Best Practices for Automated Licence Plate Recognition Technologies

Automated licence plate recognition (ALPR) technologies can quickly capture and match large volumes of licence plate numbers to lists of plates stored in a database. Police services in Ontario use ALPR systems to match licence plates with lists of plates, such as stolen and expired plates and plates registered to suspended drivers. These systems can also be set up to capture other information, such as the location of vehicles at specific times and dates. As a result, ALPR systems have the potential to be used to track individuals’ locations over time, making it easier for police to conduct surveillance and profiling.

The use of ALPR systems raises significant privacy concerns. Among those concerns are potential failures to comply with Ontario’s privacy legislation, and intrusions on other fundamental rights and liberties. Proper policies, procedures and technical controls are critical to protecting privacy, particularly when considering that most drivers are law-abiding individuals simply going about their everyday activities.

The IPC has done considerable work relating to these technologies with the Ontario Provincial Police, the Toronto Police Service and a number of municipal police services across the province.  To assist other services considering implementing this technology, we have published Guidance on the Use of Automated Licence Plate Recognition Systems by Police Services. It outlines the key obligations of police under privacy legislation in their use of ALPR systems and provides guidance for using these systems in a privacy-protective manner.  It addresses the use of ALPR systems by police for public safety purposes, in particular for the purpose of alerting an officer in an ALPR-equipped vehicle to the presence of a particular licence plate.

Best practices for implementing an ALPR program include:

• Conducting a Privacy Impact Assessment
• Ensuring a comprehensive governance framework is in place
• Implementing policies and procedures to ensure the appropriate handling of personal information
• Notifying the public about the program through a combination of practices, such as verbal notices, insignias on police vehicles and website notifications
• Limiting the retention of non-hit data