SCOPE
This policy governs theuse of automated license plate reader systems and information (ALPR) by the UCSan Diego Department of Transportation Services (Transportation Services) onany property owned, leased, or controlled by the University of California SanDiego.
POLICY SUMMARY
Enactedto support the campus parking function, this policy governs the use of ALPR byTransportation Services.
This policy serves asthe usage and privacy policy required by CA Civil Code 1798.90.51 through1798.90.53 to ensure that the collection, use, maintenance, sharing, anddissemination of ALPR Information is consistent with federal, state, and locallaw and local practices.
DEFINITIONS
ALPR means ALPRSystem and Information collectively.
ALPR Information means information ordata collected using an ALPR system.
ALPR System means a searchablecomputerized database resulting from the operation of one or more mobile orfixed cameras combined with computer algorithms to read and convert images ofregistration plates and the characters they contain into computer-readabledata.
Authorized Users means the onlyindividuals permitted to install, operate, or search within the TransportationALPR System.
CampusALPR Authorityis the UC San Diego campus official who authorizes and oversees the operationof ALPR Systems and use of ALPR Information.
Major Change(s) are changesthat could have a substantial effect on the privacy of individuals or security orgovernance of ALPR Systems or Information, including but not limited to changesrelated to ownership, modification of scope, uses of AI, risk assessments,vulnerabilities, or material updates or shifts in technologies, or changes toprivacy or ALPR laws and regulations.
TransportationALPR Systemis the ALPR System procured by Transportation Services to monitor campusparking.
POLICY STATEMENT
Transportation Servicesmay utilize the Transportation ALPR System only as described below.
I. Authorizedpurposes
Transportation Servicesmay use the Transportation ALPR Systems to:
A. EnforceUC San Diego parking requirements by verifying payment and permits;
B. Countthe number of vehicles in a particular area;
C. Manageaccess to roads and parking areas;
D. Toidentify vehicles parked on UC San Diego property; and
E. Monitorduration of vehicle stay
II. Training
Authorized Users of the Transportation ALPR System mustcomplete the following required trainings:
A. Manufacturer trainingand certification on the ALPR System;
B. UC San Diego Privacy101 Workshop or Privacy @ UC San Diego training; and
C. Annual UC CyberSecurity Training Certification
III. Privacyand Security of Transportation ALPR System
Any installationof an ALPR System or new use of ALPR Information must undergo a privacyand security review by the Campus Privacy Office and the Office of InformationAssurance, respectively, for Protection Level 4 as described in BFB-IS-3: Electronic InformationSecurity Policy prior to implementation and upon any Major Changesto the system, vendor, or processes for access. The Campus ALPR Authority mustensure that Authorized Users, defined below, use administrative, operational,technical, and physical safeguards to protect ALPR information fromunauthorized access, use, destruction, modification, or disclosure, includingthe following minimum safeguards:
A. Administrative:Username and password-protected access, with multi-factor authentication, tothe ALPR System. Monitoring and auditing usage of database and ALPR Information.Appropriate training and access controls.
B. Physical:Secure storage of computers with access to database. Physical access is limitedto Authorized Users.
C. Technical: Allinformation will be encrypted both in transit and when stored on the ALPRserver.
IV. Sharingof ALPR Information.
Sharing, disclosing, publishing, providing access to,selling, or exchanging of ALPR Information from the Transportation ALPR Systemoutside of Transportation Services, AMAS, or IT staff assigned toTransportation Services is prohibited, except (a) in cases of a significant andarticulable threat to health or safety, (b) where there is explicit consent ofthe data subject(s), or (c) where required by law, court order, or search warrant.
Public access: ALPR Information shall be madepublic or deemed exempt from public disclosure pursuant to state or federallaw. Information related to the maintenance and governance of ALPR Systems andaccess to ALPR Information shall be available for public disclosure, inaccordance with applicable law. Information that might compromise or mightplausibly be used to compromise the security or integrity of the ALPR Systemswill not be disclosed to the public.
V. ALPRInformation Requirements.
A. ALPR Information in theTransportation ALPR System will be retained no longer than the close ofbusiness on the business day following 24 hours after collection, unless one ofthe exceptions in Section IV applies.
B. ALPR Information may beaggregated and kept for legitimate business needs, such as parking occupancyinformation, lot turnover rates, and general parking activity data.
C. Accuracy of Data. TheTransportation ALPR System is automated such that license plate images anddetails of collection are captured without human review. Consequently, recordedlicense plate information may be incomplete or inaccurate. TransportationServices will endeavor to correct errors when identified by manually reviewingthe license plate or plate image to avoid issuing erroneous parking citations.
RESPONSIBILITIES
I. Implementationand Enforcement.
The Vice Chancellor Resource Management & Planning (VC-RMP) isthe Campus ALPR Authority and is responsible for implementing this policy inaccordance with California Civil Code 1798.90.51. The VC-RMP may delegate therole of Campus ALPR Authority, except that duties may not be delegated toTransportation Services or the UC Police Department, but the role may not befurther redelegated.
II. Authorized Users
The following are theonly Authorized Users of the Transportation ALPR System(s) for the followingactivities:
A. Installation, operation,and maintenance: Personnel directly engaged in or responsible for the oversightof parking enforcement, ALPR vendor technicians, and UC San Diego technicalpersonnel responsible for maintaining ALPR components.
B. Search: Personneldirectly engaged in or responsible for the oversight of parking enforcement.
C. Monitoring,auditing, and oversight: As described below.
III. Auditingand Oversight
A. Transportation Servicesshall be responsible for storing and monitoring all logins and queries of theTransportation ALPR System, as required by CA Civil Code 1798.90.52. At aminimum, the following information must be maintained for every query of theALPR system: username; the date and time of access, the purpose for the access,and the license plate number or other data element(s) used to query the ALPRSystem.
B. UC San Diegodepartments with Authorized Users must conduct periodic monitoring to reviewaccess rules, logs, configuration, and to confirm active individual accounts.The Campus ALPR Authority or their designee will periodically monitor queryingactivity via electronic logs to ensure searches are tied to legitimatetransactions and other aforementioned business needs. In accordance with the UC San Diego Records Retention Schedule,Audit Logs will be retained for 8 years and then destroyed. Records pertaining topending, foreseeable or ongoing litigation, an investigation, ongoing audit, ora request for records will bemaintained in accordance with the University&s Records Management Programguidelines and instructions from legal counsel.
IV. Contracting
Procurement isresponsible for ensuring that contracts comply with this Policy.
V. Publicationand Posting
A. In accordance with CACivil Code 1798.90.53, the ALPR Policy must be publicly published. Policy andRecords Administration will ensure that this policy is properly posted. TheDirector of Parking will ensure that this policy is posted conspicuously on theParking and Transportation Services website.
B. Director of Parking isresponsible for ensuring that a public notice is posted at the entrance(s) ofany facility with fixed ALPR cameras associated with Transportation ALPRSystem(s).
PROCEDURES
None.
FORMS
None.
RELATED INFORMATION
CACivil Code 1798.90.5
CACivil Code 1798.90.51
CACivil Code 1798.90.52
CACivil Code 1798.90.53
CACivil Code 1798.90.55
CACivil Code 1798.29(g) (1) (F).
University ofCalifornia PPSM-21 Selection and Appointment.
UCProtection Level Classification Guide
UCInstitutional Information Disposal Standard
UCSan Diego Policy and Procedure Manual PPM135-3 Network Security
UC Records Retention Schedule
FREQUENTLY ASKEDQUESTIONS (FAQ&S)
None.
REVISION HISTORY
This policy was issued June14, 2024.
