DRIP-27 Bill 113 (2026) BILL 113 (2026), ESTABLISHING CHAPTER 8.38, MAUI COUNTY CODE, ON THE DISCLOSURE, SALE, AND COMMERCIAL USE OF LICENSE PLATE READER DATA (DRIP-27)
A small, locally controlled system may be useful. A large networked system that stores everyone’s movements without proving results could be a waste of money and an unnecessary invasion of privacy.
Aloha DRIP Chair and Councilmembers,
I am writing on behalf of Maui Indivisible to request 112 & 113 be amended.
We know that regulating 2 spy tools will not bring sanity to Maui County’s mass spy project. That’s why scores of States, Counties, cities and towns across the US have shut these projects down in the last year, not just regulated a few tools. It’s not just liberal and Progressive places, it’s conservative and even MAGA places. Maui is very late to the party on this and on the wrong side of history. Even FL Governor DeSantis calls these projects “out of control.”
Our position is if the Council wants these mass spy tools and projects, it needs to take that responsibility seriously and provide us transparency and protections so we can hold the County accountable when our rights are violated.
These 2 bills targeting 2 spy tools should pilot conditions imposed on all County spy projects and tools. In other words, while the Council has yet to put a Moratorium on the County mass spy project on the agenda, the Council should impose conditions immediately on the spy tools in 112 and 113 as a pilot: Because these bills weakly regulate only 2 spy tools and given the scope of the County's spy project, these conditions on the County’s mass spy tools should be...
1. Annual Council Evaluation of all mass spy projects and tools
2 Annual sunsets to Council approval and funding of all mass spy projects and tools so that renewing them is intentional
3. Expand the scope of these bills to cover more general types of mass spy tools and from Police (MPD) to every County dept
4. Transparency
5. Enforceable Rights and Consequences for violations
6. Reciprocity: We see Councilmembers want to track and record us with expensive cutting edge computer tools and cameras everywhere. If we, the public, must lose privacy and other freedoms for Council’s poor judgment about our safety, then the advocates and decision-makers of this project should bear the worst aspects of the spying. Most of us do not have AI software, so you should commit in the law to cameras placed at the entrance of your home driveway, office door accessed from a common area, and the grocery store you most regularly frequent and these cameras should feed to public websites where we can look at your comings and goings 24/7.
What do we mean by Transparency? Built into these bills that legitimize mass spy tools, there need to be regular...
1. Monthly agency public reporting and disclosure of statistical use and effectiveness measured by purpose of spy tool, abuse, and breach of data security.
2. Annual independent audits on mass spy tools reported to the Council including measures of use, cost, effectiveness, transparency to the public, abuse, breach of data security, and violation of civil and personal rights.
3. Publicizing of County contracts as soon as they are proposed as well as final forms including public posting of where to read all contracts, agreements, and legally enforceable documents regarding all parties. Since the MPD/County regularly violates UIPA and lengthy litigation is the only consequence so far, the burden to publicize should be on the County.
4. Verification tours open to the public of all surveillance centers
5. Data traffic revealed: Available to regular public electronic inspection should be data batch logs sorted by data category, date, dept/division/unit that record the location of all the places where County collected data travels. All County collected data must be tagged so it can be tracked. Every recipient of County collected data must agree not to not interfere with these data tracking tags and to help with any tracking obstacles.
What do we mean by Enforceable Rights and Consequences? Also built into these bills, there need to be...
1. Model Non-disclosure of data agreements (NDDA) to accompany every contract associated and enforceable on every contract party involved with these mass spy tool projects that are available online to the public
2. Meaningful consequences for violations of these bills, data breaches, other civil liberty violations such as triggering the exclusionary clause in criminal proceedings, publicizing violations and breach details and the names of people responsible for breach, civil compensation to victims, and removal of violators from data access.
These 2 bills are trying to do an impossible thing: Make it look like we have protections against Police and County spy abuse but still not undermine the spy project that Council funded. Bills 112 (FRT) and 113(ALPR)
• are constructed to undermine their stated purposes and are riddled with loopholes.
• allow the County to abuse these tools but not the vendors with which it contracts.
• do not equally regulate the 2 targeted spy tools leading to the question of why allow more abuse of one spy tool over the other.
• partly protect some of our rights but not other rights in which there has been significant historical abuse, so why discriminate against populations who experience these spy tools differently.
