Use of Surveillance Technology by Law Enforcement

Second Regular Session Seventy-fifth General Assembly STATE OF COLORADO INTRODUCED LLS NO. 26-0597.01 Christopher McMichael x4775 SENATE BILL 26-071 SENATE SPONSORSHIP Zamora Wilson, HOUSE SPONSORSHIP (None), Senate Committees House Committees Judiciary A BILL FOR AN ACT CONCERNING THE REGULATION OF LAW ENFORCEMENT SURVEILLANCE TECHNOLOGIES TO PROTECT CITIZENS.

Bill Summary (Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.) The bill establishes the "Surveillance Accountability and Freedom Ensured (SAFE) Act" (SAFE Act). On and after July 1, 2027, the SAFE Act requires a law enforcement agency to use surveillance technology only for lawful purposes directly related to public safety or for an active investigation. If a law enforcement agency uses surveillance technology to Shading denotes HOUSE amendment. Double underlining denotes SENATE amendment.

Capital letters or bold & italic numbers indicate new material to be added to existing law. Dashes through the words or numbers indicate deletions from existing law.

collect surveillance data, the law enforcement agency must comply with certain requirements related to the collection, storage, sharing, and destruction of the data. The law enforcement agency must ensure that: ! Facial recognition systems are only used after a warrant is obtained or in exigent circumstances when there is an imminent threat to public safety; ! Traffic cameras and automated license plate readers must only be used in public spaces and for specific enforcement purposes, such as traffic violations or identifying stolen vehicles; and ! Drone cameras are operated in compliance with federal aviation administration regulations. A law enforcement agency may store data collected by surveillance technology only for a specified amount of time depending on the type of technology used and how the data is collected or until an active investigation is concluded. A law enforcement agency shall not sell any data that is collected from its surveillance technologies, but the law enforcement agency may share the surveillance data with another law enforcement agency if the data is related to an active investigation and the other law enforcement agency agrees to comply with the requirements of the SAFE Act. A law enforcement agency must also ensure that surveillance data is permanently destroyed at the end of an applicable retention period or once the data is no longer needed for the matter. The bill creates civil penalties for violations of these provisions. The bill also requires a law enforcement agency to make certain information related to the law enforcement agency's compliance with the SAFE Act available to residents who request it at no cost to the resident. The bill requires the attorney general to conduct an audit of a law enforcement agency every 2 years and authorizes the attorney general to bring a civil action to enforce the SAFE Act.

Be it enacted by the General Assembly of the State of Colorado: SECTION 1. Short title. The short title of this act is the "Surveillance Accountability and Freedom Ensured (SAFE) Act". SECTION 2. Legislative declaration. (1) The general assembly finds and declares that:

(a) The use of surveillance technologies by law enforcement agencies, including the use of speed cameras, automated license plate readers, red-light cameras, pole-mounted cameras, drones, and facial recognition systems, can enhance public safety by aiding in the prevention, detection, and investigation of crimes;

(b) However, the unchecked deployment and use of surveillance technologies pose significant risks to the privacy, civil liberties, and constitutional rights of Coloradans, including the potential for surveillance without a warrant, misuse of data, and disproportionate impacts on marginalized communities;

(c) It is necessary to establish clear guardrails on the use, collection, storage, access, sharing, and destruction of data obtained through surveillance technologies in order to strike a proper balance between protecting privacy and promoting public safety; and (d) These guardrails must include mechanisms for public transparency and accountability with minimal bureaucratic hurdles to ensure compliance and build public trust.

SECTION 3. In Colorado Revised Statutes, add part 15 to article 31 of title 24 as follows:

PART 15 SURVEILLANCE ACCOUNTABILITY FOR LAW ENFORCEMENT AGENCIES

24-31-1501. Definitions.

