License Plate Reader Data Retention
Staff recommends that the Mayor and Council receive information about data retention for License Plate Readers and instruct staff on next steps.
Change in Law or Policy
Under current policy, the Rockville Police Department is part of the Montgomery County Mobile Data Terminal (MDT) System. As a result, the data from the License Plate Readers on City of Rockville patrol vehicles is automatically transferred electronically to Montgomery County and subsequently under the County's control and retention policies. A change in retention of City of Rockville LPR data may impact the current partnership with Montgomery County on the MDT System.
The Mayor and Council included this item on the agenda in response to questions and concerns raised by Councilmember Moore about the length of time that data from the City's License Plate Readers (LPR) is retained by Montgomery County. Councilmember Moore suggested that individuals with expertise in this area be invited to participate in the Mayor and Council meeting on March 11. The following individuals will be in attendance:
- Ken Matney, Police Corporal, Rockville City Police Department
- Russ Hamill, Assistant Chief, Montgomery County Department of Police
- Ginger McCall, Open Government Director, Electronic Privacy Information Center (EPIC)
- David Rocah, Staff Attorney, ACLU of Maryland
To support the Mayor and Council's discussion of this matter, staff is providing background information about the City of Rockville LPR program (Attachment A). This information, as well as other data, was shared with the Mayor and Council in August 2012 in response to questions about LPRs and data retention.
The City of Rockville participates in the Metropolitan Capitol Region License Plate Recognition System Program along with all other police agencies in Montgomery County (Montgomery County Police Department, City of Gaithersburg Police Department, Village of Chevy Chase Police Department, and Takoma Park Police Department). LPR systems consist of high speed cameras, combined with sophisticated computer algorithms capable of converting the image of a vehicle's license plate into computer readable data. The system compares license plate numbers and letters to a "Hot List" provided by the State of Maryland and notifies the police officer when a license plate from the "Hot List" is identified. The LPR is used for crime analysis, crime investigation (such as stolen vehicles, stolen tags, and wanted and missing persons), and Homeland Security functions.
The City of Rockville received three LPR systems through a FY 2008 Homeland Security UASI ( Urban Areas Security Initiative) grant from the Metropolitan Washington Council of Governments and coordinated through the Arlington, Virginia Police Department. Rockville's LPR system was implemented in 2009. The LPR units are mounted to three Rockville Police patrol vehicles with the data automatically entered in the vehicle's MDT. The data remains in the vehicle's MDT for 30 days and is then automatically erased from the terminal. There is no ongoing repository of the LPR data with the Rockville City Police Department. Since Rockville is part of the Montgomery County MDT System, the data from the terminals in the three Rockville patrol vehicle outfitted with LPR units is automatically transferred from the terminal to the Montgomery County Police Department at the end of each tour of duty. It is then subject to the County's repository methods and retention policies.
Local Retention Policies
Councilmember Moore's concerns relate to the length of time that data from the three City of Rockville LPR units is retained. Staff collected retention data from other area police agencies and shared it with the Mayor and Council last August.
Montgomery County Police Department - A new County LPR policy became effective in January 2013 (Attachment B). Section V. Dissemination and Retention of Data states:
"Data is to be purged from the files when it has been determined that one or more of the following conditions exist:
1. The data is no longer relevant or necessary to the goals and objectives of this directive.
2. The data cannot be utilized for any present and/or future law enforcement purpose to assist in the furtherance of criminal investigations. Data stored in case files are exempt from this requirement."
Gaithersburg and Chevy Chase Village Police Departments - Gaithersburg and Chevy Chase Village use the same approach to data retention as the City of Rockville. Data is retained for 30 days on the MDT and is then automatically deleted. Gaithersburg and Chevy Chase also participate in the County's MDT System so their LPR data is also downloaded daily into the Montgomery County Mobile Data System.
Takoma Park Police Department - LPR data is retained in-house for 30 days and then is deleted.
Maryland Coordination and Analysis Center (MCAC) or the Fusion Center - MCAC coordinates the efforts of federal, state and local agencies to gather, analyze, and share intelligence information with law enforcement, public health, and emergency responder personnel. The Montgomery County Police Department is charged with transferring LPR data from Rockville, Gaithersburg, and Chevy Chase Village to the MCAC. MCAC stores the LPR data (separate from all other data it collects) for one year. After one year, the data is purged unless it has become, or it is reasonable to believe that it will become, evidence.
