A bill

 

TO AMEND THE SOUTH CAROLINA CODE OF LAWS BY ENACTING THE "SOUTH CAROLINA COMMUNITY DATA PROTECTION AND RESPONSIBLE SURVEILLANCE ACT" SO AS TO PROVIDE NO STATE OR LOCAL ENTITY MAY PARTICIPATE IN ANY SURVEILLANCE SYSTEM THAT STORES SURVEILLANCE DATA ON THIRD PARTY SERVERS OR USE ARTIFICIAL INTELLIGENCE OR AUTOMATED SYSTEMS to TRACK VEHICLES UNDER CERTAIN CIRCUMSTANCES, TO PROVIDE FOR SURVEILLANCE DATA RETENTION AND STORAGE, AND JUDICIAL OVERSIGHT, TO PROVIDE FOR THE PUBLISHING OF CERTAIN ANNUAL REPORTS, AND TO PROVIDE PENALTIES.

 

Whereas, privately operated surveillance networks such as systems provided by Flock Safety collect extensive vehicle data far beyond basic license plate images. These systems use artificial intelligence to identify and track vehicles using appearance-based characteristics including visible damage, accessories, decals, or paint designs; and

 

Whereas, because this data is stored on private, third-party servers, South Carolina communities and law enforcement agencies do not retain true ownership or control of the information they rely upon, creating risks of misuse, repurposing, or unauthorized access; and

 

Whereas, incidents in other states, including the wrongful armed detention of a Black mother and her children in Colorado after a false automated alert, demonstrate the dangers inherent in privatized artificial intelligence-based surveillance systems susceptible to error or misuse; and

 

Whereas, South Carolinians are entitled to privacy, due process, and protection from unwarranted surveillance. The State has a compelling interest in ensuring that any data collected for public safety is safely governed, locally controlled, and strictly limited; and

 

Whereas, the General Assembly declares it necessary to regulate the use, access, storage, and retention of vehicle-surveillance data to protect civil liberties and community safety. Now, therefore,

 

Be it enacted by the General Assembly of the State of South Carolina:

 

SECTION 1.  This act may be cited as the "The South Carolina Community Data Protection and Responsible Surveillance Act."

 

SECTION 2.  Title 23 of the S.C. Code is amended by adding:

 

CHAPTER 45

 

South Carolina Community Data Protection and Responsible Surveillance Act

 

    Section 23-45-10.  As used in this chapter:

       (A) "Automated License Plate Reader (ALPR)" means a system that captures or analyzes images or video of license plates, vehicles, or vehicle features for identification.

       (B) "Vehicle Feature Recognition" means the use of artificial intelligence (AI) or automated software to identify vehicle characteristics other than a license plate number, including body damage, roof racks, decals, bumper stickers, paint patterns, or other distinguishing marks.

       (C) "Third-Party Storage" means any storage of surveillance data on servers or cloud platforms not solely owned, operated, and physically located within South Carolina government facilities.

       (D) "Surveillance Data" means any information produced or derived from ALPR technology including images, metadata, timestamps, GPS coordinates, analytical outputs, alerts, user queries, and search histories.

 

    Section 23-45-20.  (A) No state or local law enforcement agency, may use, contract for, or participate in any surveillance system that stores surveillance data on third-party servers.

    (B) All surveillance data collected within South Carolina must be stored exclusively on secured servers physically located within the State and entirely owned and controlled by South Carolina governmental entities.

    (C) Any contract or agreement contrary to this section is void as against public policy.

 

    Section 23-45-30.  (A) No State or local law enforcement agency may use AI or automated systems that identify, or track vehicles based on appearance, characteristics, or features other than license plates.

    (B) ALPR systems operating in South Carolina may analyze only license plate characters and essential contextual data which includes time, date, and location.

    (C) The use of software to identify or track vehicles based on dents, decals, custom paint, personal accessories, or similar appearance-based traits is prohibited.

 

    Section 23-45-40.  (A) Surveillance data may be retained for no longer than twenty-one days.

    (B) Automatic deletion must occur at the end of the twenty-one-day period unless the data is tied to an active criminal investigation supported by a valid court order.

    (C) Data retained under a court order must be deleted once the investigation closes or the order expires.

    (D) Indefinite, bulk, or archival storage of surveillance data is prohibited.

 

    Section 23-45-50.  (A) Law enforcement agencies may not access, retrieve, or search surveillance data without obtaining a search warrant supported by probable cause. Warrants must describe the specific data sought and investigative purpose. Blanket, exploratory, or generalized access to surveillance data is prohibited.

    (B) Law enforcement agencies may access data without a warrant only when:

       (1) there is an imminent threat to life or serious bodily harm, and

       (2) a warrant cannot reasonably be obtained in time.

    (C) Emergency access must be documented in writing within twenty-four hours and submitted to a judge for review. If the judge finds it unjustified, the data must be deleted and cannot be used in any investigation or proceeding.

    (D) Access to surveillance data shall be restricted to specially designated and trained personnel. Law enforcement officers may not access historical surveillance data directly. Supervisory approval is required for each inquiry.

    (E) Every access or search of surveillance data must be automatically logged with the:

       (1) identity of the accessing user;

       (2) date and time;

       (3) purpose for access; and

       (4) case number or warrant number.

    (F) The logs must be retained for a minimum of five years and made available for independent audit.

    (G) The South Carolina Inspector General shall appoint independent auditors to conduct quarterly compliance audits of every law enforcement agency using ALPR technology. Audit findings must assess compliance with warrant rules, retention limits, and access controls. Summaries of audit results must be published publicly.

    (H) Surveillance data may be used only for specific criminal investigations. Data may not be used for civil enforcement, traffic enforcement, code enforcement, immigration checks, or generalized intelligence gathering.

    (I) Any law enforcement agency that accesses or uses surveillance data without lawful authorization is guilty of a misdemeanor and, upon conviction, must be sentenced to not more than one year in prison, and fined not more than five thousand dollars.

    (J) Surveillance data obtained in violation of this chapter is inadmissible in any criminal, civil, or administrative proceeding.

 

    Section 23-45-60.  (A) Law enforcement agencies operating ALPR systems must publish an annual transparency report that includes:

       (1) the total number of scans collected;

       (2) the number of alerts generated,

       (3) the number of investigations in which ALPR data was used; and

       (4) copies of all vendor contracts or agreements.

    (B) Reports must protect ongoing investigations but must enable meaningful public oversight.

 

    Section 23-45-70.  (A) Any law enforcement agency or official knowingly violating the provisions of this chapter is subject to administrative penalties, civil liability, contract termination, and other remedies as provided by law.

    (B) Any South Carolina resident whose data is unlawfully accessed, retained, or shared may bring a civil action for injunctive relief, damages, and attorney's fees.

 

SECTION 3.  This act takes effect upon approval by the Governor.

----XX----