AS USED IN THIS PART 15, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(1) "AUTHORIZED PERSONNEL" MEANS AN EMPLOYEE OF A LAW ENFORCEMENT AGENCY WHO HAS BEEN TRAINED AND CERTIFIED IN THE PROPER USE AND HANDLING OF SURVEILLANCE DATA, AS DETERMINED BY THE LAW ENFORCEMENT AGENCY'S POLICY DEVELOPED IN COMPLIANCE WITH THIS PART 15.

(2) "INVESTIGATION" MEANS AN ACTIVE INQUIRY INTO A SPECIFIC ALLEGED VIOLATION OF LAW BASED ON REASONABLE SUSPICION OR PROBABLE CAUSE.

(3) "LAW ENFORCEMENT AGENCY" HAS THE SAME MEANING AS "STATE OR LOCAL LAW ENFORCEMENT AGENCY" AS DEFINED IN SECTION 24-33.5-115 (4)(b).

(4) "SURVEILLANCE DATA" MEANS INFORMATION COLLECTED, RECORDED, OR GENERATED BY SURVEILLANCE TECHNOLOGY, INCLUDING IMAGES, VIDEOS, METADATA, LICENSE PLATE NUMBERS, FACIAL SCANS, LOCATION DATA, OR DERIVED ANALYTICS.

(5) (a) "SURVEILLANCE TECHNOLOGY" MEANS AN ELECTRONIC DEVICE OR SYSTEM USED BY A LAW ENFORCEMENT AGENCY FOR THE PURPOSE OF MONITORING, RECORDING, OR ANALYZING INDIVIDUALS, VEHICLES, OR PUBLIC SPACES.

(b) "SURVEILLANCE TECHNOLOGY" INCLUDES:

(I) SPEED CAMERAS;

(II) AUTOMATED LICENSE PLATE READERS;

(III) RED-LIGHT CAMERAS;

(IV) POLE-MOUNTED CAMERAS;

(V) DRONES OR OTHER UNMANNED AERIAL VEHICLE SURVEILLANCE SYSTEMS;

(VI) FACIAL RECOGNITION SOFTWARE OR SYSTEMS; AND (VII) OTHER TECHNOLOGY USED BY A LAW ENFORCEMENT AGENCY TO CAPTURE VISUAL, AUDIO, OR LOCATION INFORMATION.

24-31-1502. Restrictions on surveillance data collection by law enforcement agencies - public impact assessment.

(1) A LAW ENFORCEMENT AGENCY MAY USE SURVEILLANCE TECHNOLOGY ONLY FOR LAWFUL PURPOSES DIRECTLY RELATED TO PUBLIC SAFETY, INCLUDING TRAFFIC ENFORCEMENT, CRIME PREVENTION, OR AN ACTIVE INVESTIGATION.

(2) A LAW ENFORCEMENT AGENCY THAT USES SURVEILLANCE TECHNOLOGY TO COLLECT SURVEILLANCE DATA SHALL:

(a) USE THE SURVEILLANCE TECHNOLOGY ONLY IN A MANNER THAT NONRELEVANT INDIVIDUALS OR ACTIVITIES;

IS TARGETED AND MINIMIZES INCIDENTAL CAPTURE OF

(b) USE FACIAL RECOGNITION SYSTEMS ONLY AFTER OBTAINING A WARRANT OR IN EXIGENT CIRCUMSTANCES WHEN THERE IS AN IMMINENT THREAT TO PUBLIC SAFETY;

(c) CONFIGURE AUTOMATED LICENSE PLATE READERS, SPEED CAMERAS, RED-LIGHT CAMERAS, TRAFFIC CAMERAS, AND OTHER SURVEILLANCE TECHNOLOGY USED IN TRAFFIC ENFORCEMENT TO CAPTURE SURVEILLANCE DATA ONLY FROM PUBLIC SPACES AND FOR SPECIFIC LAW ENFORCEMENT PURPOSES, SUCH AS IDENTIFYING STOLEN VEHICLES OR ENFORCING TRAFFIC LAWS; AND

(d) OPERATE DRONES OR OTHER UNMANNED AERIAL VEHICLE SURVEILLANCE SYSTEMS ONLY IN COMPLIANCE WITH FEDERAL AVIATION ADMINISTRATION REGULATIONS AND SHALL INCLUDE REAL-TIME LOGGING OF FLIGHT PATHS AND SURVEILLANCE DATA COLLECTION SCOPES.

