AUTOMATED LICENSE PLATE RECOGNITION (ALPR) USAGE AND PRIVACY POLICY FOR MANAGED PROPERTIES
ALPR Data Custodian: Director of Information Technology
Email: privacy@arcadiamsc.com
Public Policy URL: https://www.arcadiamsc.com/privacypolicy
1.1 Purpose. Arcadia Management Services Co. (the “Company”) manages commercial, residential and mixed-use properties. At certain managed properties, the Company deploys, administers, accesses, or operates or intends to operate, one or more automated license plate recognition (“ALPR”) cameras systems (“ALPR System”). The ALPR System utilizes cameras and various processes to capture and store digital images of vehicle license plates entering or exiting the property. The ALPR System uses software recognition algorithms to identify license plate characters and creates a searchable computerized database resulting from the data collected by cameras located at the property. ALPR System data (“ALPR Data”) includes license plate number information as well as the date, time and location when the image or information was collected.
The purpose of this Automated License Plate Recognition Usage and Privacy Policy (the “Policy”) is to detail the Company’s use of the ALPR System, and how we use, access, process, share, store, maintain, collect, secure, and retain the ALPR Data that is within the Company’s possession or control, in compliance with all applicable federal, state, and local laws, including California Civil Code sections 1798.90.5 through 1798.90.55.
1.2 Applicability of ALPR Policy. The Policy applies to ALPR Data collected or hosted on the Company’s behalf at an ALPR enabled property for which the Company manages. This Policy does not govern an ALPR System operated exclusively by a property owner, tenant, law enforcement agency, or other third party where the Company does not administer that system and has no authority to access, use, or share its ALPR Data. If the Company later receives access to a third-party system, that access will be approved, documented, and brought within this Policy before use.
1.3 Availability of this Policy. This Policy is available to the public in writing upon request to the Director of Information Technology at privacy@arcadiamsc.com. The Company will also post the current Policy on the Company’s website at the Public Policy URL identified above. The posted version will identify its effective date and supersede prior versions.
2.1 Data Collection. A property managed by the Company that utilizes an ALPR System may collect the license plate image, vehicle image, plate number and state of issuance, date, time, camera location, and available vehicle characteristics such as color and make.
2.2 Authorized Use of ALPR Data. The Company utilizes the ALPR System to capture, analyze, and store ALPR data for the following authorized purposes: (1) managing vehicular access and parking at properties managed by the Company; (2) deterring and investigating theft, vandalism, vehicle break-in, trespassing, and other criminal activity occurring at properties managed by the Company; (3) identifying vehicles associated with a reported crime or a reported incident at a managed property; (4) protecting the safety and security of occupants, visitors, employees, and tenants; (5) responding to a safety or security incident at a managed property; and (6) providing ALPR Data to a law enforcement agency, consistent with this Policy, in support of an official and lawful investigation or in response to an imminent theat.
2.3 Restricted Uses. The Company does not make the ALPR System or ALPR Data available to individuals for any personal or non-commercial purpose. The Company does not sell ALPR Data. The Company only uses the ALPR System to collect license plate data from vehicles in areas of the property open to public view, such as entrances, exits, and parking area. ALPR Data shall not be used by the Company to harass, intimidate, or discriminate against any individual or constitutionally protected group.
3.1 Management of the ALPR System. The Company remains responsible for implementing this Policy for ALPR Data within its possession or control. A written agreement with each service provider that hosts, processes, maintains, or administers an ALPR System will require the provider, as applicable, to use ALPR Data only to perform contracted services; maintain reasonable security and access controls; maintain required access records; follow the Company’s configured retention and deletion rules; provide prompt notice of suspected unauthorized access, use, or disclosure; prohibit sale and unauthorized secondary use; restrict onward disclosure; and cooperate with audits, incident response, and legal compliance.
The ALPR System deployed at a property managed by the Company is installed and hosted by independent third-party service providers, which perform collection, storage, security, retention, and deletion functions on the Company’s behalf under written agreement. The Company does not delegate, and the service provider does not assume, the Company’s obligations under applicable laws, including California Civil Code sections 1798.90.51 through 1798.90.53. The Company remains responsible for compliance as to ALPR Data within its possession or control and ensures through written agreements that each service provider implements security procedures and privacy practices consistent with this Policy and applicable law.