These two bills are very technical and that masks their shortcomings. Reading these two bills made my eyes glaze over many times. But we are taking seriously this process Council set up when Council rushed these bills after funding and building this mass spy project. We respectfully dissect these bills on the technical merits:
1. In 112, if the proposed predicate for FRT is “documented criminal investigation,” the minimum standard for FRT use should be constitutional “probable cause” and not the standard of an in-the-field Terry Stop “reasonable suspicion” which was developed for sudden, brief, temporary investigative stops which last no longer than necessary to confirm or dispel the officer's suspicion. FRT’s history of inaccuracy and police abuse is the reason why 112 avoids raising this weakened Terry standard in the purpose section. Worse, 112’s loophole allowing retroactive documenting contradicts the bill’s stated purpose that FRT “be used only in connection with a documented criminal investigation” and further undermines the probable cause standard. (see 8.37.030(E) allowing retroactive documenting an investigation)
2. 112 fails to include all biometric and person-specific tech surveillance. Limiting 112 to FRT will soon put the regulation in an irrelevant time warp.
3. 112 does not address sale and commercial use of FRT data like 113 does with ALPR data
4. 112's Defintion of where FRT can be deployed leaves almost no place for privacy except surrounded by 4 solid walls on a tropical island: "the interior of a private dwelling or lodging unit." 8.37.030(I)
5. 112 and 113 fail to address transmitting, exchanging, and integrating this data with other governments, inside and outside the US, which may use it for commercial purposes or transmit it to a private entity for commercial purposes or for purposes that are not commercial, for example, political, etc. Nor do they prohibit a private entity sharing data non commercially with another government which is what Flock has done with ICE. “8.38.020 Sale and commercial use. A. An agency must not sell, lease, trade, license, or otherwise transfer ALPR data to a private entity. B. A vendor must not sell, lease, trade, license, or otherwise transfer ALPR data to a private entity.”
6. 112 and 113 do not prohibit use of these tools to support police abuse of 4th and 14th Amendment activity
7. 113 does not establish any probable cause standards of County use for ALPR data like 112 does for FRT data. Why does the County treat these 2 forms of personal location and behavioral tracking data differently?
8. 113 only prohibits one type, immigration enforcement, of police abuse of ALPR and not other current forms of police abuse, such as those partly covered in 112, sometimes documented of MPD, widely documented of local police nation-wide, and widely documented of the Trump regime such as attacking 1st and 4th and 14th Amendment rights. (See "’Legitimate law enforcement purpose’ does not include immigration enforcement.” and 8.38.040 Immigration enforcement). Given Trump has commandeered most of his police state forces to prioritize immigration enforcement, it is not good enough to forbid local immigration enforcement when we have no oversight mechanisms to protect that blurred line for all Federal agencies and County current collaboration with them. Why does the County treat these 2 forms of surveillance differently?
9. It’s great 113 has set up standards for vendors use of ALPR data (“8.38.050 Contracts; special conditions.”). These standards should also apply to all County depts to prevent County abuse of the general public and all notice and approval provisions should also be directed to elected government leaders and subject to Sunshine laws.
10. 113 should ban providing ALPR data to any federal immigration authority and not have anything to do with the provider's intentional "purpose." In fact, the ban should extend to any entity one might reasonably expect will transfer the data to any Federal agency after due diligence research.
I support the purpose of Bill 113, but I ask the Committee not to recommend passage until the bill is corrected.
License plate reader records show where and when a vehicle was seen. When those records are stored and searched over time, they can reveal sensitive patterns about where a vehicle’s owner or user may live, work, travel, or worship. This information should not be sold, misused, or kept longer than necessary.
The most serious problem is in Section 8.38.060. It currently says the County “must execute or renew” a contract with a vendor whose practices include selling law-enforcement data or reserving the right to use government data for other purposes.
The word “not” appears to be missing. As written, this section says the opposite of what the bill is intended to accomplish. It must be corrected before passage.
The bill also needs several basic protections.
First, the bill contains no general time limit for keeping routine license plate information. Data that is not connected to an incident or investigation should be deleted within 90 days unless it becomes evidence in a documented investigation or must be preserved under a court order or legal hold.
Second, searches intended to reconstruct a vehicle’s movements over a long period should require a warrant or other judicial authorization. There should be narrow exceptions for emergencies, missing or endangered persons, consent, and other situations required by law.
Third, the bill should clearly state that using a data-sharing platform or participating in mutual aid does not remove the bill’s requirements. The bill currently allows platform requests to avoid the additional approval process required for other outside requests.