(3) (a) BEFORE A LAW ENFORCEMENT AGENCY PURCHASES, CONTRACTS FOR OR RENEWS A CONTRACT FOR, DEPLOYS IN A NEW WAY OR LOCATION, OR UPGRADES A SURVEILLANCE TECHNOLOGY, THE LAW ENFORCEMENT AGENCY SHALL:

(I) CONDUCT A PUBLIC PRIVACY IMPACT ASSESSMENT THAT INCLUDES COMMUNITY INPUT AND AN OPPORTUNITY FOR PUBLIC TESTIMONY; AND

(II) OBTAIN APPROVAL FROM THE GOVERNING BODY OF THE STATE OR LOCAL GOVERNMENT ENTITY THAT OVERSEES THE LAW ENFORCEMENT AGENCY.

(b) THE REQUIREMENTS OF SUBSECTION (3)(a) OF THIS SECTION APPLY TO A LAW ENFORCEMENT AGENCY THAT CURRENTLY USES SURVEILLANCE TECHNOLOGY WHENEVER THE LAW ENFORCEMENT AGENCY:

(I) TECHNOLOGY;

RENEWS A CONTRACT FOR THE USE OF SURVEILLANCE

(II) PURCHASES OR DEPLOYS A NEW TYPE OF SURVEILLANCE TECHNOLOGY;

(III) DEPLOYS AN EXISTING SURVEILLANCE TECHNOLOGY IN A NEW MANNER OR IN A NEW LOCATION; OR

(IV) UPGRADES THE LAW ENFORCEMENT AGENCY'S EXISTING SURVEILLANCE TECHNOLOGY SYSTEMS.

24-31-1503. Surveillance data - storage and retention of data - destruction of data - access and sharing of data - prohibition on sale of data.

(1) A LAW ENFORCEMENT AGENCY THAT COLLECTS SURVEILLANCE DATA SHALL ENSURE THAT THE SURVEILLANCE DATA IS STORED SECURELY, INCLUDING ENSURING THAT THE SURVEILLANCE DATA IS ENCRYPTED OR OTHERWISE RENDERED UNREADABLE TO AN UNAUTHORIZED USER BY USING A METHOD OR TECHNOLOGY GENERALLY ACCEPTED IN THE FIELD OF INFORMATION SECURITY.

(2) UNLESS THE SURVEILLANCE DATA IS PART OF AN ACTIVE INVESTIGATION:

(a) SURVEILLANCE DATA COLLECTED FROM TRAFFIC CAMERAS, SPEED CAMERAS, RED-LIGHT CAMERAS, AND AUTOMATED LICENSE PLATE READERS MUST NOT BE STORED FOR LONGER THAN THIRTY DAYS;

(b) SURVEILLANCE DATA COLLECTED FROM POLE-MOUNTED CAMERAS, DRONES, OR OTHER UNMANNED AERIAL VEHICLE SURVEILLANCE SYSTEMS MUST NOT BE STORED FOR LONGER THAN NINETY DAYS; AND

(c) SURVEILLANCE DATA COLLECTED FROM FACIAL RECOGNITION SOFTWARE OR SYSTEMS MUST NOT BE STORED FOR LONGER THAN SEVEN DAYS.

(3) IF SURVEILLANCE DATA IS PART OF AN ACTIVE INVESTIGATION, THE SURVEILLANCE DATA MAY BE RETAINED UNTIL THE MATTER IS RESOLVED, INCLUDING THE CONCLUSION OF ANY APPEALS, BUT MUST BE REVIEWED ANNUALLY FOR NECESSITY AND DESTROYED IF THE DATA IS NO LONGER RELEVANT TO THE MATTER.

