§3–509.

    (a)    (1)    In this section the following words have the meanings indicated.

        (2)    (i)    “Active data” means:

                1.    data uploaded to individual automatic license plate reader system units before operation; and

                2.    data gathered during the operation of an automatic license plate reader system.

            (ii)    “Active data” does not include historical data.

        (3)    “Automatic license plate reader system” means a system of one or more mobile or fixed high–speed cameras used in combination with computer algorithms to convert images of license plates into computer–readable data.

        (4)    (i)    “Captured plate data” means the global positioning system coordinates, dates and times, photographs, license plate numbers, and any other data collected by or derived from an automatic license plate reader system.

            (ii)    “Captured plate data” includes active data and historical data.

        (5)    “Center” means the Maryland Coordination and Analysis Center.

        (6)    “Criminal justice information” means information relating to criminal justice collected, processed, or preserved by a law enforcement agency.

        (7)    “Historical data” means any data collected by an automatic license plate reader system and stored:

            (i)    in an automatic license plate reader database operated by or for the Maryland Coordination and Analysis Center or by or for a law enforcement agency; or

            (ii)    through cloud computing.

        (8)    “Law enforcement agency” has the meaning stated in § 3–201(d) of this title.

        (9)    “Legitimate law enforcement purpose” means the investigation, detection, or analysis of a crime or a violation of the Maryland vehicle laws or the operation of terrorist or missing or endangered person searches or alerts.

    (b)    (1)    A law enforcement agency may not use captured plate data unless the agency has a legitimate law enforcement purpose.

        (2)    Automatic license plate historical data captured in accordance with this section:

            (i)    is the property of the law enforcement agency;

            (ii)    may not be sold for any purpose by a law enforcement agency or vendor contracted by a law enforcement agency, including the sale of subscriptions or licenses to access data;

            (iii)    may not be accessed by a vendor contracted by a law enforcement agency unless access is expressly requested and authorized by the law enforcement agency;

            (iv)    may not be uploaded for any reason by the law enforcement agency or a vendor contracted by the law enforcement agency that stores the data to any other law enforcement agency or entity, regardless of whether the agency or entity is located inside or outside the State; and

            (v)    may be uploaded to a database owned or operated by the Maryland Coordination and Analysis Center.

        (3)    An employee of a law enforcement agency or the vendor contracted by the law enforcement agency who violates this subsection is subject to imprisonment not exceeding 1 year or a fine not exceeding $10,000 or both.

    (c)    (1)    The Department of State Police and any law enforcement agency using an automatic license plate reader system shall adopt procedures relating to the operation and use of the system.

        (2)    The procedures shall include:

            (i)    which personnel in the Center or a law enforcement agency are authorized to query captured plate data gathered by an automatic license plate reader system;

            (ii)    procedures to protect personally identifiable information and criminal justice information collected and stored in an automatic license plate reader database;

            (iii)    an audit process to ensure that information obtained through the use of an automatic license plate reader system is used only for legitimate law enforcement purposes, including audits of requests made by individual law enforcement agencies, an individual law enforcement officer, or a vendor contracted by a law enforcement agency;

            (iv)    procedures and safeguards to ensure that Center staff with access to the automatic license plate reader database are adequately screened and trained; and

            (v)    procedures to certify whether an automatic license plate reader system experienced a data breach and a requirement for any vendor operating a database for a law enforcement agency to report:

                1.    any breaches of the database;

                2.    the number of employees who have access to the database; and

                3.    any unauthorized releases of information.

    (d)    Information gathered by an automatic license plate reader system is not subject to disclosure under the Maryland Public Information Act.

    (e)    On or before March 1 of each year beginning in 2016, the Department of State Police, in conjunction with the Center and law enforcement agencies that maintain an automatic license plate reader database, shall report to the Senate Judicial Proceedings Committee, the House Judiciary Committee, and the Legislative Policy Committee, in accordance with § 2–1257 of the State Government Article, on the following information based on data from the previous calendar year:

        (1)    the total number of automatic license plate reader units being operated in the State by law enforcement agencies and the number of units submitting data to the Center;

        (2)    the number of automatic license plate reader readings made by a law enforcement agency that maintains an automatic license plate reader database and the number of readings submitted to the Center;

        (3)    the number of automatic license plate reader readings being retained on the automatic license plate reader database;

        (4)    the number of requests made to the Center and each law enforcement agency that maintains an automatic license plate reader database for automatic license plate reader data, including specific numbers for:

            (i)    the number of requests that resulted in a release of information;

            (ii)    the number of out–of–state requests;

            (iii)    the number of federal requests;

            (iv)    the number of out–of–state requests that resulted in a release of information; and

            (v)    the number of federal requests that resulted in a release of information;

        (5)    any data breaches or unauthorized uses of the automatic license plate reader database; and

        (6)    a list of audits that were completed by the Center or a law enforcement agency.