2025 SESSION

HOUSE SUBSTITUTE

25106262D

HOUSE BILL NO. 2724

AMENDMENT IN THE NATURE OF A SUBSTITUTE

(Proposed by the House Committee for Courts of Justice

on January 29, 2025)

(Patron Prior to Substitute—Delegate Herring)

A BILL to amend and reenact § 52-30.2 of the Code of Virginia and to amend the Code of Virginia by adding in Title 2.2 a chapter numbered 55.6, consisting of a section numbered 2.2-5517, relating to use of automatic license plate recognition systems; reports; penalty.

Be it enacted by the General Assembly of Virginia:

1. That § 52-30.2 of the Code of Virginia is amended and reenacted and that the Code of Virginia is amended by adding in Title 2.2 a chapter numbered 55.6, consisting of a section numbered 2.2-5517, as follows:

CHAPTER 55.6.

USE OF AUTOMATIC LICENSE PLATE RECOGNITION SYSTEMS.

§ 2.2-5517. Use of automatic license plate recognition systems by law-enforcement agencies.

A. For purposes of this section:

"Audit trail" means all records of queries and responses in an automatic license plate recognition system, and all records of actions in which system data is accessed, entered, updated, shared, or disseminated, including the (i) date and time of access; (ii) license plate number or other data elements used to query the system; (iii) specific purpose, as set forth in subsection D, for accessing or querying the system, including the offense type for any criminal investigation; (iv) associated call for service or case number; and (v) username of the person or persons who accessed or queried the system.

"Audit trail data" means all forms of data collected by an automatic license plate recognition system for purposes of producing an audit trail.

"Automatic license plate recognition system" or "system" means a system of one or more high-speed cameras used in combination with computer algorithms to convert images of license plates, vehicles, or a combination of both into computer-readable data.

"Division" means the Division of Purchases and Supply of the Department of General Services.

"Law-enforcement agency" means any agency or entity that employs law-enforcement officers as defined in § 9.1-101.

"Missing or endangered person" means a person who has been identified as missing or endangered based on information provided by the National Criminal Information Center, the National Center for Missing and Exploited Children, or the Missing Children Information Clearinghouse (§ 52-31 et seq.) or pursuant to a Virginia Amber Alert (§ 52-34.1 et seq.), a Virginia Critical Operation for a Disappeared Child Initiative Alert (§ 52-34.3:1 et seq.), a Virginia Senior Alert (§ 52-34.4 et seq.), a Virginia Blue Alert (§ 52-34.7 et seq.), a Virginia Critically Missing Adult Alert (§ 52-34.10 et seq.), a Virginia Missing Person with Autism Alert (§ 52-34.13 et seq.), or any substantially similar alert under the laws of another state or territory of the United States, the District of Columbia, or the United States.

"Notification" means an alert from an automatic license plate recognition system that a license plate or vehicle matches a license plate or vehicle in a database utilized by the automatic license plate recognition system for comparison purposes.

"Person associated with human trafficking" means a person who is either a suspected victim or an alleged perpetrator of either commercial sex trafficking or labor trafficking.

"Publicly post" means to post on a website that is maintained by the agency or on any other website on which the agency generally posts information and that is available to the public or that clearly describes how the public may access such information.

"Query" means a search of automatic license plate recognition system data based on information entered by the user, including a full or partial license plate number, any identifying characteristics of a vehicle, the date, time, or location of an image, or any other data that is searchable within the automatic license plate recognition system.

"System data" means all forms of data collected by an automatic license plate recognition system, including images of license plates, vehicles, any identifying characteristics of vehicles, the date, time, and location of an image, and any peripheral images collected from which analytical data may be extracted.

"Vendor" means a business, company, corporation, or other nongovernmental entity that contracts with a law-enforcement agency for the installation, use, or maintenance of an automatic license plate recognition system.