(4) (a) A LAW ENFORCEMENT AGENCY SHALL ENSURE THAT ACCESS TO SURVEILLANCE DATA IS LIMITED TO AUTHORIZED PERSONNEL AND THAT SURVEILLANCE DATA IS ACCESSED ONLY FOR LEGITIMATE LAW ENFORCEMENT PURPOSES.

(b) WHEN AUTHORIZED PERSONNEL ACCESSES SURVEILLANCE DATA, THE AGENCY SHALL ENSURE THAT INFORMATION RELATED TO THAT ACCESS IS COLLECTED, INCLUDING:

(I) THE NAME OF THE PERSON THAT ACCESSED THE SURVEILLANCE DATA;

(II) THE DATE AND TIME THE PERSON ACCESSED THE SURVEILLANCE DATA; AND

(III) THE PURPOSE FOR WHICH THE SURVEILLANCE DATA WAS ACCESSED.

(c) THE LAW ENFORCEMENT AGENCY SHALL RETAIN THE INFORMATION COLLECTED IN ACCORDANCE WITH SUBSECTION (4)(b) OF THIS SECTION FOR AT LEAST FIVE YEARS AFTER THE DATE THE SURVEILLANCE DATA WAS ACCESSED.

(5) A LAW ENFORCEMENT AGENCY MAY SHARE SURVEILLANCE DATA WITH ANOTHER LAW ENFORCEMENT AGENCY IF:

(a) THERE IS A SPECIFIC, DOCUMENTED NEED FOR THE OTHER LAW ENFORCEMENT AGENCY TO ACCESS THE SURVEILLANCE DATA AND THE NEED IS RELATED TO AN ACTIVE INVESTIGATION; AND (b) THE LAW ENFORCEMENT AGENCY THAT RECEIVES THE SURVEILLANCE DATA AGREES, IN WRITING, TO COMPLY WITH THE REQUIREMENTS OF THIS PART 15.

(6) (a) A LAW ENFORCEMENT AGENCY OR AN EMPLOYEE OR CONTRACTOR OF A LAW ENFORCEMENT AGENCY SHALL NOT SELL, LICENSE, OR OTHERWISE MONETIZE SURVEILLANCE DATA COLLECTED BY THE LAW ENFORCEMENT AGENCY.

(b) A LAW ENFORCEMENT AGENCY OR AN EMPLOYEE OR CONTRACTOR OF A LAW ENFORCEMENT AGENCY THAT VIOLATES SUBSECTION (6)(a) OF THIS SECTION MAY BE SUBJECT TO CIVIL PENALTIES IN ACCORDANCE WITH SECTION 24-31-1505.

(7) (a) A LAW ENFORCEMENT AGENCY SHALL PERMANENTLY AND SECURELY DESTROY SURVEILLANCE DATA AT THE END OF THE RETENTION PERIOD DESCRIBED IN SUBSECTION (2) OF THIS SECTION OR WHEN THE SURVEILLANCE DATA IS NO LONGER NEEDED FOR AN ACTIVE MATTER.

(b) A LAW ENFORCEMENT AGENCY SHALL ENSURE THAT SURVEILLANCE DATA IS DESTROYED IN A MANNER IN WHICH THE SURVEILLANCE DATA CANNOT BE RECOVERED.

(c) A LAW ENFORCEMENT AGENCY SHALL COLLECT INFORMATION RELATED TO THE DESTRUCTION OF SURVEILLANCE DATA, INCLUDING THE DATE AND METHOD OF DESTRUCTION, AND SHALL MAINTAIN A RECORD OF THAT INFORMATION FOR AT LEAST FIVE YEARS AFTER THE DATE THE SURVEILLANCE DATA WAS DESTROYED.

