Washington § 10.130.080 - Audits.

(1) Each agency operating or accessing an automated license plate reader system shall maintain audit trail data documenting all access to the system. Audit trail data must be retained for two years and must include, at a minimum:

(a) A record of each action in which automated license plate reader data is accessed or searched, including:

(i) The identity or username of the person who accessed or queried the system, and as applicable, the organization or entity with whom the person is affiliated;

(ii) The date and time the automated license plate reader data or the automated license plate reader system was accessed or searched;

(iii) Data elements used to query the automated license plate reader system;

(iv) Specific purpose for accessing or querying the automated license plate reader system, including the offense type for any criminal investigation;

(v) The associated call for service or case number; and

(vi) The location of the cameras that are part of the automated license plate reader system accessed.

(b) All records of actions in which automated license plate reader data is exported, downloaded, or shared; and

(c) Any audit trail data generated by or made available through a third-party vendor providing automated license plate reader system services. Each agency shall ensure that all such vendor audit trail data is downloaded or otherwise obtained and retained by the agency in accordance with this section.

(2) Data elements used to query the automated license plate reader system and retained as audit trail data pursuant to subsection (1)(a) of this section may be used solely for auditing purposes and may not be searched, analyzed, compiled, or indexed for investigative purposes. Data elements that contain unique identifiers must be partially redacted in any public disclosure.

(3) Each agency shall conduct an internal audit at least once each year to review:

(a) All access to and use of the automated license plate reader system, as reflected in the audit trail data; and

(b) The agency's compliance with the data retention, purging, and sharing requirements established under this chapter and agency policy.

Effective date—2026 c 239: See note following RCW 10.130.030.