SF 4850

Introduction - 94th Legislature (2025 - 2026)

Posted on 03/26/2026 09:27 a.m.

A bill for an act
relating to government data practices; updating automated license plate reader
provisions to address the role of third-party service providers; amending Minnesota
Statutes 2024, section 13.824, subdivisions 1, 6, 7.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2024, section 13.824, subdivision 1, is amended to read:

Subdivision 1.

Definitions.

(a) For purposes of this section, the following terms have
the meanings given.

(b) "Automated license plate reader" means an electronic device mounted on a law
enforcement vehicle or positioned in a stationary location that is capable of recording data
on, or taking a photograph of, a vehicle or its license plate and comparing the collected data
and photographs to existing law enforcement databases for investigative purposes. Automated
license plate reader includes a device that is owned or operated by a person who is not a
government entity to the extent that data collected by the reader are shared with a law
enforcement agency. Automated license plate reader does not include a traffic safety camera
system.

(c) new text begin "Share," "sharing," "access," or "accessing" means any act by which a law enforcement
agency makes automated license plate reader data available to, or permits querying of such
data by, another person or entity, including through a third-party service provider's platform
or database or through any networked, multiagency, or nationwide search capability.
new text end

new text begin (d) "Third-party service provider" means an entity that a law enforcement agency
contracts with or utilizes to collect, create, receive, maintain, or disseminate the agency's
automated license plate reader data on the agency's behalf.
new text end

new text begin (e) new text end "Traffic safety camera system" has the meaning given in section 169.011, subdivision
85a.

Sec. 2.

Minnesota Statutes 2024, section 13.824, subdivision 6, is amended to read:

Subd. 6.

Biennial audit.

(a) In addition to the log required under subdivision 5, the law
enforcement agency must maintain records showing the date and time automated license
plate reader data were collected and the applicable classification of the data. The law
enforcement agency shall arrange for an independent, biennial audit of the records to
determine whether data currently in the records are classified, how the data are used, whether
they are destroyed as required under this section, and to verify compliance with subdivision
7. If the commissioner of administration believes that a law enforcement agency is not
complying with this section or other applicable law, the commissioner may order a law
enforcement agency to arrange for additional independent audits. Data in the records required
under this paragraph are classified as provided in subdivision 2.

(b) new text begin The law enforcement agency shall ensure that the independent auditor has complete
access to all records, logs, audit trails, query histories, and systems containing automated
license plate reader data, including those maintained by or accessible to the law enforcement
agency through any third-party service provider, as necessary to complete the audit required
by paragraph (a). Failure to provide the auditor with necessary access constitutes
noncompliance with this section and may result in an order from the commissioner of
administration requiring additional audits or other remedial action.
new text end

new text begin (c) new text end The results of the audit are public. The commissioner of administration shall review
the results of the audit. If the commissioner determines that there is a pattern of substantial
noncompliance with this section by the law enforcement agency, the agency must
immediately suspend operation of all automated license plate reader devices until the
commissioner has authorized the agency to reinstate their use. An order of suspension under
this paragraph may be issued by the commissioner, upon review of the results of the audit,
review of the applicable provisions of this chapter, and after providing the agency a
reasonable opportunity to respond to the audit's findings.

deleted text begin (c) deleted text end new text begin (d) new text end A report summarizing the results of each audit must be provided to the
commissioner of administration, to the chairs and ranking minority members of the
committees of the house of representatives and the senate with jurisdiction over data practices
and public safety issues, and to the Legislative Commission on Data Practices and Personal
Data Privacy no later than 30 days following completion of the audit.

Sec. 3.

Minnesota Statutes 2024, section 13.824, subdivision 7, is amended to read:

Subd. 7.

Authorization to access data.

(a) A law enforcement agency must comply
with sections 13.05, subdivision 5, and 13.055 in the operation of automated license plate
readers, and in maintaining automated license plate reader data.

(b) The responsible authority for a law enforcement agency must establish written
procedures to ensure that law enforcement personnel have access to the data only if authorized
in writing by the chief of police, sheriff, or head of the law enforcement agency, or their
designee, to obtain access to data collected by an automated license plate reader for a
legitimate, specified, and documented law enforcement purpose. Consistent with the
requirements of paragraph (c), each access must be based on a reasonable suspicion that
the data are pertinent to an active criminal investigation and must include a record of the
factual basis for the access and any associated case number, complaint, or incident that is
the basis for the access.

(c) The ability of authorized individuals to enter, update, or access automated license
plate reader data must be limited through the use of role-based access that corresponds to
the official duties or training level of the individual and the statutory authorization that
grants access for that purpose. All queries and responses, and all actions in which data are
entered, updated, accessed, shared, or disseminated, must be recorded in a data audit trail.
Data contained in the audit trail are public, to the extent that the data are not otherwise
classified by law.

new text begin (d) Each access to or query of a law enforcement agency's automated license plate reader
data by a person outside the agency, including any query made through or facilitated by a
third-party service provider, must be authorized in writing by the chief of police, sheriff,
or head of that law enforcement agency, or their designee. The law enforcement agency
under whose authority the automated license plate reader data was collected remains
responsible for ensuring full compliance with this subdivision, regardless of whether the
agency uses a third-party service provider to manage access to the data.
new text end