Fourth, the County should conduct yearly audits and publish an annual report. The report should identify, in general terms, how many searches and disclosures occurred, which agencies received information, and whether any misuse or security breaches were found. Information about active investigations can remain protected.
Fifth, an ALPR alert should be treated as an investigative lead, not proof that a crime occurred. Officers should verify the license plate, vehicle, and source record before taking enforcement action based only on an alert, unless an immediate danger makes that impossible.
Separately, Council should use its oversight authority to obtain MPD’s current data-sharing agreements with federal agencies and release them to the public, subject to lawful redactions. Council should determine whether County ALPR information has been shared with ICE, HSI, the FBI, or another federal agency and, if so, for what purpose, under what authority, and whether that sharing complies with Act 141.
The public emails raise legitimate questions, but they do not prove that improper sharing occurred. That is why Council should obtain the agreements, audit logs, and facts.
Please amend Bill 113 before moving it forward. If these problems cannot be corrected now, defer the bill and return with a clean draft.
Privacy protections must be clear, enforceable, and correctly written.
I'm a Maui county, resident of over 20 years and active voter. I ask you make the provisions in bill 112 and 113 more comprehensive. These bills don't do enough to protect our privacy.
There's facial recognition cameras in parking lots, on roads, hiking paths, and even playgrounds. If we are doing nothing wrong we shouldn't be subject to such intrusive surveillance.
The cloud storage systems are extremely vulnerable to hacking and systematically misused by law enforcement. Every day a new news report comes out about law enforcement abusing these surveillance systems and someone hacking the databases to stalk and harass people. This is already happening all over the US.
These are on playgrounds. We need to keep our children safe from predators who easily exploit these systems. As it is now, they make our children more vulnerable.
Maui needs freedom from facial recognition and license plate readers. Bill 112 and Bill 113 should include:
-provisions limiting where cameras can be placed and how many.
-require a WARRANT to access data
-mandatory frequent audits of data and who accessed it
-public notification of camera locations
-limit on the duration data is stored
-ban on AI integration
-improved transparency to the public
These bills are grossly insufficient at protecting our privacy. They are like putting a bandaid on a 6" gash. Facial recognition and oppressive surveillance are already out of control. I urge you to improve these bills to adequately address the needs of the Maui community and keep us safe.
A small, locally controlled system may be useful. A large networked system that stores everyone’s movements without proving results could be a waste of money and an unnecessary invasion of privacy.
Aloha DRIP Chair and Councilmembers,
I am writing on behalf of Maui Indivisible to request 112 & 113 be amended.
We know that regulating 2 spy tools will not bring sanity to Maui County’s mass spy project. That’s why scores of States, Counties, cities and towns across the US have shut these projects down in the last year, not just regulated a few tools. It’s not just liberal and Progressive places, it’s conservative and even MAGA places. Maui is very late to the party on this and on the wrong side of history. Even FL Governor DeSantis calls these projects “out of control.”
Our position is if the Council wants these mass spy tools and projects, it needs to take that responsibility seriously and provide us transparency and protections so we can hold the County accountable when our rights are violated.
These 2 bills targeting 2 spy tools should pilot conditions imposed on all County spy projects and tools. In other words, while the Council has yet to put a Moratorium on the County mass spy project on the agenda, the Council should impose conditions immediately on the spy tools in 112 and 113 as a pilot: Because these bills weakly regulate only 2 spy tools and given the scope of the County's spy project, these conditions on the County’s mass spy tools should be...
1. Annual Council Evaluation of all mass spy projects and tools
2 Annual sunsets to Council approval and funding of all mass spy projects and tools so that renewing them is intentional
3. Expand the scope of these bills to cover more general types of mass spy tools and from Police (MPD) to every County dept
4. Transparency
5. Enforceable Rights and Consequences for violations
6. Reciprocity: We see Councilmembers want to track and record us with expensive cutting edge computer tools and cameras everywhere. If we, the public, must lose privacy and other freedoms for Council’s poor judgment about our safety, then the advocates and decision-makers of this project should bear the worst aspects of the spying. Most of us do not have AI software, so you should commit in the law to cameras placed at the entrance of your home driveway, office door accessed from a common area, and the grocery store you most regularly frequent and these cameras should feed to public websites where we can look at your comings and goings 24/7.
What do we mean by Transparency? Built into these bills that legitimize mass spy tools, there need to be regular...
