On October 1, 2026, the Electronic Frontier Foundation and the ACLU of Northern California sent a demand letter + California Public Records Act request to Marin County Sheriff Jamie Scardina.[1][5]

The letter cites network audit logs obtained by Point Reyes Light on September 30 that show his office shared Flock Safety ALPR data with out-of-state and federal agencies — 254,131 times in November 2024 alone.[1][4] The recipient agencies named explicitly: Alabama, Indiana, Kentucky, Florida, and Texas — states that “impose severe restrictions on reproductive care and have a history of assisting ICE.”[1]

This directly violates California SB 34 — enacted in 2015, it prohibits sharing ALPR data with entities outside California — and the terms of the 2022 Settlement Agreement in Lagleva v. Marin County Sheriff, where EFF + ACLU had previously sued MCSO for sharing millions of California plate reads with ICE and Border Patrol.[1][2] The sheriff had agreed to stop.[1][2]

( the Lagleva settlement dates to 2022; the audit log documents breach in November 2024 — two and a half years after the agreement )

EFF + ACLU are requesting a full audit of the ALPR database, new compliance protocols, and penalties for any employee who shares ALPR outside the state.[1][5] In the letter, EFF argues the sharing “exposed sensitive driver location information to misuse by the federal government and by states that lack California’s robust privacy protections.”[1]

The State of Surveillance daily briefing Oct 13 — the canonical editorial anchor for this demand letter — summarized the case as: “254,131 ALPR shares that violated SB 34 in a single month,” naming the 2022 consent decree as the legal hook that the sheriff had signed and then breached.[5]

That briefing also reaffirmed that California’s SB 34 prohibits sharing ALPR data with out-of-state or federal agencies “for any reason,” and that the Lagleva settlement resolved a 2021 EFF-ACLU lawsuit on behalf of community activists who alleged their plate data had been shared with hundreds of federal and out-of-state agencies, including ICE and Border Patrol.[5][2]

The editorial question for a Mexican, Brazilian, or Argentine procurement office signing an enterprise CCTV/ALPR contract in Q4 2026: if a California sheriff already had a prior lawsuit + settlement, and his own internal audit logs documented the breach, and LATAM privacy law (LFPDPPP Mexico Art. 5/60, LGPD Brazil Art. 5/46, Ley 21.719 Chile) all classify vehicle-location data + biometric data as sensitive data with stricter legal bases than ordinary consent — what three clauses does your RFP for Flock / Motorola Vigilant / Axon / Genetec require:

Clause 1 — federal-state-agency-disclosure clause. Vendor publishes a written, every-90-days list of every federal/state/out-of-jurisdiction agency that has accessed customer data, with an aggregated count (the equivalent of what MCSO should have published in its November 2024 audit report).[1]

Clause 2 — internal-audit-report-disclosure clause. Vendor warrants delivery to the customer of any internal audit documenting contractual non-compliance, with 14-day notice from the moment the audit is generated — no waiting for a third party to FOIA/PRA it into the public record first.[1]

Clause 3 — settlement-agreement-compliance clause. If the vendor has prior settlement agreements with customers, regulators, or advocacy groups that affect its data architecture, customer requires a written warranty of continuous compliance + an independent audit right.[2]

The architectural difference between an RFP signed with a vendor that has publicly verifiable audit logs and one signed with a vendor that does not is no longer a theoretical question.[5]

P.D. How many of your current contract clauses cover the scenario “the vendor discovers an internal audit documenting contractual breach and doesn’t deliver it to you for 60-90 days”? If the answer is “none,” today’s a good day to revisit the stack.

📰 Sources: EFF Deeplinks Oct 1, 2026 + EFF Lagleva case page + EFF verbatim demand letter + Point Reyes Light Sep 30, 2026 + State of Surveillance Daily Surveillance Briefing Oct 13, 2026.

Sources

[1] EFF — We Demand More Information on How Marin Cops Illegally Shared Flock ALPR Data (Pinsof, Oct 1 2026) — https://www.eff.org/deeplinks/2026/10/we-demand-more-information-how-marin-cops-illegally-shared-flock-alpr-data [2] EFF case page — Lagleva v. Marin County Sheriff — https://www.eff.org/cases/lagleva-v-marin [4] Point Reyes Light — Marin’s Flock data breached (Rios Mace, Sep 30 2026) — https://www.ptreyeslight.com/news/marins-flock-data-breached/ [5] State of Surveillance Daily Surveillance Briefing — Oct 13 2026 — https://stateofsurveillance.org/news/daily-surveillance-briefing-october-13-2026/