3.2 Authorized Users. Authorized users with access to ALPR Data include employees and contractors with an operational need to oversee the ALPR System. Access to configure, operate, or administer the ALPR System is restricted to individuals holding the following job titles or roles, or their designated backups, who have completed the training described below: (1) Director of Commercial Property Management; (2) Director of Residential Property Management; (3) Assistant property managers, and security or risk-management personnel, limited to the Company’s properties for which they have assigned responsibility; (4) Legal, compliance, or audit personnel, for a specific legal, compliance, audit, claim, or incident-response purpose; (5) Information technology or information-security personnel; and (6) Independent contractors performing a specific function. Authorized users are responsible for complying with this Policy and may have their access suspended or revoked for any misuse.
Each Authorized User must have a unique individual account. Credentials may not be shared. Multi-factor authentication must be used where supported. Access will be reviewed periodically and promptly suspended or revoked when the business need ends, the user changes roles or separates, or misuse is suspected.
3.3 Access. Access to ALPR data is limited to personnel with a documented operational need. The Company’s Authorized Users, as identified in Section 3.2, may query data in the ALPR System. Logins and queries by Authorized Users are recorded and monitored, and the record includes: (1) the username of the person who accessed the ALPR Data and, as applicable, the organization or entity with which that person is affiliated; (2) the date and time of access; (3) the purpose of the query; and (4) the license plate number or other data elements used in the query. Any employee who becomes aware of unauthorized access or misuse of ALPR information shall immediately notify the Data Custodian as identified in Section 3.4.
A record containing the same information is maintained for every instance in which the Company accesses or provides access to ALPR Data, including access by a law enforcement agency user under Section 4.3 and access by service-provider personnel under Section 4.1. Where the record is generated and held by the Company’s service provider, the Company’s written agreement with that provider requires the provider to create and retain that record and to make it available to the Company on request.
3.4 Data Custodian. The Director of Information Technology is the official custodian and head administrator responsible for implementing this Policy. The Data Custodian approves Company users, defines permission levels, approves law enforcement sharing, confirms retention settings, oversees training, reviews audits and incidents, and coordinates legal and privacy compliance. A documented backup may perform these functions when the Data Custodian is unavailable, but the Data Custodian retains oversight responsibility.
3.5 Training. Each Authorized User must complete training before being granted access to the ALPR System or ALPR data. Training is designed to protect and safeguard individual privacy and to ensure compliance with applicable laws, and covers, at a minimum: (1) the terms of this Policy and the authorized and restricted uses in Section 2; (2) permissible query purposes and the obligation to record a purpose for each query; (3) the prohibition on personal or harassing use, and on sharing credentials; (4) data security practices; and (5) recognizing and immediately reporting suspected unauthorized access, misuse, or a security incident. A record of all completed training, including the date and the name of each authorized user trained, is maintained by the Company. The Data Custodian or their designee is responsible for the development and implementation of training requirements for all Authorized Users, and assumes responsibility for the implementation of this Policy.
3.6 Company Operator and End-User Status. The Company may act as an ALPR operator, as an ALPR end-user, or as both, as those terms are defined in Civil Code section 1798.90.5. Where the Company operates an ALPR System, the obligations of Civil Code section 1798.90.51 apply. Where the Company or its personnel access or use an ALPR System the obligations of Civil Code section 1798.90.53 apply. This Policy governs the Company’s own collection, access, use, sharing, and retention of ALPR Data.
3.7 Monitoring and Compliance. The Data Custodian or their designee monitors the ALPR System to ensure the security of ALPR Data and compliance with this Policy and applicable laws. Monitoring consists of: (1) review of the ALPR System access and query logs; (2) review of Authorized Users and permissions to access ALPR data; (3) confirmation of retention and deletion settings; (4) confirmation of sharing confirmation and approved law enforcement agency list; (5) review of training records. Monitoring is performed at least annually and promptly upon any report of suspected unauthorized access or misuse.
4.1 Service-Provider Access. The Company’s designated service-provider and approved contractors may access or process ALPR Data as reasonably necessary to provide, secure, maintain, troubleshoot or improve the contracted services, comply with the law, or respond to a security or technical issue.
4.2 General Restrictions & Process. The Company will not sell, rent, or exchange ALPR Data. Sharing, transfer, or disclosure is permitted only for an authorized purpose, through a process described in this Policy. Except for legally compelled disclosures, sharing must be approved by the Data Custodian or occur through a sharing configuration approved in advance by the Data Custodian.