24-31-1504. Verification of compliance and transparency.

(1) A RESIDENT OF THE JURISDICTION SERVED BY A LOCAL LAW ENFORCEMENT AGENCY, OR A RESIDENT OF THE STATE FOR THE COLORADO STATE PATROL OR COLORADO BUREAU OF INVESTIGATION, MAY REQUEST INFORMATION FROM THE LAW ENFORCEMENT AGENCY REGARDING THE AGENCY'S USE OF SURVEILLANCE TECHNOLOGY AND THE AGENCY'S COLLECTION, STORAGE, AND DESTRUCTION OF SURVEILLANCE DATA THAT DEMONSTRATES THE LAW ENFORCEMENT AGENCY'S COMPLIANCE WITH THIS PART 15. THE LAW ENFORCEMENT AGENCY SHALL PROVIDE THE INFORMATION REQUESTED FREE OF CHARGE TO THE RESIDENT.

(2) A REQUEST SUBMITTED BY A RESIDENT IN ACCORDANCE WITH SUBSECTION (1) OF THIS SECTION MAY BE SUBMITTED TO THE LAW ENFORCEMENT AGENCY THROUGH EMAIL, THROUGH AN ONLINE PORTAL, OR BY MAIL. A LAW ENFORCEMENT AGENCY THAT RECEIVES A REQUEST SHALL SEND A RESPONSE TO THE RESIDENT WITHIN TEN BUSINESS DAYS AFTER RECEIVING THE REQUEST.

A LAW ENFORCEMENT AGENCY MAY DEMONSTRATE COMPLIANCE WITH THIS PART 15 IN RESPONSE TO A REQUEST SUBMITTED PURSUANT TO THIS SECTION BY PROVIDING THE REQUESTING RESIDENT THE FOLLOWING INFORMATION:

(a) CONFIRMATION THAT SPECIFIC SURVEILLANCE DATA RELATED TO THE REQUESTOR'S PERSONAL IDENTIFYING INFORMATION HAS BEEN DESTROYED;

(b) ACCESS TO ANONYMIZED LOGS THAT DEMONSTRATE WHETHER SURVEILLANCE DATA RELATED TO THE REQUESTOR WAS ACCESSED, SHARED, OR DESTROYED; AND

(c) REPORTS ON THE LAW ENFORCEMENT AGENCY'S OVERALL COMPLIANCE WITH THIS PART 15, INCLUDING ANY ANNUAL REPORTS OR AUDITS CONDUCTED PURSUANT TO SUBSECTION (4) OR (5) OF THIS SECTION. THE LAW ENFORCEMENT AGENCY SHALL ENSURE THAT ALL PERSONAL IDENTIFYING INFORMATION HAS BEEN REDACTED FROM A REPORT BEFORE SENDING THE REPORT TO THE REQUESTING RESIDENT.

(4) A LAW ENFORCEMENT AGENCY THAT USES SURVEILLANCE TECHNOLOGY SHALL PUBLISH AN ANNUAL REPORT ON ITS PUBLICLY ACCESSIBLE WEBSITE THAT INCLUDES THE FOLLOWING INFORMATION:

(a) THE TYPES OF SURVEILLANCE TECHNOLOGIES USED BY THE LAW ENFORCEMENT AGENCY;

(b) AGGREGATE AND ANONYMIZED INFORMATION RELATED TO THE COLLECTION, RETENTION, ACCESS, SHARING, AND DESTRUCTION OF SURVEILLANCE DATA; AND

(c) ANY COMPLAINTS RECEIVED BY THE LAW ENFORCEMENT AGENCY OR VIOLATIONS COMMITTED BY THE LAW ENFORCEMENT AGENCY IN RELATION TO THE USE OF SURVEILLANCE TECHNOLOGY OR THE COLLECTION, STORAGE, AND DESTRUCTION OF SURVEILLANCE DATA AND HOW THE COMPLAINTS OR VIOLATIONS WERE RESOLVED.

