                                 CODE OF VIRGINIA

USE OF AUTOMATIC LICENSE PLATE RECOGNITION SYSTEMS BY LAW-ENFORCEMENT AGENCIES
(§ 2.2-5517)

A. For purposes of this section:
			&#8220;Audit trail&#8221; means all records of queries and responses in an
automatic license plate recognition system, and all records of actions in which
system data is accessed, entered, updated, shared, or disseminated, including
the (i) date and time of access; (ii) license plate number or other data
elements used to query the system; (iii) specific purpose, as set forth in
subsection D, for accessing or querying the system, including the offense type
for any criminal investigation; (iv) associated call for service or case number;
and (v) username of the person or persons who accessed or queried the system.
			&#8220;Audit trail data&#8221; means all forms of data collected or generated
by an automatic license plate recognition system for purposes of producing an
audit trail.
			&#8220;Automatic license plate recognition system&#8221; or
&#8220;system&#8221; means a system of one or more high-speed cameras used in
combination with computer algorithms to convert images of license plates,
vehicles, or a combination of both into computer-readable data.
			&#8220;Division&#8221; means the Division of Purchases and Supply of the
Department of General Services.
			&#8220;Law-enforcement agency&#8221; means any agency or entity that employs
law-enforcement officers as defined in &#xA7; 9.1-101.
			&#8220;Missing or endangered person&#8221; means a person who has been
identified as missing or endangered based on information provided by the
National Criminal Information Center, the National Center for Missing and
Exploited Children, or the Missing Children Information Clearinghouse (&#xA7;
52-31 et seq.) or pursuant to a Virginia Amber Alert (&#xA7; 52-34.1 et seq.), a
Virginia Critical Operation for a Disappeared Child Initiative Alert (&#xA7;
52-34.3:1 et seq.), a Virginia Senior Alert (&#xA7; 52-34.4 et seq.), a Virginia
Blue Alert (&#xA7; 52-34.7 et seq.), a Virginia Critically Missing Adult Alert
(&#xA7; 52-34.10 et seq.), a Virginia Missing Person with Autism Alert (&#xA7;
52-34.13 et seq.), or any substantially similar alert under the laws of another
state or territory of the United States, the District of Columbia, or the United
States.
			&#8220;Notification&#8221; means an alert from an automatic license plate
recognition system that a license plate or vehicle matches a license plate or
vehicle in a database utilized by the automatic license plate recognition system
for comparison purposes.
			&#8220;Person associated with human trafficking&#8221; means a person who is
either a suspected victim or an alleged perpetrator of either commercial sex
trafficking or labor trafficking.
			&#8220;Publicly post&#8221; means to post on a website that is maintained by
the agency or on any other website on which the agency generally posts
information and that is available to the public or that clearly describes how
the public may access such information.
			&#8220;Query&#8221; means a search of automatic license plate recognition
system data based on information entered by the user, including a full or
partial license plate number, any identifying characteristics of a vehicle, the
date, time, or location of an image, or any other data that is searchable within
the automatic license plate recognition system.
			&#8220;System data&#8221; means all forms of data collected or generated by
an automatic license plate recognition system, including images of license
plates, vehicles, any identifying characteristics of vehicles, the date, time,
and location of an image, and any peripheral images collected from which
analytical data may be extracted.
			&#8220;Vendor&#8221; means a business, company, corporation, or other
nongovernmental entity that contracts with a law-enforcement agency for the
installation, use, or maintenance of an automatic license plate recognition
system.

B. Pursuant to § 2.2-1112, the Division of Purchases and Supply shall determine
the automatic license plate recognition systems for use in the Commonwealth in
accordance with this section. An automatic license plate recognition system
shall not be approved by the Division for use by a law-enforcement agency
unless:

   1. The vendor certifies that it will not sell or share any system data or
   audit trail data gathered in the Commonwealth, except upon request of the
   contracting law-enforcement agency for a purpose set forth in subsection F,
   and will only access system data or audit trail data upon request of the
   contracting law-enforcement agency for maintenance and quality assurance
   purposes;

   2. The vendor certifies that its system is capable of purging system data
   collected or generated in the Commonwealth after 21 days of the date of its
   capture, or earlier if requested by the contracting law-enforcement agency, in
   such a manner that the system data is destroyed and not recoverable by either
   the vendor or the contracting law-enforcement agency;

   3. The vendor certifies that its system is capable of producing an audit trail
   and purging audit trail data collected or generated in the Commonwealth after
   two years of the date of its capture in such a manner that the audit trail
   data is destroyed and not recoverable by either the vendor or the contracting
   law-enforcement agency;

   4. The databases used by the system to provide notifications as set forth in
   subsection D are updated at least every 24 hours, or as soon as practicable
   after such updates become available; and

   5. The system meets information security standards as established by the
   Virginia Information Technologies Agency.

C. (Effective July 1, 2026) A law-enforcement agency may enter into a contract
with a vendor for the installation, use, or maintenance of a system approved by
the Division. The contract shall specify that system data and audit trail data
will be the property of the law-enforcement agency and that the system meets the
requirements set forth in subsection B. The contract shall further specify that
the vendor will immediately notify the law-enforcement agency upon receipt of
any subpoena duces tecum, execution of any search warrant, or any other request
from a third party for such system data or audit trail data, unless disclosure
of such subpoena duces tecum, search warrant, or request is otherwise prohibited
by law.