1. Monthly agency public reporting and disclosure of statistical use and effectiveness measured by purpose of spy tool, abuse, and breach of data security.
2. Annual independent audits on mass spy tools reported to the Council including measures of use, cost, effectiveness, transparency to the public, abuse, breach of data security, and violation of civil and personal rights.
3. Publicizing of County contracts as soon as they are proposed as well as final forms including public posting of where to read all contracts, agreements, and legally enforceable documents regarding all parties. Since the MPD/County regularly violates UIPA and lengthy litigation is the only consequence so far, the burden to publicize should be on the County.
4. Verification tours open to the public of all surveillance centers
5. Data traffic revealed: Available to regular public electronic inspection should be data batch logs sorted by data category, date, dept/division/unit that record the location of all the places where County collected data travels. All County collected data must be tagged so it can be tracked. Every recipient of County collected data must agree not to not interfere with these data tracking tags and to help with any tracking obstacles.
What do we mean by Enforceable Rights and Consequences? Also built into these bills, there need to be...
1. Model Non-disclosure of data agreements (NDDA) to accompany every contract associated and enforceable on every contract party involved with these mass spy tool projects that are available online to the public
2. Meaningful consequences for violations of these bills, data breaches, other civil liberty violations such as triggering the exclusionary clause in criminal proceedings, publicizing violations and breach details and the names of people responsible for breach, civil compensation to victims, and removal of violators from data access.
These 2 bills are trying to do an impossible thing: Make it look like we have protections against Police and County spy abuse but still not undermine the spy project that Council funded. Bills 112 (FRT) and 113(ALPR)
• are constructed to undermine their stated purposes and are riddled with loopholes.
• allow the County to abuse these tools but not the vendors with which it contracts.
• do not equally regulate the 2 targeted spy tools leading to the question of why allow more abuse of one spy tool over the other.
• partly protect some of our rights but not other rights in which there has been significant historical abuse, so why discriminate against populations who experience these spy tools differently.
These two bills are very technical and that masks their shortcomings. Reading these two bills made my eyes glaze over many times. But we are taking seriously this process Council set up when Council rushed these bills after funding and building this mass spy project. We respectfully dissect these bills on the technical merits:
1. In 112, if the proposed predicate for FRT is “documented criminal investigation,” the minimum standard for FRT use should be constitutional “probable cause” and not the standard of an in-the-field Terry Stop “reasonable suspicion” which was developed for sudden, brief, temporary investigative stops which last no longer than necessary to confirm or dispel the officer's suspicion. FRT’s history of inaccuracy and police abuse is the reason why 112 avoids raising this weakened Terry standard in the purpose section. Worse, 112’s loophole allowing retroactive documenting contradicts the bill’s stated purpose that FRT “be used only in connection with a documented criminal investigation” and further undermines the probable cause standard. (see 8.37.030(E) allowing retroactive documenting an investigation)
2. 112 fails to include all biometric and person-specific tech surveillance. Limiting 112 to FRT will soon put the regulation in an irrelevant time warp.
3. 112 does not address sale and commercial use of FRT data like 113 does with ALPR data
4. 112's Defintion of where FRT can be deployed leaves almost no place for privacy except surrounded by 4 solid walls on a tropical island: "the interior of a private dwelling or lodging unit." 8.37.030(I)
5. 112 and 113 fail to address transmitting, exchanging, and integrating this data with other governments, inside and outside the US, which may use it for commercial purposes or transmit it to a private entity for commercial purposes or for purposes that are not commercial, for example, political, etc. Nor do they prohibit a private entity sharing data non commercially with another government which is what Flock has done with ICE. “8.38.020 Sale and commercial use. A. An agency must not sell, lease, trade, license, or otherwise transfer ALPR data to a private entity. B. A vendor must not sell, lease, trade, license, or otherwise transfer ALPR data to a private entity.”
6. 112 and 113 do not prohibit use of these tools to support police abuse of 4th and 14th Amendment activity
7. 113 does not establish any probable cause standards of County use for ALPR data like 112 does for FRT data. Why does the County treat these 2 forms of personal location and behavioral tracking data differently?
8. 113 only prohibits one type, immigration enforcement, of police abuse of ALPR and not other current forms of police abuse, such as those partly covered in 112, sometimes documented of MPD, widely documented of local police nation-wide, and widely documented of the Trump regime such as attacking 1st and 4th and 14th Amendment rights. (See "’Legitimate law enforcement purpose’ does not include immigration enforcement.” and 8.38.040 Immigration enforcement). Given Trump has commandeered most of his police state forces to prioritize immigration enforcement, it is not good enough to forbid local immigration enforcement when we have no oversight mechanisms to protect that blurred line for all Federal agencies and County current collaboration with them. Why does the County treat these 2 forms of surveillance differently?
