Codex Americana: DRAFT BILL — The Public Roadway Data Sovereignty and Oversight Act

SECTION 1. SHORT TITLE.
This Act shall be known as the Public Roadway Data Sovereignty and Oversight Act.

SECTION 2. LEGISLATIVE FINDINGS.

The Legislature finds that:

Public roadways are maintained by the State for the use of all residents and are subject to the State’s authority over safety, data governance, and privacy.
Increasing use of automated surveillance technologies—such as license-plate recognition cameras and similar devices—located on private property but directed at public roadways has created unresolved questions regarding data ownership, security, and jurisdictional control.
The State has a compelling interest in ensuring that any data captured from public roadways is handled in accordance with state law, is subject to local and state oversight, and is not transmitted, exported, or otherwise controlled by private entities without accountability.
A refundable compliance bond is a reasonable and narrowly tailored method of ensuring compliance with state data-handling standards.

As used in this Act:

“Public Roadway” means any road, street, highway, or right-of-way constructed, owned, or maintained by the State or any political subdivision thereof.
“Data-capturing device” means any camera, sensor, automated license plate reader, or other technological system capable of collecting, recording, or transmitting images or identifying information from a public roadway.
“Private-site public-facing device” means any data-capturing device located on private property that is directed at or capable of collecting data from a public roadway.
“Operator” means any individual, homeowners association, business, corporation, or other entity that installs, controls, contracts for, or maintains a private-site public-facing device.

No operator may deploy or maintain a private-site public-facing device unless the device is registered with the State Department of Transportation (DOT) or other designated state authority.
Registration shall include:
a. The physical location of the device;
b. The entity responsible for installation and operation;
c. The categories of data collected;
d. The third-party vendors or platforms receiving such data, if any;
e. A certification that the device complies with all requirements of this Act.

For each private-site public-facing device, the operator shall post a refundable compliance bond in the amount of $1,000.
The bond shall be conditioned upon:
a. Compliance with state data-handling, retention, audit, and deletion standards;
b. Submission to local and state jurisdictional control of any data collected;
c. Timely response to lawful data-access requests by authorized state or local agencies;
d. Maintenance of secure data-transfer and storage methods as defined by regulation.
The bond may be forfeited, in whole or in part, for:
a. Failure to comply with this Act;
b. Unauthorized disclosure of roadway data;
c. Failure to register devices or update registrations;
d. Obstruction of state oversight.

Any data collected from a public roadway by a private-site public-facing device shall be deemed public roadway data subject to state authority.
Public roadway data must:
a. Be stored within the United States;
b. Be accessible to local and state agencies with lawful authority;
c. Not be transferred, licensed, sold, or otherwise made available to external entities except as permitted by state regulation.
Operators shall maintain logs of all data access and transmissions for a minimum of two years.

Public roadway data collected by private-site public-facing devices shall not be retained longer than 30 days, unless:
a. Subject to a preservation request by law enforcement, or
b. Requisite for an active investigation or proceeding.
Operators shall implement automatic deletion mechanisms certified by the DOT.

The DOT or designated authority may:
a. Audit operators for compliance;
b. Impose civil penalties up to $5,000 per violation;
c. Order removal or deactivation of non-compliant devices;
d. Revoke registration for repeated violations.
Penalties may be satisfied using the compliance bond.
Operators remain liable for any unsatisfied fines beyond the bond amount.

Nothing in this Act limits a municipality or county from enacting stricter requirements for surveillance devices directed at public roadways.

The DOT shall promulgate rules necessary to implement this Act no later than 180 days after enactment, including:

This Act shall take effect January 1 of the year following enactment.