San Mateo County Grand Jury

2026-2027

2 reports

Findings & Recommendations 2 findings
F1: Since January 1, 2024, 14 CCR §§ 18995.1 and 18995.4 require jurisdictions to enforce SB 1383 requirements. Under MOUs reviewed by the Grand Jury, SMCSD is responsible for enforcement for participating jurisdictions. Inspection records reviewed by the Grand Jury do not show a consistent documented process for conducting inspections and re- inspections, setting compliance deadlines, or issuing Notices of Violation, Penalty Orders, or other enforcement when required.
F2: During the investigation, SMCSD’s online edible food recovery complaint form was not functional when tested, and the Grand Jury could not locate publicly accessible written complaint procedures for the jurisdictions reviewed. Although a countywide form is not mandated, 14 CCR § 18995.3 requires each jurisdiction to provide a procedure for receipt and investigation of written complaints and to allow anonymous complaints.
Additional Recommendations 3

Not linked to specific findings.

R1: By December 31, 2026, SMCSD should adopt and implement written SB 1383 edible food recovery enforcement procedures for services performed under its MOUs, including criteria for inspections, re-inspections, Notices of Violation, Penalty Orders, or other enforcement when required.
R2: By June 30, 2027, SMCSD should develop and implement a standardized inspection form and publicly accessible database of inspection reports and enforcement information, subject to Public Records Act requirements and any applicable exemptions.
R3: By June 30, 2027, SMCSD should develop an anonymous complaint process that can be adopted by participating jurisdictions.
Findings & Recommendations 9 findings
F1: The ALPR operator’s ALPR policy was not posted in a manner that appears consistent with the California Attorney General’s guidance on “conspicuous” posting.
F2: The ALPR operator’s ALPR Policy appears to be outdated because it describes ALPR operations as mediated by NCRIC, a practice the investigation found was discontinued several years ago.
F3: The ALPR operator shared ALPR information with private university security entities but did not establish that the receiving entity was a “public agency” as defined in Civil Code section 1798.90.55(b), or that the sharing was otherwise permitted by law within the meaning of Civil Code section 1798.90.55(b).
F4: The ALPR operator did not produce records demonstrating that audits required by its ALPR policy had been conducted.
F5: The audit reports produced by the ALPR operator were insufficient to substantiate compliance with applicable California law and the operator’s published ALPR policy.
F6: The ALPR operator’s Flock Safety contract does not include provisions specifically requiring compliance with applicable California ALPR laws.
F7: The operator’s ALPR policy described a process requiring written requests and executed agreements for ALPR data-sharing relationships; however, the records produced did not substantiate that this process was followed or that the required agreements were obtained.
F8: The operator’s ALPR policy did not establish criteria governing the approval of in-state ALPR data-sharing requests or the termination of existing network-sharing relationships.
F9: The retention period specified in the operator’s ALPR Policy does not match the retention period as reported by the Flock transparency portal or Flock contract.
Additional Recommendations 9

Not linked to specific findings.

R1: The ALPR operator should conspicuously post the current version of their ALPR Policy as required by Civil Code sections 1798.90.51(a)–(b).
R2: The ALPR operator with outdated ALPR policies should revise those policies to accurately reflect current operational practices.
R3: The ALPR operator currently identified as sharing ALPR data with private university security entities should obtain and retain a written legal and factual determination that the recipient is a “public agency” under Civil Code section 1798.90.5(f), or that the sharing is otherwise permitted by law; if no lawful basis exists, the operator should terminate the sharing relationship.
R4: The ALPR operator should prepare audit reports in accordance with the frequency stated in the operator’s published ALPR policy.
R5: The audit reports produced by the ALPR operator should substantiate compliance with applicable California law and the operator’s published ALPR policy.
R6: Upon contract renewal, the ALPR operator should incorporate contractual language requiring vendor compliance with applicable California law and prohibiting vendors from disclosing ALPR data to unauthorized third parties. Operators should consider provisions similar to those contained in the Town of Colma contract with Flock.
R7: The ALPR operator should update its ALPR policy to accurately reflect the process used to approve ALPR data-sharing relationships.
R8: The ALPR operator should include in their ALPR policies written criteria governing the approval, denial, periodic review, and termination of in-state ALPR network-sharing relationships.
R9: The ALPR operator should update their ALPR policy or Flock contract terms, as necessary, so that the stated retention rule accurately reflects operations.