Category: electronic surveillance

HOUSE BILL No. ____

AN ACT concerning law enforcement; relating to electronic surveillance and automated license plate recognition systems; requiring judicial warrants for specified searches and uses; prohibiting specified data sharing and surveillance technologies; establishing data-retention, auditing, reporting and enforcement requirements; prescribing criminal penalties and credentialing consequences; and providing for related matters.

Be it enacted by the Legislature of the State of Kansas:

Section 1. Short title.

This act may be cited as the Kansas Warrant-Based Electronic Surveillance and Accountability Act.

Sec. 2. Legislative findings and purpose.

(a) The legislature finds that:

(1) Automated license plate recognition systems can collect and retain location, date, time, photograph and license-plate information associated with a vehicle. Kansas law has defined “captured license plate data” to include those categories of information.

(2) Kansas legislation has previously required law-enforcement agencies using automated license plate recognition systems to adopt written policies, limit access to legitimate law-enforcement purposes, document searches and alerts, and impose retention limits, subject to stated exceptions.

(3) The United States Supreme Court has recognized that government acquisition or use of certain forms of detailed digital information can implicate substantial privacy interests and the Fourth Amendment. See Carpenter v. United States, 585 U.S. 296 (2018); Riley v. California, 573 U.S. 373 (2014). The Court has also addressed the constitutional implications of prolonged location monitoring and sense-enhancing surveillance. See United States v. Jones, 565 U.S. 400 (2012); Kyllo v. United States, 533 U.S. 27 (2001).

(4) The Legislature intends to establish clear statewide rules requiring judicial authorization before law-enforcement agencies conduct specified electronic searches or use specified surveillance technologies, and to provide for independent auditing and accountability.

(b) The purpose of this act is to protect privacy and civil liberties while establishing enforceable limits on the collection, access, use, retention, and disclosure of electronic surveillance data by law-enforcement agencies and persons acting on their behalf.

Sec. 3. Definitions.

As used in this act:

(a) “Automated license plate recognition system” or “ALPR system” means one or more cameras, sensors, software programs, or other devices, whether fixed, mobile, or remotely hosted, that automatically capture, read, record, analyze, or convert images or information concerning a license plate into searchable or computer-readable data. The term includes a system that captures associated location, date, time, vehicle, or image information.

(b) “ALPR data” means any data captured, generated, derived, or stored by an ALPR system, including license-plate numbers, photographs, vehicle descriptions, global positioning coordinates, date and time information, alerts, query results, access records, and associated metadata.

(c) “Hotlist” means a list of license-plate numbers entered into an ALPR system before a scan for the sole purpose of identifying a vehicle that is reported stolen, associated with an active arrest warrant, or the subject of a specific, documented, and active investigation of a felony or an endangered or missing person. A hotlist does not include a database, list, or query created or maintained for general intelligence, generalized surveillance, immigration enforcement, civil enforcement, or the identification or monitoring of persons based solely on protected activity or protected characteristics.

(d) “Hotlist alert” means a system-generated match between a plate captured by an ALPR system and an entry on a hotlist.

(e) “Law-enforcement agency” means any state, county, municipal, local, or university police department or other Kansas public agency employing or appointing law-enforcement officers, and any agent, contractor, or service provider acting on behalf of such an agency.

(f) “Electronic search” means a query, scan, comparison, retrieval, or other use of an electronic system to obtain, identify, track, or analyze information about a person, vehicle, device, or location. The term includes a search of stored ALPR data and a search or use of a cell-site simulator.

(g) “Judicial search warrant” means a warrant issued by a Kansas judge or magistrate with jurisdiction, upon a sworn application establishing probable cause and particularly describing the person, place, device, account, records, or data to be searched or seized. An administrative subpoena, contractual authorization, agency policy, or approval by a law-enforcement supervisor is not a judicial search warrant.

(h) “Artificial intelligence system” means a machine-based system that generates predictions, recommendations, classifications, scores, identifications, or decisions from data and that is used to inform or materially influence a law-enforcement action. The term includes generative artificial intelligence and algorithmic systems used for predictive policing, risk scoring, automated investigative leads, biometric identification, or analysis of surveillance data.

(i) “Facial-recognition system” means a system that analyzes or compares an image or video of a face to identify, verify, or infer the identity of a person, including a system that generates a face template, faceprint, or biometric match.

(j) “Cell-site simulator” or “IMSI catcher” means a device or system that impersonates or mimics a cellular communications tower, or otherwise induces a cellular device to disclose identifying or signaling information, including an international mobile subscriber identity, international mobile equipment identity, or similar identifier.

Sec. 4. Warrant required for electronic searches and ALPR data access.

