The following is a letter from the Florida ACLU expressing support for a wide-ranging privacy bill that would prohibit the use of automated license plate readers without a warrant in most cases, and ban retention of any legally-collected data, blocking a federal program tapping into ALPRs on a state-level.
We write in support of HB 571, a bill that adds much needed privacy protections for digital information to Florida’s statutes. Technological advances are making it easier for the government to collect ever more intrusive information on its citizens, and the law is often slow to provide commiserate checks and balances. This bill ensures that warrant requirements are in place to protect our information and that when personal information is collected it cannot be used for improper purposes.
Section 3. This section ensures that information collected by the government cannot be sold to third parties. The government collects significant quantities of highly sensitive information for both law enforcement and regulatory purposes, and it is important that there are no financial incentives to encourage the greater collection and dissemination of such information. This section also ensures that what is collected for legitimate government purposes isn’t transformed into commercial data for an outside party.
Section 4. Section 4 requires law enforcement to obtain a warrant before using wall-penetrating radar devices. The provision includes exceptions for executing an arrest with a warrant, when there is a high risk of terrorist attack, or to find a missing person.
In 2001, the US Supreme Court held that law enforcement officers need warrants before using thermal imaging devices1 and we believe that analysis easily extends to radar -based devices too. If anything, radar devices are evolving towards being incredibly sensitive and more intrusive than thermal imaging. They can already “zero in on movements as slight as human breathing from a distance of more than 50 feet,” create three dimensional maps and be attached to drones.
However, articles from January of this year report that federal law enforcement may disagree with such an application. This bill provides clarity and makes sure this potentially invasive tool is generally governed by a warrant requirement and constitutionally recognized exceptions
Section 5. This section requires electronic communications services to protect identifying information that could link their users to a specific internet protocol (IP) address. Service providers are permitted to share that identifying information, but only if a user grants affirmative permission through a consent structure that is “clear and conspicuous.”
An IP address is a unique identifier given to each device that accesses the Internet, such as a laptop or a phone. While your service provider may know the real person or the real physical address behind the device, the websites you visit usually do not. They only see your IP address, ensuring that you can read, research, shop, map, comment and communicate in private. It’s important that information that can lead to a person’s real world identity be protected unless he or she chooses to share it, and section 5 ensures that is the case in Florida.
Section 6. Section 6 requires that the government obtain a warrant before searching through portable electronic devices like cell phones. This reiterates a recent Florida Supreme Court decision holding the same.4 The decision clarifies that searches incident to arrest are meant to save evidence from destruction or ensure officer safety. Searching through photographs on a phone served neither purpose and therefore needed a warrant. We support explicitly adding this to Florida statutes.
Section 6 also clarifies that the government may not enter into a nondisclosure agreement with vendors who sell surveillance equipment. While a Florida court held in 2009 that a confidentiality agreement between the government and a private party could not trump open records laws. Florida has fought open records request on so-called “Stingray” devices that monitor broad swaths of cell phones at one time.
Finally, Section 6 also creates a new reporting structure for communication companies, prosecutors and courts to better track how many and what type of orders are issued each year. These reports will provide the first comprehensive look on how often law enforcement collects sensitive information like location data, or extensive communications without a warrant under a pen register and trap and trace order. Also, by knowing how much these surveillance programs cost and whether they actually result in arrest and convictions, the legislature will be better able to determine if the programs are quite literally worth the cost.
Section 7. This section requires the government to obtain a warrant to collect license plate data with exceptions for emergencies, terror threats and tolls. Any information collected but be deleted within 30 days if not reserved for use in an ongoing investigation.
License plate readers (LPRs) currently offer law enforcement location tracking authority in the complete absence of any regulation. Historic location data collected over a period of time is very sensitive and can reflect who a person knows, where he goes to worship, which doctors he sees, how often he frequents a bar, where he sleeps at night, when he arrives at or leaves work and more. None of this information reflects criminal behavior yet it is highly personal and reveals a great deal about the person the data is connected to.
Florida newspapers have documented LPR use across the state and it appears that even more localities are looking to implement them in the near future. These surveillance tools are expanding across the country and as of this month, bills are pending in 15 states to limit the collection or use of the data as legislatures recognize that the government keeping entire databases of its citizens’ locations poses serious privacy risks.8 We support Florida becoming a state that more carefully restricts the use of LPRs.
Section 8. This section ensures that contractors who have access to student data cannot sell or distribute student information beyond the scope of their service to the school district that hired them. For example, if a school district hires a company to run a website that allows students and parents to access student information, that company would not be able to mine the data it is managing for commercial purposes or otherwise use it in a way not explicitly authorized by the student or school. Working with a school should not be a gateway that allows companies to build a commercial dossier on Florida’s children.
Given the many important privacy protections contained in HB 571, we strongly urge you to vote “yes” on the bill.