 2(b)
- Document how the data are used
- Document data retention policies and any data destruction Minn. Stat. § 13.824, subd. 3(a)
- Establish procedures assuring data accuracy, protection, and appropriate access and incorporate the procedures into a policy Minn. Stat. §§ 13.284, subd. 7(a); 13.05, subd. 5
- Comply with data breach notification requirements, as applicable Minn. Stat. §§ 13.824, subd. 7(a); 13.055
- Establish written procedures to ensure ALPR data are accessed only if authorized in writing by the agency head (or a designee) for a legitimate, specified, and documented law enforcement purpose Minn. Stat. § 13.824, subd. 7(b)
- Provide for role-based access to ALPR data and record activity in an audit trail Minn. Stat. § 13.824, subd. 7(c)
What other areas of compliance does the law require?
In addition to those areas subject to audit and the commissioner’s audit review, law enforcement agencies must comply with the following requirements related to ALPR data collection, use, and dissemination.
- Limit ALPR data collection to the following. Collecting other data is prohibited.
- License plate numbers
- Date, time, and location data on vehicles
- Pictures of license plates, vehicles, and areas surrounding the vehicles
- Minn. Stat. § 13.824, subd. 2(a)(1)-(3)
- Match ALPR data only with data in the Minnesota license plate data file, unless the data relate to an active criminal investigation. Minn. Stat. § 13.824, subd. 2(c)
- Participate in a central state repository of ALPR data only if explicitly authorized by law. Minn. Stat. § 13.824, subd. 2(c)
- No use of an ALPR to monitor or track the subject of an active criminal investigation unless authorized by a warrant or exigent circumstances justify the use without a warrant. Minn. Stat. § 13.824, subd. 2(d)
- Appropriate sharing of ALPR data with other law enforcement. Minn. Stat. § 13.824, subd. 4
- Maintain a public log of use. NOTE: The 60-day retention requirement applicable to data collected by an ALPR does not apply to the public log of use. The retention period for the public log is set by an agency’s approved records retention schedule under section 138.17. Minn. Stat. § 13.824, subd. 5(a)
- Maintain a public list of the current and previous fixed stationary ALPR locations, unless the agency determines that the data are security information. Minn. Stat. § 13.824, subd. 5(b)
- Notify the Bureau of Criminal Apprehension (BCA) within ten days of the installation or current use of an ALPR. Minn. Stat. § 13.824, subd. 8(a)