(a) Except as provided in subsection (b), a law-enforcement agency shall not:

(1) conduct an electronic search of ALPR data;

(2) access, retrieve, query, or disclose stored ALPR data for an investigative or enforcement purpose;

(3) use an ALPR system to track or monitor a particular person or vehicle; or

(4) use or cause another person to use a cell-site simulator or IMSI catcher;

unless the agency first obtains a judicial search warrant.

(b) A judicial search warrant is not required for:

(1) a real-time ALPR scan used solely to determine whether a captured plate matches a hotlist, provided the scan is not used to create, retain, or search a historical record except as expressly permitted by this act;

(2) an officer’s observation of a license plate or vehicle in a place where the officer is lawfully present, without use of an ALPR system or access to stored ALPR data; or

(3) an emergency disclosure or search strictly necessary to respond to an imminent threat of death or serious bodily injury, if the agency documents the facts supporting the emergency and, where practicable, obtains judicial authorization before the search.

(c) When an agency relies on subsection (b)(3), the agency shall prepare a written record within 24 hours describing the emergency, the information searched or disclosed, the persons who approved and conducted the search, and the reason a warrant could not be obtained in time. The agency shall apply for a warrant as soon as practicable if it seeks to retain or continue to use the information. Information obtained under the emergency exception shall not be used in a criminal proceeding unless a warrant is obtained or a court determines that the exception applied.

(d) A judicial warrant under this section shall particularly describe the data sought, the relevant time period, the purpose of the search, and any limits on use, disclosure, and retention. An agency shall not use a warrant to conduct a generalized or indiscriminate search of ALPR data.

(e) No provision of this act shall be construed to diminish any protection provided by the Fourth Amendment to the United States Constitution or section 15 of the Kansas Bill of Rights.

Sec. 5. ALPR data retention and deletion.

(a) A law-enforcement agency shall delete ALPR data not associated with a hotlist alert no later than 24 hours after the data are captured.

(b) ALPR data associated with a hotlist alert may be retained only if:

(1) the alert is verified by an officer before any stop, detention, or other enforcement action;

(2) an officer documents the hotlist entry, the basis for the entry, the alert, the verification, and any resulting action; and

(3) the data are relevant to a specific investigation or proceeding and are retained pursuant to a judicial search warrant, court order, or applicable records-retention requirement.

(c) A hotlist alert, standing alone, does not establish reasonable suspicion or probable cause. An officer shall independently verify the plate and the factual basis for any proposed enforcement action.

(d) An agency shall ensure that deletion under this section includes deletion from systems, backups, contractor-hosted storage, and other repositories within the agency’s possession, custody, or control, except where preservation is required by a judicial order or other controlling law.

(e) Nothing in this section authorizes retention of data that another law requires to be destroyed sooner.

Sec. 6. Prohibited sharing and access.

(a) A Kansas law-enforcement agency shall not:

(1) provide, disclose, sell, license, transfer, or otherwise make ALPR data available to a federal law-enforcement agency or federal entity;

(2) permit a federal law-enforcement agency or federal entity to access an ALPR system, its data, its search functions, or its query results;

(3) share or provide access to an ALPR system or ALPR data to a law-enforcement agency located outside Kansas; or

(4) enter into, renew, or maintain an agreement, contract, memorandum of understanding, or other arrangement that would permit conduct prohibited by this section.

(b) A Kansas law-enforcement agency shall not participate in an interstate or multijurisdictional ALPR network to the extent that participation permits access to or disclosure of ALPR data in violation of subsection (a).

(c) This section does not prohibit disclosure specifically required by a final order of a court with jurisdiction, provided that the agency promptly gives notice to the attorney general and seeks appropriate protective relief when legally available.

Sec. 7. Prohibited technologies.

(a) A law-enforcement agency shall not acquire, lease, deploy, operate, access, or use an ALPR system, software, database, or service owned, operated, marketed, or supplied by Flock Safety or an entity controlled by, controlling, or under common control with Flock Safety. (would require an investigation into Flock Safety to support findings of deceptive business practices)

(b) A law-enforcement agency shall not acquire, lease, deploy, operate, access, or use a facial-recognition system.

(c) A law-enforcement agency shall not acquire, lease, deploy, operate, access, or use an artificial-intelligence system for a law-enforcement purpose.

(d) A law-enforcement agency shall not acquire, lease, deploy, operate, access, or use a cell-site simulator or IMSI catcher.

(e) A public agency shall not use an independent contractor, private company, or other person to perform an act that the agency is prohibited from performing under this section. An agency shall not evade this section by outsourcing a system, search, analysis, or data-storage function.

(f) A law-enforcement agency shall, within 90 days after the effective date of this act, cease prohibited uses, terminate or modify prohibited contracts to the extent legally permissible, and secure or destroy information held solely as a result of a prohibited use, subject to preservation required by a judicial order or other controlling law.