Additional Information for Discussion and Consideration
1) What is the impact of Rockville adopting a different retention policy from Montgomery County? What flexibility is in the mobile data system to allow Montgomery County Police to delete selected data records?
The MDT partnership that Rockville, Gaithersburg, and Chevy Chase Village have with Montgomery County impacts the length of time that data from the municipalities is retained. Councilmember Moore inquired whether Rockville's Police Department data could be tagged and deleted on a different schedule than the remainder of the data in Montgomery County's system. When asked six months ago, the County Police Department responded that it would be possible to delete Rockville data, but it would be extremely labor intensive because the system has no ability to assign separate purge dates for specific police agencies. Subsequent conversations indicate that there may be a more efficient method of identifying and deleting Rockville data.
It was also noted that Rockville data forwarded by the County to the MCAC remains subject to the MCAC retention policies.
2) Are there policies and procedures in place to protect LPR data while retained by public safety agencies?
The MCAC Standard Operating Procedure for the LPR Program addresses the sensitivity of private information collected and retained in their system. The MCAC Standard Operating Procedure (Attachment C) states:
"The MCAC collects information in a manner consistent with applicable laws, regulations, and internal policies. Collected information is analyzed and distributed in order to provide tactical, operational, and/or strategic intelligence on the existence, identities, and capabilities of criminal suspects or enterprises. In accordance with these principles, LPR data will be queried and disseminated only if there is legal process requiring these actions or there is reasonable suspicion that an individual or enterprise is involved in criminal conduct or activity and the information is relevant to that criminal conduct or activity and the requestor has a legitimate need to know."
All data is subject to the MCAC Privacy Protection Policy and subject to audit and evaluation at least annually through an independent auditor. The Standard Operating Procedures also states that all transactions and queries of the LPR data system are subject to review at any time and anyone found to misuse the system is subject to disciplinary action.
Montgomery County's new policy also addresses appropriate use and security of LPR data. Use of the data is restricted to offical law enforcement purposes and the files are audited on a regular basis. The County police would also be subject to the MCAC policy as part of the agreement to participate in the program.
3) Is there analysis or data available on data retention policies or the public's view of LPR data retention?
Staff completed preliminary research that was shared with the Mayor and Council in August 2012. Two reports were identified that address public input on data retention.
Attachment D provides the License Plate Recognition Technology (LPR) Impact Evaluation and Community Assessment by the Center for Evidence Based Crime Policy at George Mason University. The assessment included a survey conducted in Fairfax County, Virginia of 2000 randomly selected residential households. The survey asked respondents "Do you think that your local police should save the LPR data?" Of the responses:
- 23% indicated that the data should not be saved
- 23% indicated that it should be saved but only for a short period of time (for example, 1 month)
- 30.5% indicated that it should be saved for about 6 months
- 23.5% indicated that it should be saved until the police want to erase it.
The survey also asked "If it can help in solving crimes, do you think that your local police should save LPR data?"
- 16.9% indicated that the data should not be saved
- 16.4% indicated that it should be saved but only for a short period of time (for example, 1 month)
- 30.5% indicated that it should be saved for about 6 months
- 36.2% indicated that it should be saved until the police want to erase it.
Attachment E provides the Privacy impact assessment report for the utilization of license plate readers, prepared by the International Association of Chiefs of Police (IACP) in September 2009. In Part 6. Retention of LPR data, the report recognizes that collection and retention of the data can create some privacy concerns and can create potential for misuse or accidental disclosure of data. At the same time, there is a concern that deleting or destroying information could impede investigations and potentially result in fewer cases being solved.
The IACP research found that data retention laws vary from state to state and there is no formula, standards, or guidelines for policy making and determining how long LPR data should be retained. The IACP suggests five criteria that could be applied when setting a retention period, including the following:
- Statutes of limitation
- Potential future usefulness of the LPR data
- Relative sensitivity of the LPR data
- Quality of LPR data
- Technologically implemented policy controls
The report concludes that a comprehensive study of LPR data practices may be necessary to identify standards for retention periods.
Mayor and Council History
This is the first time this item has been brought before the Mayor and Council.
The material in this agenda item provides background information about License Plate Recognition systems and Councilmember Moore's questions and concerns about LPR data retention. If the Mayor and Council determine that additional information or action is warranted after reviewing this information and having the chance to hear from the invited panelists, staff requests specific direction in order to determine appropriate next steps.
Approved on: 03/07/2013