(5) (a) THE ATTORNEY GENERAL SHALL CONDUCT AN INDEPENDENT AUDIT OF A LAW ENFORCEMENT AGENCY THAT USES SURVEILLANCE TECHNOLOGY AT LEAST EVERY TWO YEARS AND PUBLISH THE RESULTS OF THE AUDIT ON THE ATTORNEY GENERAL'S PUBLICLY ACCESSIBLE WEBSITE.

(b) THE ATTORNEY GENERAL'S AUDIT OF A LAW ENFORCEMENT AGENCY CONDUCTED PURSUANT TO SUBSECTION (5)(a) OF THIS SECTION MUST INCLUDE:

(I) VERIFICATION THAT THE LAW ENFORCEMENT AGENCY IS USING SURVEILLANCE TECHNOLOGY IN A MANNER THAT COMPLIES WITH THIS PART 15;

(II) VERIFICATION THAT THE LAW ENFORCEMENT AGENCY IS STORING, RETAINING, SHARING, AND DESTROYING SURVEILLANCE DATA IN COMPLIANCE WITH THIS PART 15; AND (III) A REVIEW OF OTHER RELEVANT INFORMATION OR DOCUMENTATION THAT THE ATTORNEY GENERAL DETERMINES IS NECESSARY TO VERIFY THE LAW ENFORCEMENT AGENCY'S COMPLIANCE WITH THIS PART 15.

24-31-1505. Enforcement and penalties - admissibility.

(1) THE ATTORNEY GENERAL OR AN INDIVIDUAL AFFECTED BY A VIOLATION OF THIS PART 15 MAY BRING A CIVIL ACTION AGAINST A LAW ENFORCEMENT AGENCY.

(2) IF A LAW ENFORCEMENT AGENCY IS FOUND TO HAVE VIOLATED THIS PART 15, THE COURT MAY ORDER:

(a) INJUNCTIVE RELIEF;

(b) CIVIL PENALTIES OF UP TO FIVE THOUSAND DOLLARS PER VIOLATION;

(c) REASONABLE ATTORNEY FEES AND COSTS; AND

(d) DISCIPLINARY ACTION AGAINST LAW ENFORCEMENT AGENCY PERSONNEL, INCLUDING TERMINATION.

(3) IF THE COURT ORDERS CIVIL PENALTIES TO BE PAID BY A LAW ENFORCEMENT AGENCY IN ACCORDANCE WITH SUBSECTION (2)(b) OF THIS SECTION IN AN ACTION BROUGHT BY THE ATTORNEY GENERAL, THE CIVIL PENALTIES SHALL BE CREDITED TO THE GENERAL FUND.

(4) SURVEILLANCE DATA ACCESSED IN VIOLATION OF THIS PART 15 IS NOT ADMISSIBLE AS EVIDENCE IN ANY CRIMINAL OR CIVIL PROCEEDING OR ANY OTHER JUDICIAL, QUASI-JUDICIAL, OR ADMINISTRATIVE HEARING OR PROCEEDING; EXCEPT THAT THE SURVEILLANCE DATA IS ADMISSIBLE AGAINST A LAW ENFORCEMENT AGENCY IN A CIVIL ACTION BROUGHT AGAINST THE LAW ENFORCEMENT AGENCY PURSUANT TO SUBSECTION (1) OF THIS SECTION.

SECTION 4.

Act subject to petition - effective date - applicability. (1) This act takes effect July 1, 2027; except that, if a referendum petition is filed pursuant to section 1 (3) of article V of the state constitution against this act or an item, section, or part of this act within the ninety-day period after final adjournment of the general assembly, then the act, item, section, or part will not take effect unless approved by the people at the general election to be held in November 2026 and, in such case, will take effect July 1, 2027.

(2) This act applies to conduct occurring on or after the applicable effective date of this act.