Report 2019-118 Recommendation 37 Responses

Report 2019-118: Automated License Plate Readers: To Better Protect Individuals' Privacy, Law Enforcement Must Increase Its Safeguards for the Data It Collects (Release Date: February 2020)

Recommendation #37 To: Marin County Sheriff's Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, by August 2020, Marin should develop and implement procedures for granting and managing user accounts that include, but are not limited to, requiring that supervisors must approve accounts for users, providing training to users before granting accounts, suspending users after defined periods of inactivity, and requiring regular refresher training for active users and training for users before reactivating previously inactive accounts. Marin should also ensure that it has procedures in place to deactivate an account immediately for an account holder who separates from the agency or who no longer needs a user account.

Annual Follow-Up Agency Response From September 2023

The recommended policies have been developed and implemented concerning account approval, training, suspension, and deactivation. Per MCSO Policy 426.5 the ALPR Program Manager is responsible for approving user accounts. Training will be provided to users before granting accounts, after re-activation and biannually as a refresher. Users must acknowledge review of ALPR policy and training records will be maintained by the Professional Standards Unit. These procedures are mandated by Policy 426.4, which reads: "Training will be provided prior to account creation or reactivation. Biannual refresher training will be provided to active account holders. Training records will be maintained by the Professional Standards Unit." Users will be suspended after 90 days of inactivity. Under Policy 426.4, "[i]f a user does not log into their account for 90 days, the account will automatically be deactivated. When an employee is no longer employed by the Department, their account will immediately be closed."

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The policy has been revised and/or updated. The new policy number is 429. The current policy has been provided to you via the process for submitting supporting documents.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

Marin has not addressed all aspects of the recommendation. Its current policy omits mention of supervisor approval, user training, and user refresher training.

60-Day Agency Response

Marin did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

All Recommendations in 2019-118

Agency responses received are posted verbatim.