B. Pursuant to § 2.2-1112, the Division of Purchases and Supply shall determine the automatic license plate recognition systems for use in the Commonwealth in accordance with this section. An automatic license plate recognition system shall not be approved by the Division for use by a law-enforcement agency unless:

1. The vendor certifies that it will not sell or share any system data or audit trail data gathered in the Commonwealth, except upon request of the contracting law-enforcement agency for a purpose set forth in subsection F, and will only access system data or audit trail data upon request of the contracting law-enforcement agency for maintenance and quality assurance purposes;

2. The vendor certifies that its system is capable of purging system data gathered in the Commonwealth after 30 days of the date of its capture, or earlier if requested by the contracting law-enforcement agency, in such a manner that the system data is destroyed and not recoverable by either the vendor or the contracting law-enforcement agency;

3. The vendor certifies that its system is capable of producing an audit trail and purging audit trail data after two years of the date of its capture in such a manner that the audit trail data is destroyed and not recoverable by either the vendor or the contracting law-enforcement agency;

4. The databases used by the system to provide notifications as set forth in subsection D are updated at least every 24 hours, or as soon as practicable after such updates become available; and

5. The system meets information security standards as established by the Virginia Information Technologies Agency.

C. A law-enforcement agency may enter into a contract with a vendor for the installation, use, or maintenance of a system approved by the Division. The contract shall specify that system data and audit trail data will be the property of the law-enforcement agency and that the system meets the requirements set forth in subsection B.

D. A law-enforcement agency may use a system only (i) as part of a criminal investigation where there is a reasonable suspicion that a crime was committed; (ii) as part of an active investigation related to a missing or endangered person, including whether to issue an alert for such person, or a person associated with human trafficking; or (iii) to receive notifications related to a missing or endangered person, a person with an outstanding warrant, a person associated with human trafficking, a stolen vehicle, or a stolen license plate. A law-enforcement agency shall not download system data unless such data is related to at least one of these purposes. A law-enforcement agency may download audit trail data for purposes of generating audit reports. A stop of a motor vehicle based on a notification from the system shall be consistent with subsection M.

E. System data shall be purged after 30 days of the date of its capture in such a manner that such data is destroyed and not recoverable by either the vendor or the law-enforcement agency. Audit trail data shall be purged after two years of the date of its capture in such a manner that such data is destroyed and not recoverable by either the vendor or the law-enforcement agency. However, if the system data or the audit trail data is part of an ongoing investigation, prosecution, or civil action, such data shall be retained by the law-enforcement agency until (i) the investigation concludes without any criminal charges or (ii) the final disposition of any criminal or civil matter related to the data, including any direct appeals and any writs of habeas corpus pursuant to Article 3 (§ 8.01-654 et seq.) of Chapter 25 of Title 8.01 or federal law, in accordance with applicable records retention law and policy.

F. System data and audit trail data shall not be subject to disclosure under the Virginia Freedom of Information Act (§ 2.2-3700 et seq.). A law-enforcement agency shall not sell any system data or audit trail data. A law-enforcement agency may share system data or audit trail data for the following purposes:

1. With another law-enforcement agency for purposes set forth in subsection D, which may include allowing another law-enforcement agency to query system data;

2. With the attorney for the Commonwealth for purposes set forth in subsection D or for complying with discovery or a court order in a criminal proceeding;

3. With a defendant or his counsel for purposes of complying with discovery or a court order in a criminal proceeding;

4. Pursuant to a court order or a court-issued subpoena duces tecum in any criminal or civil proceeding;

5. With the vendor for maintenance or quality assurance purposes; or

6. To alert the public to an emergency situation, a missing or endangered person, a person associated with human trafficking, or a person with an outstanding warrant.

In addition, the Department of State Police shall share system data obtained from any system installed, maintained, and operated on any limited access highway or any bridge, tunnel, or special structure under the jurisdiction of the Commonwealth Transportation Board or the Department of Transportation with any law-enforcement agency in the locality where such system is installed, maintained, or operated, and such law-enforcement may share such system data for the purposes set forth in this subsection.

G. A law-enforcement agency that uses a system shall maintain records sufficient to facilitate public reporting as required by this section, the production of an audit trail, and discovery in criminal and civil proceedings, appeals, and post-conviction proceedings.