9. It’s great 113 has set up standards for vendors use of ALPR data (“8.38.050 Contracts; special conditions.”). These standards should also apply to all County depts to prevent County abuse of the general public and all notice and approval provisions should also be directed to elected government leaders and subject to Sunshine laws.
10. 113 should ban providing ALPR data to any federal immigration authority and not have anything to do with the provider's intentional "purpose." In fact, the ban should extend to any entity one might reasonably expect will transfer the data to any Federal agency after due diligence research.
Aloha Chair and Members of the DRIP,
My name is Edward Codelia, a resident of Kula.
I support the purpose of Bill 113, but I ask the Committee not to recommend passage until the bill is corrected.
License plate reader records show where and when a vehicle was seen. When those records are stored and searched over time, they can reveal sensitive patterns about where a vehicle’s owner or user may live, work, travel, or worship. This information should not be sold, misused, or kept longer than necessary.
The most serious problem is in Section 8.38.060. It currently says the County “must execute or renew” a contract with a vendor whose practices include selling law-enforcement data or reserving the right to use government data for other purposes.
The word “not” appears to be missing. As written, this section says the opposite of what the bill is intended to accomplish. It must be corrected before passage.
The bill also needs several basic protections.
First, the bill contains no general time limit for keeping routine license plate information. Data that is not connected to an incident or investigation should be deleted within 90 days unless it becomes evidence in a documented investigation or must be preserved under a court order or legal hold.
Second, searches intended to reconstruct a vehicle’s movements over a long period should require a warrant or other judicial authorization. There should be narrow exceptions for emergencies, missing or endangered persons, consent, and other situations required by law.
Third, the bill should clearly state that using a data-sharing platform or participating in mutual aid does not remove the bill’s requirements. The bill currently allows platform requests to avoid the additional approval process required for other outside requests.
Fourth, the County should conduct yearly audits and publish an annual report. The report should identify, in general terms, how many searches and disclosures occurred, which agencies received information, and whether any misuse or security breaches were found. Information about active investigations can remain protected.
Fifth, an ALPR alert should be treated as an investigative lead, not proof that a crime occurred. Officers should verify the license plate, vehicle, and source record before taking enforcement action based only on an alert, unless an immediate danger makes that impossible.
Separately, Council should use its oversight authority to obtain MPD’s current data-sharing agreements with federal agencies and release them to the public, subject to lawful redactions. Council should determine whether County ALPR information has been shared with ICE, HSI, the FBI, or another federal agency and, if so, for what purpose, under what authority, and whether that sharing complies with Act 141.
The public emails raise legitimate questions, but they do not prove that improper sharing occurred. That is why Council should obtain the agreements, audit logs, and facts.
Please amend Bill 113 before moving it forward. If these problems cannot be corrected now, defer the bill and return with a clean draft.
Privacy protections must be clear, enforceable, and correctly written.
Mahalo,
Edward Codelia
Kula
I'm a Maui county, resident of over 20 years and active voter. I ask you make the provisions in bill 112 and 113 more comprehensive. These bills don't do enough to protect our privacy.
There's facial recognition cameras in parking lots, on roads, hiking paths, and even playgrounds. If we are doing nothing wrong we shouldn't be subject to such intrusive surveillance.
The cloud storage systems are extremely vulnerable to hacking and systematically misused by law enforcement. Every day a new news report comes out about law enforcement abusing these surveillance systems and someone hacking the databases to stalk and harass people. This is already happening all over the US.
These are on playgrounds. We need to keep our children safe from predators who easily exploit these systems. As it is now, they make our children more vulnerable.
Maui needs freedom from facial recognition and license plate readers. Bill 112 and Bill 113 should include:
-provisions limiting where cameras can be placed and how many.
-require a WARRANT to access data
-mandatory frequent audits of data and who accessed it
-public notification of camera locations
-limit on the duration data is stored
-ban on AI integration
-improved transparency to the public
These bills are grossly insufficient at protecting our privacy. They are like putting a bandaid on a 6" gash. Facial recognition and oppressive surveillance are already out of control. I urge you to improve these bills to adequately address the needs of the Maui community and keep us safe.