4.3 Law Enforcement Sharing. The Company may enable match-based sharing for an ALPR System at one or more properties. Where the Company has enabled match-based sharing for a covered ALPR System, an authorized user of an approved law enforcement agency may query the ALPR Data by entering a license plate, vehicle characteristic, or other criteria into the ALPR System. The Company’s service provider acts as the technical intermediary, comparing the criteria against ALPR Data available under the Company’s sharing configuration and, if a match exists, returning responsive ALPR Data to the agency. A Company employee does not separately review or approve each agency query.
Match-based sharing is enabled only for law enforcement agencies on an approved agency list maintained by the Data Custodian. An agency is added only by documented approval of the Data Custodian, and sharing is not enabled on a default, portfolio-wide, or open basis. An authorized law enforcement agency may use shared ALPR Data only for official and lawful investigations, a response to an imminent threat to life or serious bodily injury, or another documented public-safety purpose consistent with this Policy. Each approved agency must require its users to record a case number or a documented public-safety purpose for every query, and must confirm that its users are bound by the agency’s own ALPR usage and privacy policy and by applicable law.
ALPR Data made available under this Section may be used only for the authorized purposes described in this Policy. The Company requires each approved agency to agree to that limitation as a condition of being added to the approved agency list.
4.4 Company Disclosure of ALPR Data. The Company may make a case-specific disclosure of the minimum necessary ALPR Data: (a) to a law enforcement or governmental agency responding to a documented request related to a specific crime, emergency, or material safety incident; (b) in response to a valid subpoena, warrant, court order, or other legally compelled process; or (c) to a property owner, insurer, legal counsel, or approved security provider where reasonably necessary to investigate or respond to a specific incident, claim, threat, or legal obligation involving a property managed by the Company. Except where disclosure is legally compelled, the Data Custodian or their designee must approve the disclosure in advance. Each disclosure is documented, including the recipient, the date, the ALPR Data disclosed, and the basis for the disclosure.
5.1 Data Storage & Retention. ALPR Data is stored in the databases of the Company’s service providers. ALPR Data in the Company’s possession or control is retained for thirty (30) days from the date of capture, after which it is automatically and permanently deleted from the ALPR System in the ordinary course, unless retention beyond that period is necessary as described below.
The Company may preserve or export the minimum ALPR Data reasonably necessary for a specific active investigation, incident, insurance claim, litigation hold, subpoena, warrant, court order, or other legal obligation, in which case it will be retained only until the applicable legal process, investigation, or hold concludes. Each preservation is documented by the Data Custodian, including the ALPR Data preserved, the reason for preservation, and the date. The Data Custodian or their designee reviews each open preservation no less than quarterly and, upon determining in consultation with legal counsel that the underlying investigation, claim, hold, or legal process has concluded, causes the preserved ALPR Data to be permanently deleted. The Data Custodian is responsible for confirming, at least annually, that ALPR Data is retained consistent with this Policy.
5.2 Security and Monitoring. The Company shall implement and maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of ALPR Data. These safeguards are designed to protect ALPR Data from unauthorized access, destruction, use, modification, or disclosure, including: (1) role-based access controls limiting ALPR System access to individuals identified in this Policy; (2) obtaining unique login credentials for each authorized user; and (3) logging each instance in which ALPR Data is accessed.
5.3 Data Verification. The Company shall take reasonable measures to help ensure the accuracy of ALPR Data and to correct data errors, including periodic verification that the ALPR System’s plate-recognition algorithm is functioning within the manufacturer’s stated accuracy parameters. The Company tests each ALPR System at least annually for accuracy and documents the results.
5.4 Periodic Audits. The Company will conduct periodic audits of ALPR System access logs to confirm that all access to and use of ALPR Data is consistent with this Policy, including retention and destruction practices and any sharing or transfer of ALPR Data. The audit shall be performed by the Data Custodian or their designee at least annually. Audit findings should be documented by the Data Custodian.
5.5 Incident Response. The Company will promptly investigate any suspected unauthorized access, use, modification, destruction, or disclosure of ALPR Data. Where required by California law, notifications shall be provided in accordance with applicable data breach statutes. Questions regarding this Policy or alleged misuse of the ALPR Data should be directed to the Data Custodian.
5.6 Notice at the Property. The Company will post conspicuous signage at vehicular entrances at each property where an ALPR System is deployed.
6.1. Policy Review. The Data Custodian will review this Policy at least annually and whenever there is a material change to law, technology, vendor terms, data collection, retention, or sharing practices.
6.2 Changes to this Policy. This Policy may be amended from time to time to account for new policies, procedures, or changes in the law. Any amended version will be made publicly available in writing and, where applicable, posted on the Company’s website.
