SCOPE

This policy governs the use of automated license plate reader systems and information (ALPR) by the UC San Diego Department of Transportation Services (Transportation Services) on any property owned, leased, or controlled by the University of California San Diego.

 

POLICY SUMMARY

 

Enacted to support the campus parking function, this policy governs the use of ALPR by Transportation Services.

 

This policy serves as the usage and privacy policy required by CA Civil Code §§ 1798.90.51 through 1798.90.53 to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR Information is consistent with federal, state, and local law and local practices.  

 

DEFINITIONS

ALPR means ALPR System and Information collectively.

ALPR Information means information or data collected using an ALPR system.

ALPR System means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. 

Authorized Users means the only individuals permitted to install, operate, or search within the Transportation ALPR System.

Campus ALPR Authority is the UC San Diego campus official who authorizes and oversees the operation of ALPR Systems and use of ALPR Information. 

Major Change(s) are changes that could have a substantial effect on the privacy of individuals or security or governance of ALPR Systems or Information, including but not limited to changes related to ownership, modification of scope, uses of AI, risk assessments, vulnerabilities, or material updates or shifts in technologies, or changes to privacy or ALPR laws and regulations.

Transportation ALPR System is the ALPR System procured by Transportation Services to monitor campus parking.

 

POLICY STATEMENT

 

Transportation Services may utilize the Transportation ALPR System only as described below.

 

I.                Authorized purposes

Transportation Services may use the Transportation ALPR Systems to:

 

A.     Enforce UC San Diego parking requirements by verifying payment and permits;  

B.     Count the number of vehicles in a particular area;

C.    Manage access to roads and parking areas;

D.    To identify vehicles parked on UC San Diego property; and

E.     Monitor duration of vehicle stay

 

II.              Training

Authorized Users of the Transportation ALPR System must complete the following required trainings:

 

A.     Manufacturer training and certification on the ALPR System;

B.     UC San Diego Privacy 101 Workshop or Privacy @ UC San Diego training; and

C.    Annual UC Cyber Security Training Certification

 

III.             Privacy and Security of Transportation ALPR System

Any installation of an ALPR System or new use of ALPR Information must undergo a privacy and security review by the Campus Privacy Office and the Office of Information Assurance, respectively, for Protection Level 4 as described in BFB-IS-3: Electronic Information Security Policy prior to implementation and upon any Major Changes to the system, vendor, or processes for access. The Campus ALPR Authority must ensure that Authorized Users, defined below, use administrative, operational, technical, and physical safeguards to protect ALPR information from unauthorized access, use, destruction, modification, or disclosure, including the following minimum safeguards: 

 

A.     Administrative: Username and password-protected access, with multi-factor authentication, to the ALPR System. Monitoring and auditing usage of database and ALPR Information. Appropriate training and access controls.  

 

B.     Physical: Secure storage of computers with access to database. Physical access is limited to Authorized Users.

 

C.    Technical: All information will be encrypted both in transit and when stored on the ALPR server.  

 

IV.            Sharing of ALPR Information.

 

Sharing, disclosing, publishing, providing access to, selling, or exchanging of ALPR Information from the Transportation ALPR System outside of Transportation Services, AMAS, or IT staff assigned to Transportation Services is prohibited, except (a) in cases of a significant and articulable threat to health or safety, (b) where there is explicit consent of the data subject(s), or (c) where required by law, court order, or search warrant.

 

Public access:  ALPR Information shall be made public or deemed exempt from public disclosure pursuant to state or federal law. Information related to the maintenance and governance of ALPR Systems and access to ALPR Information shall be available for public disclosure, in accordance with applicable law. Information that might compromise or might plausibly be used to compromise the security or integrity of the ALPR Systems will not be disclosed to the public.

 

V.              ALPR Information Requirements.

 

A.     ALPR Information in the Transportation ALPR System will be retained no longer than the close of business on the business day following 24 hours after collection, unless one of the exceptions in Section IV applies.

 

B.     ALPR Information may be aggregated and kept for legitimate business needs, such as parking occupancy information, lot turnover rates, and general parking activity data.

 

C.    Accuracy of Data. The Transportation ALPR System is automated such that license plate images and details of collection are captured without human review. Consequently, recorded license plate information may be incomplete or inaccurate. Transportation Services will endeavor to correct errors when identified by manually reviewing the license plate or plate image to avoid issuing erroneous parking citations.

 

RESPONSIBILITIES

 

I.                Implementation and Enforcement.

The Vice Chancellor Resource Management & Planning (VC-RMP) is the Campus ALPR Authority and is responsible for implementing this policy in accordance with California Civil Code 1798.90.51. The VC-RMP may delegate the role of Campus ALPR Authority, except that duties may not be delegated to Transportation Services or the UC Police Department, but the role may not be further redelegated.

II.              Authorized Users

The following are the only Authorized Users of the Transportation ALPR System(s) for the following activities:

 

A.     Installation, operation, and maintenance: Personnel directly engaged in or responsible for the oversight of parking enforcement, ALPR vendor technicians, and UC San Diego technical personnel responsible for maintaining ALPR components.

 

B.     Search: Personnel directly engaged in or responsible for the oversight of parking enforcement.

 

C.    Monitoring, auditing, and oversight: As described below.

 

III.             Auditing and Oversight

 

A.     Transportation Services shall be responsible for storing and monitoring all logins and queries of the Transportation ALPR System, as required by CA Civil Code 1798.90.52. At a minimum, the following information must be maintained for every query of the ALPR system: username; the date and time of access, the purpose for the access, and the license plate number or other data element(s) used to query the ALPR System. 

 

B.     UC San Diego departments with Authorized Users must conduct periodic monitoring to review access rules, logs, configuration, and to confirm active individual accounts. The Campus ALPR Authority or their designee will periodically monitor querying activity via electronic logs to ensure searches are tied to legitimate transactions and other aforementioned business needs. In accordance with the UC San Diego Records Retention Schedule, Audit Logs will be retained for 8 years and then destroyed. Records pertaining to pending, foreseeable or ongoing litigation, an investigation, ongoing audit, or a request for records will be maintained in accordance with the University’s Records Management Program guidelines and instructions from legal counsel. 

 

IV.            Contracting

Procurement is responsible for ensuring that contracts comply with this Policy.

 

V.              Publication and Posting

 

A.     In accordance with CA Civil Code 1798.90.53, the ALPR Policy must be publicly published. Policy and Records Administration will ensure that this policy is properly posted. The Director of Parking will ensure that this policy is posted conspicuously on the Parking and Transportation Services website.

 

B.     Director of Parking is responsible for ensuring that a public notice is posted at the entrance(s) of any facility with fixed ALPR cameras associated with Transportation ALPR System(s).

 

PROCEDURES

None.

FORMS

 

None.

 

RELATED INFORMATION

CA Civil Code § 1798.90.5 

CA Civil Code § 1798.90.51 

CA Civil Code § 1798.90.52

CA Civil Code § 1798.90.53 

CA Civil Code § 1798.90.55 

CA Civil Code § 1798.29(g) (1) (F).  

University of California PPSM-21 Selection and Appointment. 

UC Protection Level Classification Guide 

UC Institutional Information Disposal Standard 

UC San Diego Policy and Procedure Manual PPM135-3 Network Security 

UC Records Retention Schedule

 

FREQUENTLY ASKED QUESTIONS (FAQ’S)

 

None.

 

 

REVISION HISTORY

This policy was issued June 14, 2024.