License Plate Reader Policy

Flock Safety License Plate Reader Usage and Privacy Policy

Definitions

License plate reader (LPR) system: a system of one or more automated high-speed cameras used in combination with data processing to convert images of vehicles and license plates into computer-readable data.  

LPR alert: a notification generated by an LPR system indicating that a vehicle passed a LPR camera with a license plate or vehicle characteristics that match data held by the National Crime Information Center, the National Center for Missing and Exploited Children, or other database or hot list.

LPR data: Information collected by the LPR system, which is as follows:

• License plate image 
• Vehicle image 
• Vehicle characteristics (e.g. vehicle color, make)
• License plate number
• License plate state
• Date
• Time
• Camera Location

Purposes: The purpose of Flock Safety’s LPR system is to enhance public safety and security and to help customers obtain objective evidence in order to solve crime. 

Access: 

Each Flock Safety customer will designate one or more “administrators” who are the custodians and head administrators of the LPR systems and its operation. Each customer’s data is accessible to the administrator(s) and designees.

To provide customer support and address system issues, Flock Safety has designated CJIS-certified engineers who are able to access customer LPR systems.

All queries of the LPR system will be stored for auditing purposes, including:

• Username
• Date
• Time
• Purpose of query
• License plate and other elements used to query the system

This data is stored in the Flock Safety system to facilitate audits conducted according to the policies of each Flock Safety customer, in order to ensure access was made by authorized persons for legitimate purposes and in compliance with law and policy.

Training: LPR system users receive training from Flock Safety on the proper use of the system prior to being granted access to the LPR system.

Security: Flock Safety uses industry-leading safeguards to protect LPR data from unauthorized access, use, destruction, modification, or disclosure. Flock Safety’s information security policy and safeguards align with the security requirements established by NIST Cybersecurity and CISA Secure By Design. These include:

• Mulit-factor authentication on privileged administrator and customer accounts;
• End-to-end encryption of data from camera to cloud storage with industry validated cryptography;
• Role-based access controls to limit access to the least privileged necessary for customers;
• Continuous security scanning and remediation of vulnerabilities on public facing infrastructure;
• Audit logging and monitoring  of user activity and system services to identify anomalies;
• Processes for researchers to report vulnerabilities for company responsible and public disclosure; and
• Third party attestations to compliance requirements for SOC 2 and ISO 27001.

Quality Assurance: Flock LPRs have a high rate of accuracy; because of Flock’s machine learning technology, these rates continue to improve over time. Additionally, the cameras self-monitor to ensure connectivity and functionality, and low-confidence plate reads trigger cautionary alerts to the user. Although infrequent, license plate translation may be incomplete or inaccurate. False positives are flagged to continuously improve the system. Users should confirm the computer translation prior to taking any action based on an LPR alert or search.

Flock Safety stores the LPR data (data hosting) and ensures proper maintenance and security of data stored in their cloud-based system. 

Ownership and Release of LPR Data: Information gathered or collected and records retained by the Flock Safety system on behalf of Flock Safety customers is owned by the customer. This data will not be:

• Sold, published, exchanged, or disclosed for commercial purposes.
• Disclosed or published without authorization.
• Disseminated to persons not authorized to access or use the information.

However, Flock Safety may access, use, preserve and/or disclose the LPR data to law enforcement authorities, government officials, and/or third parties, if legally required to do so or if Flock Safety has a good faith belief that such access, use, preservation or disclosure is reasonably necessary to: (a) comply with a legal process or request; (b) enforce Flock Safety’s terms and conditions executed with the customer, including investigation of any potential violation thereof; (c) detect, prevent, or otherwise address security, fraud or technical issues; or (d) protect the rights, property or safety of Flock Safety, its users, a third party, or the public as required or permitted by law, including responding to an emergency situation.

Data Retention: LPR data is stored briefly on the camera and then transferred to the AWS Government Cloud. LPR is hard deleted on a rolling 30 day basis. This is Flock Safety’s default retention schedule; it may be increased or decreased on a case-by-case basis if a different schedule is required by a customer’s law or policy. 

Privacy: This policy governs the LPR system provided by Flock Safety. 

The images stored in the system are collected from areas visible to the public where there is no reasonable expectation of privacy. 

Flock Safety’s privacy policy is available here. 

Official Custodian: Davis Lukens, Chief Technology Officer, Flock Safety.

‍