D. A law-enforcement agency may use a system only (i) as part of a criminal
investigation into an alleged violation of the Code of Virginia or any ordinance
of any county, city, or town where there is a reasonable suspicion that a crime
was committed; (ii) as part of an active investigation related to a missing or
endangered person, including whether to issue an alert for such person, or a
person associated with human trafficking; or (iii) to receive notifications
related to a missing or endangered person, a person with an outstanding warrant,
a person associated with human trafficking, a stolen vehicle, or a stolen
license plate. All information necessary for the creation of an audit trail
shall be entered in order to query system data. A law-enforcement agency shall
not query or download system data unless such data is related to at least one of
these purposes. A law-enforcement agency may download audit trail data for
purposes of generating audit reports. A stop of a motor vehicle based on a
notification from the system shall be consistent with subsection M.

E. System data shall be purged after 21 days of the date of its capture in such
a manner that such data is destroyed and not recoverable by either the vendor or
the law-enforcement agency. Audit trail data shall be purged after two years of
the date of its capture in such a manner that such data is destroyed and not
recoverable by either the vendor or the law-enforcement agency. However, if the
system data or the audit trail data is part of an ongoing investigation,
prosecution, or civil action, such data shall be retained by the law-enforcement
agency until (i) the investigation concludes without any criminal charges or
(ii) the final disposition of any criminal or civil matter related to the data,
including any direct appeals and any writs of habeas corpus pursuant to Article
3 (&#xA7; 8.01-654 et seq.) of Chapter 25 of Title 8.01 or federal law, in
accordance with applicable records retention law and policy.

F. System data and audit trail data shall not be subject to disclosure under the
Virginia Freedom of Information Act (§ 2.2-3700 et seq.). A law-enforcement
agency shall not sell any system data or audit trail data. A law-enforcement
agency shall not share system data or audit trail data with, or disseminate such
data to, any database of any other state, federal, private, or commercial
entity. A law-enforcement agency may share system data or audit trail data for
the following purposes:

   1. With another law-enforcement agency for purposes set forth in subsection D,
   which may include allowing another law-enforcement agency to query system
   data, provided that the agency receiving such data shall comply with all of
   the provisions of this section;

   2. With the attorney for the Commonwealth for purposes set forth in subsection
   D or for complying with discovery or a court order in a criminal proceeding;

   3. With a defendant or his counsel for purposes of complying with discovery or
   a court order in a criminal proceeding;

   4. Pursuant to a court order or a court-issued subpoena duces tecum in any
   criminal or civil proceeding;

   5. With the vendor for maintenance or quality assurance purposes; or

   6. To alert the public to an emergency situation, a missing or endangered
   person, a person associated with human trafficking, or a person with an
   outstanding warrant.
   				In addition, the Department of State Police shall share system data
   obtained from any system installed, maintained, and operated on any limited
   access highway or any bridge, tunnel, or special structure under the
   jurisdiction of the Commonwealth Transportation Board or the Department of
   Transportation with any law-enforcement agency in the locality where such
   system is installed, maintained, or operated, and such law-enforcement agency
   may share such system data for the purposes set forth in this subsection.

G. A law-enforcement agency that uses a system shall maintain records sufficient
to facilitate public reporting as required by this section, the production of an
audit trail, and discovery in criminal and civil proceedings, appeals, and
post-conviction proceedings.

H. A law-enforcement agency that uses a system shall establish a policy
governing such use that is consistent with this section that includes:

   1. Training requirements for individuals who will use or access the system;

   2. The purposes for which the system can be used or accessed;

   3. Procedures to ensure that the databases used by the system to provide
   notifications as set forth in subsection D are updated at least every 24
   hours, or as soon as practicable after such updates become available;

   4. Procedures to confirm the accuracy of any notifications made by the system
   before stopping a vehicle that are consistent with subsection M;

   5. A prohibition against downloading system data that is not related to at
   least one of the purposes set forth in subsection D, except for downloads of
   audit trail data for purposes of generating audit reports;

   6. An internal auditing procedure that occurs at least once every 30 days;

   7. Procedures for the retention and destruction of system data and audit trail
   data that are consistent with subsection E;

   8. A prohibition on the sale of system data and audit trail data and
   restrictions on the sharing of system data and audit trail data that are
   consistent with subsection F; and

   9. Security procedures to protect the system, system data, and audit trail
   data from unauthorized access, destruction, use, modification, or disclosure.

