|
Getting your Trinity Audio player ready...
|
The UNC System on Tuesday set new rules for how North Carolina’s public universities may use automatic license plate recognition systems, like those from Flock Safety, on their campuses—a move that comes as the technology faces scrutiny nationwide over how data is stored and who can access it.
“These standards govern how ALPR technology and data are secured, retained, and audited,” the five-page regulation begins. “This regulation ensures that campus safety teams adopting new technology maintain the highest standards of privacy, data accountability, mandatory training, and oversight, while fully complying with applicable laws.”
Per UNC System policy, regulations are signed by the system president—currently Peter Hans—and do not require approval from the Board of Governors.
Generally, ALPR cameras automatically capture photos of license plates as cars drive by them. The data is uploaded to a central system that law enforcement agencies can search, and the information is stored for varying periods of time depending on the companies’ policies and local and state laws. The companies behind the technology tout that the cameras can be used to solve crimes, such as vehicle thefts or abductions. But individuals and groups opposing it have raised concerns that the systems do not adequately safeguard the public’s privacy and that they can be abused by law enforcement officials for non-work purposes.
In a statement to The Assembly, UNC System spokesperson Andy Wallace said: “As with any emerging technology, it is a matter of good governance to establish clear guardrails and consistent standards for how it’s used. This regulation ensures that law enforcement has access to useful public safety tools while setting reasonable limits in order to protect data privacy.”
Several campuses in the public university system, including UNC-Chapel Hill, Appalachian State University, and UNC Pembroke, have contracts with Flock, one of the nation’s leading license plate camera companies. Recent public records requests by the citizen-led group DeFlockILM have shown that some campuses’ systems have been searched millions of times by police in other states. At UNCP, for instance, the group found that 3,480 law enforcement agencies searched the university’s 10 cameras more than 1.5 million times between April and July this year, Border Belt Independent reported. UNC-CH and App State in recent months have changed their protocols to limit how other police agencies can access their systems’ data.
The regulation states that schools’ license plate recognition systems and the data they collect may only be used for “documented law enforcement purposes,” such as informing criminal investigations, locating missing or endangered persons, locating lost or stolen vehicles, and apprehending suspects with outstanding felony warrants.
The systems may not be used to enforce traffic violations; track attendance at political, social, labor, religious, or social events without a documented law enforcement purpose; monitor people or vehicles based solely on protected characteristics or “lawful expressive activity;” or conduct broad or indiscriminate searches.
The regulation will require campuses to delete data from these systems within 30 days, instead of the 90 required under state law, unless the school receives a request under state law to preserve the information longer or if there is a warrant or other court order to do so. Preserved data must be deleted within a year of the request to hold it beyond the 30-day limit unless an additional request is made.
Each school’s police chief must appoint an administrator to oversee the systems and how they are used, and access to the systems must be limited to trained users and protected by security measures such as multifactor authentication. Among several topics, the training users receive—which will be provided at least on a semi-annual basis—must cover authorized and prohibited uses of the technology, privacy rights, and data retention policies. Schools must keep logs of the activity on the systems, including searches performed and who made them, and provide the information to the system office upon request.
Campuses may share their systems’ data with North Carolina law enforcement agencies if the request is approved by the appointed administrator; bulk-sharing of data with the agencies is prohibited unless the law enforcement agency and the university’s counsel reach a written agreement. Schools may also share information with out-of-state agencies, but those agencies’ access to the system must be “time-limited” and approved by a campus official who reports directly to the university’s chancellor, per the regulation.
Any suspected misuse of the systems “must immediately be investigated,” per the regulation. Corrective actions may include revoking an officer’s access to the system, mandating additional training, or disciplinary action such as firing. The misuse may also be referred to law enforcement if warranted.
The requirements set forth in the regulation are effective December 1. Campuses must be in compliance by January 1, 2027.