H. A law-enforcement agency that uses a system shall establish a policy governing such use that is consistent with this section that includes:

1. Training requirements for individuals who will use or access the system;

2. The purposes for which the system can be used or accessed;

3. Procedures to ensure that the databases used by the system to provide notifications as set forth in subsection D are updated at least every 24 hours, or as soon as practicable after such updates become available;

4. Procedures to confirm the accuracy of any notifications made by the system before stopping a vehicle that are consistent with subsection M;

5. A prohibition against downloading system data that is not related to at least one of the purposes set forth in subsection D, except for downloads of audit trail data for purposes of generating audit reports;

6. An internal auditing procedure that occurs at least once every 30 days;

7. Procedures for the retention and destruction of system data and audit trail data that are consistent with subsection E;

8. A prohibition on the sale of system data and audit trail data and restrictions on the sharing of system data and audit trail data that are consistent with subsection F; and

9. Security procedures to protect the system, system data, and audit trail data from unauthorized access, destruction, use, modification, or disclosure.

I. A law-enforcement agency that uses a system shall report to the Department of State Police by April 1 of each year, in a format to be determined by the Department of State Police, on its use of the system during the preceding calendar year, which shall include the following data:

1. The total number of cameras owned or leased by an agency as part of a system at the conclusion of each calendar year, including the number of such cameras designed to be affixed inside or on a motor vehicle, permanently affixed adjacent to a highway, or temporarily affixed or placed adjacent to a highway for purposes of capturing system data;

2. A list of all state and federal databases with which the system data was compared, unless the existence of any such database itself is not public;

3. The total number of times the system was queried, including the specific purposes of the queries, as set forth in subsection D, and the offense types for any criminal investigation;

4. The race, ethnicity, age, and gender of any individual identified as a suspect and charged with a criminal offense as a result of a query of the system as part of a criminal investigation;

5. The number of motor vehicles stopped based on notifications from the system, including the specific reasons for the notifications as set forth in subsection D;

6. The race, ethnicity, age, and gender of the driver of any motor vehicle stopped based on a notification from the system;

7. Whether the agency allows any other law-enforcement agencies to access its system data, and if so, which other agencies have been granted such access; and

8. The number of identified instances of unauthorized use of or access to the system, including the nature and circumstances of such instances.

J. The Department of State Police shall aggregate the data provided pursuant to subsection I and report it to the Governor, the General Assembly, and the Virginia State Crime Commission by July 1 of each year.

K. A law-enforcement agency that uses a system shall publicly post the policy set forth in subsection H and the report set forth in subsection I. Data shall not be publicly posted if it contains personal or case identifying information. If any data (i) contains an articulable concern for any person's safety, (ii) is otherwise prohibited from public disclosure by federal or state statute, or (iii) may compromise sensitive criminal justice information if disclosed, such data may be excluded from being publicly posted.

L. A law-enforcement agency shall not use a system for the purpose of interfering with individuals engaged in lawful activities or tracking individuals on the basis of the content of lawfully protected speech.

M. A notification by a system for purposes set forth in subsection D does not, by itself, constitute reasonable suspicion as grounds for law enforcement to stop a vehicle. Prior to stopping a vehicle based on a notification, a law-enforcement officer shall:

1. Develop independent reasonable suspicion for the stop; or

2. Confirm that the license plate or identifying characteristics of a vehicle match the information contained in the database used to generate the notification.

N. Any person who willfully and intentionally accesses or uses a system for a purpose other than set forth in subsection D, or who willfully and intentionally sells or shares system data or audit trail data in violation of subsection F, is guilty of a Class 1 misdemeanor.

O. Any evidence obtained in violation of subsection D, F, L, or M is not admissible by the Commonwealth in any criminal or civil proceeding, but such evidence may be admitted by a defendant in a criminal proceeding or a litigant, other than the Commonwealth, in a civil proceeding.

P. This section does not apply to systems used:

1. For the enforcement of traffic laws, which includes parking regulations, speed limits, tolling requirements, high-occupancy vehicle requirements, or on-road emissions monitoring;

2. By the Department of Motor Vehicles at permanent weighing stations and in mobile weighing operations; or

3. By any state or local agency or any private entity for non-criminal justice purposes.

Q. A law-enforcement agency shall obtain a permit from the Department of Transportation in accordance with regulations of the Commonwealth Transportation Board before installing a system on a state right-of-way. The Department of State Police shall have sole and exclusive authority to install, maintain, and operate systems for law-enforcement purposes in the right-of-way of any limited access highway or any bridge, tunnel, or special structure under the jurisdiction of the Commonwealth Transportation Board or the Department of Transportation in accordance with the provisions of this section and upon compliance with the regulations of the Commonwealth Transportation Board governing activities in the right-of-way as authorized by § 33.2-210. A vendor may submit a permit application on behalf of the law-enforcement agency if the vendor has obtained a letter of authorization signed by the law-enforcement agency. The provisions of this subsection shall not prevent or limit the use of any system that is authorized by any other provision of law.

