ALPR Usage and Privacy Policy - APEX Investigation

APEX Investigation® — ALPR Usage and Privacy Policy

Purpose and Scope

This policy governs how APEX Investigation® (CA PI License #21067) accesses, uses, and protects Automated License Plate Recognition (ALPR) information. It is adopted under California Civil Code §1798.90.5 et seq. and applies to all APEX employees, independent contractors, and any client given access to ALPR-derived results.

The “ALPR system” means one or more fixed or mobile cameras combined with computer algorithms that read and convert images of license plates into computer-readable data. “ALPR information” means the plate images, the plate characters, and the date, time, and location of each capture. APEX does not own, deploy, or operate ALPR cameras or systems. APEX is an “ALPR end-user” as defined in Civil Code §1798.90.5: it accesses ALPR information collected and maintained by third-party commercial ALPR providers, under license agreements with those providers. APEX uses that information solely as an investigative tool in support of its licensed private investigation services.

ALPR information captures vehicles in areas visible to the public. On its own it does not identify a vehicle’s driver or registered owner. Registration and other personally identifying information (PII) is protected by the federal Driver’s Privacy Protection Act (18 U.S.C. §2721 et seq.) and California law, and APEX correlates ALPR information with PII only for a permissible purpose under those laws.

(A) Authorized Uses

APEX does not collect ALPR information; it only queries provider databases. APEX accesses and uses ALPR information only on an assigned case with a documented, legitimate business purpose, and only as permitted by its provider license agreements. Authorized uses are:

Locating or confirming the presence of a specific vehicle connected to a claimant, subject, or witness in an active investigation.
Supporting workers’ compensation surveillance, SIU fraud investigations, and insurance claims investigations performed for insurance carriers, third-party administrators, self-insured employers, public entities, and legal counsel.
Verifying statements, addresses, or activity relevant to an insurance claim or litigation matter.
Any other use permitted under 18 U.S.C. §2721(b) and applicable California law.

Prohibited uses include:

Any personal, non-business, or non-case-related search.
Searches at the request of anyone other than an APEX client with an open assignment.
Locating a person to harass, intimidate, or harm them, or on behalf of anyone subject to a protective or restraining order.
Targeting any person based on race, religion, national origin, gender, sexual orientation, disability, political activity, or other protected characteristic.
Any use that violates federal, state, or local law, or the terms of APEX’s client agreements.

(B) Authorized Users and Training

Only APEX personnel authorized by management may access ALPR information. Access is limited to licensed investigators, SIU and claims staff, and supervisors whose duties require it, and to independent contractors whose contract with APEX expressly covers ALPR work.

Before receiving access, every authorized user must:

Complete APEX’s ALPR training, covering this policy, authorized and prohibited uses, the DPPA, and California Civil Code §1798.90.5 et seq.
Read and understand the user guide and terms of use for each ALPR provider platform they will access.
Receive login credentials issued individually to them; credentials are never shared.
Sign an acknowledgment that they have read and will follow this policy.

Users must complete refresher training annually. Access is revoked immediately on separation from APEX, end of contract, or a policy violation.

(C) Monitoring, Audit and Compliance

APEX keeps a record of every query it makes to an ALPR provider’s database, as required of end-users by Civil Code §1798.90.52. This record is in addition to any logs the provider keeps. Each log entry records:

The date and time the information was accessed.
The license plate number or other data elements used to query the system.
The username of the person who accessed the information and, as applicable, their organization.
The purpose of the access, including the APEX case number.
The IP address or device from which the information was accessed.

APEX management audits the access logs at least quarterly to confirm that every query ties to an open case and an authorized purpose. Suspected misuse is reported to the policy custodian, investigated, and may result in loss of access, discipline up to termination, and referral to authorities where required.

(D) Sharing, Sale and Transfer

APEX does not sell, sublicense, or trade ALPR information obtained from its providers, and follows each provider’s license restrictions on use and redistribution. APEX shares ALPR-derived findings only with the client that assigned the case, and only as part of that case’s investigative report or work product.

APEX may also disclose ALPR information when required by subpoena, court order, or other legal process, or to a law enforcement agency when permitted by law. Every disclosure outside the assigning client is approved by the policy custodian and recorded in the case file.

Clients receiving ALPR-derived findings must use them only for the purpose of the assignment and are bound by the confidentiality terms of their agreement with APEX.

(E) Custodian and Policy Owner

APEX’s third-party providers own and operate their ALPR systems and databases. APEX is the custodian only of the ALPR information it retrieves and keeps in its case files, and is responsible for implementing this policy. APEX’s executive leadership designates an ALPR Policy Custodian, who oversees user access, training, log audits, and disclosure approvals.

(F) Accuracy

ALPR plate reads are automated and can occasionally be inaccurate or incomplete. Before relying on any ALPR result, APEX investigators must visually confirm the plate image matches the computer-read characters and corroborate the result through independent investigation, such as field observation or records verification.

No ALPR result alone is reported to a client as a confirmed finding. Errors identified in ALPR information are documented in the case file, flagged so they are not relied on again, and reported to the provider for correction.

(G) Retention and Destruction

APEX retains ALPR information only as part of the case file it supports. ALPR information is retained for seven (7) years, then securely destroyed.

ALPR information not tied to an active case, including incidental captures, is not retained. Access logs are retained for seven (7) years.

(H) Security

APEX protects ALPR information with reasonable operational, administrative, technical, and physical safeguards, as required by Civil Code §1798.90.51. These include:

Unique, password-protected user accounts with multi-factor authentication where available.
Role-based access limited to authorized users.
Storage only within Caselink or other APEX-approved, access-controlled systems.
No storage of ALPR information on personal devices or unapproved accounts.

Any suspected unauthorized access or data breach is reported immediately to the ALPR Policy Custodian and handled under APEX’s incident response procedures and California breach notification law.

(I) Policy Revisions and Contact

APEX may revise this policy at any time. Revisions take effect when posted and apply to ALPR information accessed or held after that date. This policy is posted on APEX’s website at apexpi.com, as required by Civil Code §1798.90.51.

Questions about this policy may be directed to:

APEX Investigation

2424 K Street, Sacramento, CA 95816

888.900.2739 · referrals@apexpi.com