HF4205

Purpose

This bill tightens how automated license plate reader (ALPR) data is collected, stored, and used. It creates a central role for the Bureau of Criminal Apprehension (BCA) to manage ALPR data, limits what data can be collected, strengthens privacy protections, and regulates how private entities can use ALPR data. It also sets a clear timeline to move data into a state-controlled system and sets destruction and access rules to protect individuals’ privacy.

Main provisions

• ALPR definitions and scope

  • Defines what an automated license plate reader is and notes that traffic safety camera systems are not covered by these ALPR rules.
  • Identifies law enforcement agencies as those using ALPRs.

• Centralized data management

  • The BCA becomes the central repository for all data created or received from ALPRs.
  • All ALPR data must be stored on a state-based server.
  • The bureau will allow law enforcement agencies to access this data as permitted.

• Data collection limits and privacy

  • Data collection is limited to: (1) license plate numbers, (2) date/time and location data about vehicles, and (3) pictures of plates, vehicles, and surrounding areas.
  • Most ALPR data are private or nonpublic unless they are public by law or part of an active criminal investigative data set.
  • Data matching is allowed only with Minnesota’s license plate data file, and only if related to an active criminal investigation. Data not tied to active investigations cannot be used for broad matching.
  • A central state repository of ALPR data is prohibited unless explicitly authorized by law.
  • ALPR data cannot track or monitor a person in an active criminal investigation without a warrant or, in some cases, exigent circumstances.

• Data destruction and retention

  • Data not related to an active investigation must be destroyed within 60 days (or per applicable rules).
  • If a person is charged or has a pending case, data may be preserved if requested and tied to the case number.
  • Data related to program participants (e.g., pilots or pilots’ data) must be destroyed on collection or upon request, unless the data are active investigative data.
  • Inactive criminal investigative data must be destroyed according to the state retention schedule.

• Access, audits, and cross-state sharing

  • Law enforcement access must follow existing state rules and require written authorization from a chief or head of the agency, with a documented reason tied to an active investigation.
  • Access is controlled by role-based permissions and must be recorded in an audit trail.
  • All queries and actions involving ALPR data are public to the extent allowed by law.
  • Data may not be accessed or shared outside Minnesota unless required by a court order or judicial warrant. The policy includes limits on sharing with federal agencies, other states, and private entities.

• Private use and disclosures

  • The bill regulates private use of ALPR systems, including posting signs to inform drivers that ALPR is in use.
  • Private entities may not sell, transfer, share, or disseminate ALPR data about a person or their vehicle without the person’s consent, a court order, or a judicial warrant.
  • Data from private ALPR use is treated as personal data under Minnesota law and subject to privacy protections.

• ALPR data management by the BCA (section 299C.158)

  • The BCA administers all ALPR data and must store it on a state-based server.
  • Any contracts or agreements involving ALPR data must comply with the same privacy protections.

• Private use governed by ALPR statute (section 325M.40)

  • Defines ALPR systems and clarifies that the general private-use rules apply.
  • Reiterates that ALPR data is personal data and subject to privacy protections.

• Transfer timeline

  • By December 1, 2026, all ALPR data used by law enforcement agencies must be transferred to the BCA, unless the data are active or inactive criminal investigative data.

Significant changes to current law

• Creates a single, state-wide central repository for ALPR data housed at the BCA.
• Significantly narrows what data may be collected and stored, emphasizing privacy (limited data categories; private vs. public data; mandatory destruction timelines).
• Tightens access controls and requires audit trails, with strict conditions for outside-the-state sharing.
• Introduces strict limits on private use of ALPR data, including mandatory signage, prohibitions on selling or disseminating data without consent or a court order, and classification of ALPR data as personal data.
• Establishes a firm deadline to transfer existing ALPR data to the centralized BCA system.

Potential impacts to consider

• Increased privacy protections for individuals, with tighter data retention and destruction rules.
• Greater oversight and traceability of ALPR data access and usage through audit trails.
• Reduced use of ALPR data for non-investigative purposes and stricter limits on private entities’ access.
• A potential shift in law enforcement workflows due to centralized data management and access controls.

Relevant Terms automated license plate reader, ALPR, Bureau of Criminal Apprehension, central repository, data privacy, private data, active criminal investigation, inactive criminal investigative data, data retention, destruction, data audit trail, role-based access, court order, judicial warrant, probable cause, exigent circumstances, data matching, Minnesota Statutes section 13.824, section 299C.158, section 325M.40, traffic safety camera, data sharing, signs for ALPR use, Minnesota license plate data file.