§ 52-30.2. Prohibited practices; collection of data.

A. No State Police officer shall engage in bias-based profiling in the performance of his official duties.

B. State Police officers shall collect data pertaining to (i) all investigatory motor vehicle stops, (ii) all stop-and-frisks of a person based on reasonable suspicion, and (iii) all other investigatory detentions that do not result in an arrest or the issuance of a summons to be reported into the Community Policing Reporting Database. State Police officers shall submit the data to their commanding officers, who shall forward it to the Superintendent of State Police.

C. Each time a law-enforcement officer or State Police officer stops a driver of a motor vehicle, stops and frisks a person based on reasonable suspicion, or temporarily detains a person during any other investigatory stop, such officer shall collect the following data based on the officer's observation or information provided to the officer by the driver: (i) the race, ethnicity, age, gender of the person stopped, and whether the person stopped spoke English; (ii) the reason for the stop; (iii) whether the stop was based on a notification from an automatic license plate recognition system, as defined in § 2.2-5517, and if so, the specific reason for the notification as set forth in subsection D of § 2.2-5517; (iv) the location of the stop; (iv) (v) whether a warning, written citation, or summons was issued or whether any person was arrested; (v) (vi) if a warning, written citation, or summons was issued or an arrest was made, the warning provided, violation charged, or crime charged; (vi) (vii) whether the vehicle or any person was searched; and (vii) (viii) whether the law-enforcement officer or State Police officer used physical force against any person and whether any person used physical force against any officers.

D. Each state and local law-enforcement agency shall collect the number of complaints the agency receives alleging the use of excessive force.

2. That the provisions of subsection C of § 2.2-5517 of the Code of Virginia, as created by this act, shall become effective on July 1, 2026. Any law-enforcement agency may enter into or continue an existing contract with a vendor for the installation, use, or maintenance of an automatic license plate recognition system prior to July 1, 2026; however, after such date the terms of such contract must comply with the provisions of subsection C of § 2.2-5517 of the Code of Virginia, as created by this act.

3. That the provisions of subsection C of § 52-30.2 of the Code of Virginia, as amended by this act, shall become effective on January 1, 2026.

4. That the Division of Purchases and Supply of the Department of General Services, in consultation with the Virginia Information Technologies Agency, shall determine the automatic license plate recognition systems for use in the Commonwealth as set forth in subsection B of § 2.2-5517 of the Code of Virginia, as created by this act, and shall publicly post a list of such systems on its website by January 1, 2026.

5. That the provisions of this act shall apply to the use of automatic license plate recognition systems on or after July 1, 2025, and are not retroactive.

6. That the Department of State Police shall develop a model policy for the use of automatic license plate recognition systems by law-enforcement agencies that is consistent with the provisions of this act and shall publicly post such model policy by July 1, 2025.

7. That the first report from law-enforcement agencies as required by subsection I of § 2.2-5517 of the Code of Virginia, as created by this act, shall be due by April 1, 2027.

8. That the first report from the Department of State Police as required by subsection J of § 2.2-5517 of the Code of Virginia, as created by this act, shall be due by July 1, 2027.

9. That the Commonwealth Transportation Board's initial adoption of regulations pursuant to this act shall be exempt from the provisions of the Administrative Process Act (§ 2.2-4000 et seq. of the Code Virginia).

10. That any automatic license plate recognition systems in a Commonwealth Transportation Board controlled right-of-way that were installed prior to the effective date of this act shall be subject to then-existing regulations of the Commonwealth Transportation Board issued pursuant to § 33.2-210 of the Code of Virginia and shall, in order to remain in the right-of-way, obtain land use permits from the Virginia Department of Transportation no later than August 1, 2025.