I. A law-enforcement agency that uses a system shall report to the Department of
State Police by April 1 of each year, in a format to be determined by the
Department of State Police, on its use of the system during the preceding
calendar year, which shall include the following data:

   1. The total number of cameras owned or leased by an agency as part of a
   system at the conclusion of each calendar year, including the number of such
   cameras designed to be affixed inside or on a motor vehicle, permanently
   affixed adjacent to a highway, or temporarily affixed or placed adjacent to a
   highway for purposes of capturing system data;

   2. A list of all state and federal databases with which the system data was
   compared, unless the existence of any such database itself is not public;

   3. The total number of times the system was queried, including the specific
   purposes of the queries, as set forth in subsection D, and the offense types
   for any criminal investigation;

   4. The race, ethnicity, age, and gender of any individual identified as a
   suspect and charged with a criminal offense as a result of a query of the
   system as part of a criminal investigation;

   5. The number of motor vehicles stopped based on notifications from the
   system, including the specific reasons for the notifications as set forth in
   subsection D;

   6. The race, ethnicity, age, and gender of the driver of any motor vehicle
   stopped based on a notification from the system;

   7. Whether the agency allows any other law-enforcement agencies to access its
   system data, and if so, which other agencies have been granted such access;

   8. The number of identified instances of unauthorized use of or access to the
   system, including the nature and circumstances of such instances; and

   9. The number of subpoena duces tecum, search warrants, and any other requests
   received from a third party for system data or audit trail data, including the
   identity of the entity that requested the issuance of such subpoena duces
   tecum, executed such search warrant, or requested such data, and whether any
   data was provided to such entity, unless disclosure of such subpoena duces
   tecum, search warrant, or request is otherwise prohibited by law.

J. The Department of State Police shall aggregate the data provided pursuant to
subsection I and report it to the Governor, the General Assembly, and the
Virginia State Crime Commission by July 1 of each year.

K. A law-enforcement agency that uses a system shall publicly post the policy
set forth in subsection H and the report set forth in subsection I. Data shall
not be publicly posted if it contains personal or case identifying information.
If any data (i) contains an articulable concern for any person&#8217;s safety,
(ii) is otherwise prohibited from public disclosure by federal or state statute,
or (iii) may compromise sensitive criminal justice information if disclosed,
such data may be excluded from being publicly posted.

L. A law-enforcement agency shall not use a system for the purpose of
interfering with individuals engaged in lawful activities or tracking
individuals on the basis of the content of lawfully protected speech.

M. A notification by a system for purposes set forth in subsection D does not,
by itself, constitute reasonable suspicion as grounds for law enforcement to
stop a vehicle. Prior to stopping a vehicle based on a notification, a
law-enforcement officer shall:

   1. Develop independent reasonable suspicion for the stop; or

   2. Confirm that the license plate or identifying characteristics of a vehicle
   match the information contained in the database used to generate the
   notification.

N. Any person who willfully and intentionally queries, accesses, or uses a
system for a purpose other than set forth in subsection D, or who willfully and
intentionally sells, shares, or disseminates system data or audit trail data in
violation of subsection F, is guilty of a Class 1 misdemeanor.

O. Any evidence obtained as the result of a violation of subsection D, F, L, or
M is not admissible by the Commonwealth in any criminal or civil proceeding, but
such evidence may be admitted by a defendant in a criminal proceeding or a
litigant, other than the Commonwealth, in a civil proceeding.

P. This section does not apply to systems used:

   1. For the enforcement of traffic laws, which includes parking regulations,
   speed limits, tolling requirements, high-occupancy vehicle requirements, or
   on-road emissions monitoring;

   2. By the Department of Motor Vehicles at permanent weighing stations and in
   mobile weighing operations; or

   3. By any state or local agency or any private entity for non-criminal justice
   purposes.

Q. A vendor shall immediately notify the contracting law-enforcement agency
under subsection C upon receipt of a subpoena duces tecum, execution of a search
warrant, or any other request from a third party for any system data or audit
trail data, unless disclosure of such subpoena duces tecum, search warrant, or
request is otherwise prohibited by law.

R. Prior to or coincident with the implementation of an automatic license plate
recognition system, a local law-enforcement agency shall take measures to
promote public awareness on the use of such system.

HISTORY: 2025, c. 720.