Albany public safety committee reviews ALPR RFP amid concerns about vendor access and data retention

The Albany City Council's Public Safety Committee on June 22 reviewed the Albany Police Department's competitive bid process for automated license plate reader (ALPR) vendors and discussed data-sharing limits, legal risks and transparency measures.

City staff led the presentation. Police Chief Greg Allen said ALPRs have helped "identify stolen vehicles, locate missing persons, generate investigative leads" but stressed the department is "governing this technology responsibly to ensure we're protecting privacy, civil liberties, and protect the system from those who may misuse this technology." Lieutenant Justin Curlin provided the technical update and procurement timeline: the RFP went live June 1, a bidder-requested extension moved the submission deadline from June 26 to July 6, evaluations are scheduled for July 7'10 and a contract award/notice to proceed is targeted for Sept. 26.

Why it matters: Council members and residents pressed staff about how ALPR data can be shared, how long it should be kept and whether vendor practices put the city at risk. Curlin said Albany has limited retention to 30 days "one of the most protective retention limits in the region," requires users to affirm a lawful purpose at login and can "revoke access to our system at any point." He said Albany has restricted sharing to a "geographic priority zone" of about 105 agencies and removed a pass-through entity, the Northern California Regional Intelligence Center (NICRIC), in March.

Residents and technical experts urged tighter controls. Public commenter Jessica said recent reporting showed "299 illegal federal and out-of-state inquiries within just a 1-year period" on Flock-managed systems and warned that vendor terms "allow Flock'to own data forever" in some contexts; she urged that the risk of vendor access may outweigh modest and uncertain crime-clearance benefits in small jurisdictions. Dr. Evan Star, who works with secure cloud environments, told the committee that vendor-held encryption keys allow vendors to access customer data and comply with subpoenas under the U.S. Cloud Act, and recommended on-premise or zero-knowledge encryption if the city seeks stronger data sovereignty.

Staff responses and next steps: Staff acknowledged the literature on ALPR is limited for small cities and said the department lacks pre-deployment data to test shorter retention windows; that informed choosing a 30-day retention policy so investigators could pursue leads reported days after incidents. On vendor controls, staff said Albany's 2024 contract with the current vendor includes clauses that the vendor cannot unilaterally change data terms and that California law governs disputes, and staff said they would work with the city attorney to add safeguards in any future contract. The department also said it is conducting an audit of past NICRIC searches dating back to October 2024 to determine whether any unauthorized third-party or out-of-state access occurred.

What was not decided: The committee did not vote on contract approval or change retention policy at the meeting; the RFP evaluation and any resulting contract will return to council after legal and procurement review. The RFP evaluation team will include staff from Public Works and Community Development to avoid a police-heavy review team.

Quotable: "We retain data for only 30 days," Lt. Justin Curlin said, calling it "one of the most protective retention limits in the region." Peter Bernhardt, a resident, asked staff to clarify "where the data is stored" and urged release of network audit detail so "someone can follow up to find out if it's not somebody creating a bogus query." Dr. Evan Star warned the committee that "the vendor inherently has access to that data" unless Albany adopts zero-knowledge or on-premise controls.

The next procedural step is completion of the RFP evaluation in July and, if a vendor is selected, negotiation of a contract with added protections before the item returns to council.