Merced police still sharing license plate data in violation of CA law, after review
AI-generated summary reviewed by our newsroom.
- An review found Merced PD had shared ALPR data with out‑of‑state and federal agencies.
- City report still lists federal agencies and out‑of‑state agencies with access.
- SB 34 requires ALPR privacy and security.
This week, an internal audit found that the Merced Police Department has been sharing its automated license plate reader data with several out-of-state and federal agencies, in violation of a California law that prohibits sharing the information outside the state.
In a statement Thursday, the department said it “immediately disabled” sharing with the federal agencies it identified. But the updated list released after the internal review shows the department is still violating law.
Automated license plate reader technology is a tool law enforcement uses to recover stolen vehicles, locate missing persons and identify vehicles connected to violent crimes.
The Merced Police Department conducted a review after Sun-Star and Modesto Bee reporting revealed that UC Merced Police Department ALPR data was being shared with over 100 out-of-state agencies and some federal agencies.
The city of Merced released the following statement about the audit: “In the interest of transparency, the Merced Police Department is addressing recent concerns regarding automated license plate reader (ALPR) data sharing.
“Following these reports, the Merced PD conducted a comprehensive internal review of its ALPR system. That review determined that prior system configurations allowed data sharing with certain federal agencies. Upon identifying this issue, the Department immediately disabled the identified connections and will continue to conduct additional audits to ensure ongoing compliance.”
The statement did not specifically address whether any nonfederal out-of-state agencies have access to the city’s ALPR data.
The next morning, the city published its data sharing report from the vendor of the ALPR devices, Motorola Solutions — the same vendor used by the UC Merced Police Department.
While the department said it disabled sharing with “identified connections,” the report uploaded the next morning still shows a handful of federal agencies, including the U.S. Marshals Service and the Bureau of Indian Affairs, and over a dozen out-of-state agencies have access to the data.
Merced’s public information officer, Jennifer Flachman, described the Motorola report as the “clean list” after the initial review and removal of some federal agencies.
California law limits data sharing
Senate Bill 34, which went into effect in 2016, requires operators of ALPR systems to implement strict privacy and security policies, maintain access logs and protect license plate data as sensitive personal information that cannot be sold to private parties.
In 2023, the state Attorney General’s Office issued guidelines, reminding agencies of their obligation to ensure their data cannot be shared with agencies outside of California.
Sharing ALPR data concerns privacy advocates, because of its potential to unintentionally aid federal or out-of-state agencies with enforcing immigration law and abortion bans, among other things.
For example, if someone traveled from Texas to California in order to get an abortion, any one of the Texas agencies that have access to the data could easily determine that she was in another state.
Earlier this month, 404 Media reported that Florida’s Fish and Wildlife Conservation Commission police were performing dozens of license plate lookups on Flock cameras for ICE.
Merced PD vows to get in alignment with policy and law
In a written response, Flachman answered additional questions about its use of ALPR technology.
The city has been using these tools for “many years” and deploys a “limited number of ALPR cameras” throughout Merced. The department declined to state the exact number of cameras in use and would not share specific locations “to maintain the effectiveness of investigations.”
In its response, the city did explain that the settings for the technology were never formally audited after configuration and that “the department has since established a review and oversight process to ensure continued compliance.”
The data is stored in accordance with department policy and California law, the city said, but it did not specify the exact length of the data retention period. It did say that data not subject to such requirements is deleted in accordance with the retention timeline.
Because the data sharing report published by the city still includes many out-of-state agencies and some federal agencies, the Sun-Star asked about why those agencies were not removed in the audit. The city responded that “upon identifying the issue, the department immediately disabled data sharing and will continue to conduct additional audits to ensure all data sharing aligns with Department policy … (and) California law.”
