License Plate Reader Policy

Flock Safety License Plate Reader Usage and Privacy Policy

Definitions:

License plate reader (LPR) system: a system of one or more automated high-speed cameras used in combination with data processing to convert images of vehicles and license plates into computer-readable data.  

LPR alert: a notification generated by an LPR system indicating that a vehicle passed an LPR camera with a license plate or vehicle characteristics that match data held by the National Crime Information Center, the National Center for Missing and Exploited Children, or other database or hot list.

LPR data: Information collected by or stored in the LPR system, which includes the following:

• License plate image 
• Vehicle image 
• Vehicle characteristics (e.g. color, make)
• License plate number
• License plate state
• Date
• Time
• Camera location

Authorized Purposes: The purpose of Flock Safety’s LPR system is defined under “Permitted Purpose” in Flock Safety’s Terms and Conditions. 

Authorized Users and Access: 

Each Flock Safety customer designate one or more “administrators” who are the custodians and head administrators of the LPR systems and its operation. Each customer’s data is accessible to the administrator(s) and authorized end-users (together, “users”).

To provide customer support and address system issues, Flock Safety has designated CJIS-certified engineers who are able to access CJIS data and other designated individuals who are able to access other system data (“priveledged administrators”).

All queries of the LPR system are stored for auditing purposes, including:

• Username
• Date
• Time
• Purpose of query
• License plate and other elements used to query the system

This data is stored in the Flock Safety system to facilitate audits conducted according to the policies of each Flock Safety customer, in order to ensure access was made by authorized persons for legitimate purposes and in compliance with law and policy. Flock Safety encourages customers to adopt a use policy and implement a regular auditing schedule. 

Training: Flock Safety provides training to LPR system users on the proper use of the system. Flock Safety encourages customers to implement additional training for its users. Flock Safety employees are required to complete regular cybersecurity trainings. 

Security and Monitoring: Flock Safety uses industry-leading safeguards to protect LPR data from unauthorized access, use, destruction, modification, or disclosure. Flock Safety’s information security policy and safeguards align with the security requirements established by NIST Cybersecurity and CISA Secure By Design. Examples of safeguards include:

Operational:

• Audit logging and monitoring to identify anomalies.
• Continuous security scanning and remediation of vulnerabilities on public facing infrastructure.
• Role-based access controls to limit access based on functional need.
  

Administrative:

• Processes to report vulnerabilities for responsible and public disclosure.
• Third party attestations to requirements for SOC 2 Type II and ISO 27001.
• Personnel screening for engineers with access to cloud infrastructure.
  

Technical:

• Hardware based multi-factor authentication for privileged administrators.
• Software based multi-factor (TOTP) authentication for customer accounts.
• End-to-end encryption of data from camera to cloud storage with industry validated cryptography.

Physical: 

• Storage and processing of customer data in AWS US based cloud infrastructure.
• Safeguards to mitigate device tampering and vulnerabilities in firmware.
• Visitor controls, security personnel, and escort procedures for warehouses and sensitive areas.

Restrictions on the Sale, Sharing, or Transfer of LPR Data: LPR data gathered by the Flock Safety system on behalf of Flock Safety customers is owned by the customer. Customers choose whether to share LPR data with other customers in accordance with their laws and policies. Flock Safety will not:

• Sell, publish, exchange, or disclose customer’s LPR data for commercial purposes.
• Disclose or publish LPR data without authorization, unless required by law.
• Disseminate LPR data to persons not authorized to access or use the information.

In accordance with its Terms and Conditions, Flock Safety may access, use, preserve and/or disclose the LPR data to law enforcement authorities, government officials, and/or third parties, if legally required to do so or if Flock has a good faith belief that such access, use, preservation or disclosure is reasonably necessary to comply with a legal process, enforce the agreement between Flock and the customer, or detect, prevent or otherwise address security, privacy, fraud or technical issues. Additionally, Flock uses a fraction of LPR images (less than one percent), which are stripped of all metadata and identifying information, solely for the purpose of improving Flock Services through machine learning. 

Official Custodian: Davis Lukens, Chief Technology Officer, Flock Safety.

Accuracy: Flock LPRs have a high rate of accuracy; because of Flock’s machine learning technology, these rates continue to improve over time. Additionally, the cameras self-monitor to ensure connectivity and functionality, and low-confidence plate reads are not sent to the user. Although infrequent, license plate translation may be incomplete or inaccurate. False positives are flagged to continuously improve the system. Users should confirm the computer translation prior to taking any action based on an LPR alert or search.

Data Retention: LPR data is stored briefly on the camera and then transferred to the AWS Government Cloud. LPR data is hard deleted on a rolling 30-day basis by default; this may be increased or decreased on a case-by-case basis if a different schedule is required by a customer’s law or policy. 

Privacy: This policy governs the LPR system provided by Flock Safety. 

The images stored in the system are collected from areas visible to the public where there is no reasonable expectation of privacy. 

Flock Safety’s privacy policy is available here. 

‍