Sec. 8. ALPR policies, access controls, and search logs.

(a) Each law-enforcement agency that operates or has operated an ALPR system shall adopt and maintain a written policy implementing this act.

(b) The policy shall, at a minimum:

(1) identify each ALPR system and its owner, operator, vendor, and data-storage location;

(2) require that each hotlist entry be specific, documented, and tied to a permitted purpose under section 3;

(3) require warrant documentation for searches of stored ALPR data;

(4) establish access controls limiting system access to personnel with an authorized role;

(5) require training on this act and applicable constitutional protections; and

(6) provide for preservation and production of records needed for an audit or investigation under this act.

(c) Each agency shall maintain an auditable log of every ALPR scan, alert, query, search, access, disclosure, export, modification, and deletion. The log shall include, as applicable:

(1) the date and time of the event;

(2) the identity and agency of the person initiating or approving it;

(3) the system and account used;

(4) the plate or other search term entered;

(5) the stated purpose and associated case, incident, or warrant number;

(6) the warrant or court-order identifier, if applicable;

(7) the data accessed, disclosed, or exported and the recipient; and

(8) the date and method of deletion.

(d) An agency shall preserve logs for at least five years. Logs shall be protected against unauthorized alteration and shall be made available to the auditor general, the attorney general, and a court of competent jurisdiction as provided by law.

Sec. 9. Statewide audit.

(a) The Kansas attorney general, in coordination with the Kansas legislative post audit committee and the auditor of state, shall conduct or arrange for an independent audit of ALPR systems and ALPR search logs maintained or used by every state, county, municipal, local, and university law-enforcement agency.

(b) The audit shall review, at a minimum:

(1) all ALPR search logs for the five years preceding the effective date of this act, to the extent records remain available;

(2) whether searches were supported by a judicial search warrant or a documented statutory exception;

(3) whether searches had a documented, specific law-enforcement purpose;

(4) whether data were retained or deleted in compliance with applicable law and agency policy;

(5) whether data or system access was provided to federal entities or out-of-state law-enforcement agencies;

(6) whether an agency used a prohibited system or vendor, including Flock Safety; and

(7) whether access, use, disclosure, or retention records were incomplete, altered, or destroyed.

(c) Within 12 months after the effective date of this act, the auditor shall submit a public report to the governor and the legislature. The report shall identify agency-level compliance findings, violations, corrective actions, and recommendations. The report shall not disclose information whose disclosure is prohibited by law or would compromise an active investigation.

(d) Each agency shall preserve and provide records reasonably required for the audit. An agency shall not impede, delay, or knowingly provide materially false information to an auditor conducting an audit under this section.

(e) The attorney general shall conduct follow-up audits at least once every three years and may conduct an additional audit upon reasonable grounds to believe that an agency has violated this act.

Sec. 10. Enforcement; criminal and credentialing consequences.

(a) A person commits a violation of this act if the person knowingly or recklessly:

(1) conducts or causes an electronic search prohibited by this act;

(2) accesses, shares, discloses, or retains ALPR data in violation of this act;

(3) uses a prohibited system or technology in violation of section 7;

(4) knowingly evades a warrant requirement or data-retention limitation imposed by this act;

(5) knowingly falsifies, alters, or destroys a search log or audit record required by this act; or

(6) knowingly directs, permits, or assists another person in conduct prohibited by this act.

(b) A willful violation of subsection (a) is a severity level 9, nonperson felony.

(c) A person who willfully violates this act while acting under color of law shall, upon conviction:

(1) be subject to the penalty prescribed in subsection (b);

(2) be referred to the Kansas Commission on Peace Officers’ Standards and Training for revocation of the person’s law-enforcement certification or credentials, following notice and an opportunity to be heard; and

(3) be ineligible for certification or employment as a law-enforcement officer in Kansas, subject to applicable law and the procedures of the Commission.

(d) The attorney general may bring a civil action to enjoin a violation of this act and to obtain appropriate declaratory or other equitable relief. A person whose information was unlawfully searched, accessed, disclosed, or retained may seek appropriate relief in a court of competent jurisdiction.

(e) Evidence obtained in violation of this act shall be subject to suppression in a criminal, civil, or administrative proceeding, to the extent permitted by the United States Constitution, the Kansas Constitution, and other applicable law.

(f) Nothing in this section limits prosecution under another applicable criminal statute or the authority of a court to impose additional remedies.

Sec. 11. Construction and severability.

(a) This act establishes statutory protections in addition to any protections otherwise provided by the United States Constitution, the Kansas Constitution, or other law.

(b) If any provision of this act or its application to any person or circumstance is held invalid, the invalidity shall not affect other provisions or applications of the act that can be given effect without the invalid provision or application.

Sec. 12. Effective date.

This act shall take effect and be in force from and after its publication in the statute book.