Maryland License Plate Reader Laws

Status at a glance

The statute and its 2024 amendments

Maryland’s ALPR statute is § 3-509 of the Public Safety Article. It was last amended by Chapter 876 of 2024 (Senate Bill 840), approved May 16, 2024 and effective October 1, 2024. That act extended “historical data” to data stored “through cloud computing,” made historical data the agency’s property, barred its sale, limited vendor access and uploading, and extended the criminal penalty to contracted vendors.

The statute defines an automatic license plate reader system as “a system of one or more mobile or fixed high–speed cameras used in combination with computer algorithms to convert images of license plates into computer–readable data” (§ 3-509(a)(3)). Its use limits bind law enforcement agencies and their contracted vendors. It doesn’t address privately owned cameras, such as HOA or business systems. See private and HOA cameras.

Legitimate law enforcement purpose

“A law enforcement agency may not use captured plate data unless the agency has a legitimate law enforcement purpose” (§ 3-509(b)(1)). That term means “the investigation, detection, or analysis of a crime or a violation of the Maryland vehicle laws or the operation of terrorist or missing or endangered person searches or alerts” (a)(9).

Ownership, sale and uploading

Under subsection (b)(2), historical data captured under the section:

• is the property of the law enforcement agency;
• may not be sold for any purpose by the agency or its contracted vendor, “including the sale of subscriptions or licenses to access data”;
• may not be accessed by a contracted vendor “unless access is expressly requested and authorized by the law enforcement agency”;
• “may not be uploaded for any reason by the law enforcement agency or a vendor contracted by the law enforcement agency that stores the data to any other law enforcement agency or entity, regardless of whether the agency or entity is located inside or outside the State”; and
• may be uploaded to a database owned or operated by the Maryland Coordination and Analysis Center (MCAC).

An agency employee or contracted vendor who violates subsection (b) “is subject to imprisonment not exceeding 1 year or a fine not exceeding $10,000 or both” (b)(3). The statute contains no rule excluding evidence. How the upload ban applies to networks that let agencies search one another’s data hasn’t been tested in any source we found. See can police search Flock data from other states?

No statutory retention period

Section 3-509 doesn’t set a number of days for keeping captured plate data. Retention depends on each agency’s procedures. See ALPR data retention and sharing.

Required procedures, audits and reporting

The Department of State Police and every agency using an ALPR system “shall adopt procedures relating to the operation and use of the system” (c)(1). They must cover who may query the data, protection of personal and criminal justice information, staff screening and training, data breach certification, and “an audit process to ensure that information obtained through the use of an automatic license plate reader system is used only for legitimate law enforcement purposes” (c)(2)(iii). Those audits include requests by individual agencies, officers and vendors.

Under subsection (e), the State Police report each year to legislative committees on units in operation, readings, requests (including out-of-state and federal requests, and how many led to a release), breaches or unauthorized uses, and “a list of audits that were completed by the Center or a law enforcement agency.”

Public records

“Information gathered by an automatic license plate reader system is not subject to disclosure under the Maryland Public Information Act” (§ 3-509(d)). General Provisions § 4-326(b) adds that a custodian of captured plate data “shall deny inspection of the captured plate data,” except for use or sharing authorized under § 3-509 and for electronic toll systems. See public records requests for ALPR data.

The coordination center’s procedure

MCAC’s “Automated License Plate Recognition Program Standard Operating Procedure” was posted on its site in 2024, but its page footers are dated August 17, 2012. It predates the 2024 amendments and may not reflect current practice. It governs MCAC’s central database, not other agencies’ own systems.

• “LPR data will be queried and disseminated only if there is legal process requiring these actions or there is reasonable suspicion that an individual or enterprise is involved in criminal conduct or activity and the information is relevant to that criminal conduct or activity and the requestor has a legitimate need to know.”
• Data is stored “for a period not to exceed one year,” then purged unless it has become, or is reasonably expected to become, evidence, including evidence that may inculpate or exculpate a suspect.
• “All transactions and queries of the system are logged in MEMEX and are subject to review at any time.” Query logs record the user, the plate or other data queried, the date and time, and the response. Files are audited at least yearly by an independent auditor.

What this can mean in a Maryland case

• What legitimate law enforcement purpose was recorded for the query?
• Was historical data uploaded to, or accessed by, another agency or entity other than MCAC? Did a vendor access it without the agency’s express request and authorization?
• What procedures has the agency adopted under subsection (c), and what do its audits show? See ALPR audit logs and search records.
• How long did the agency keep the data, and under what written policy?
• If the data came from MCAC, was there legal process or documented reasonable suspicion and need to know?