St. Paul Police Department

What the audit said

No exceptions found across all seven itemized statute controls. LOGIS reviewed the ALPR policy, agency-provided ALPR system screen prints (including 60-day retention setting), the most recent public log of use, and interviewed staff, plus checked the Legislative Reference Library for past audits.

What the audit said

No findings. All seven control objectives (data collection/classification/use restrictions; destruction of data; sharing among law enforcement agencies; log of use; biennial audit; authorization to access; notification to the BCA) recorded "No exceptions found." LOGIS concluded SPPD is "in compliance with MN Statute 13.824." Public log of use was addressed under Control 4 and provided by SPPD. No ghost-finding language: the report contains no "did not," "was not," "should," or "we recommend" statements and no remediation described.

What the audit said

LOGIS tested 7 control objectives (data collection, data destruction, sharing among agencies, log of use, biennial audit, authorization to access data, BCA notification) and found 'no exceptions found' in every area.

What the audit said

25 controls tested (17 statutory + 8 department-requested additional procedures); 16 of the 17 statutory controls record 'No exception Noted.' Control 17 (access authorization) records a 'Process Improvement Noted': all 350 users' access was appropriate in substance, but 19 of 350 (5.4%) lacked documented written approval -- approvals had been kept only in email, and the email retention setting deleted records older than 180 days, with no external archive. Report recommends process improvements (no specific text given). Retention 60 days (Controls 6, 10); fixed cameras not in use.

What the audit said

No findings. The report enumerates 25 separate controls and records "No exception Noted" against every one, concluding the program "reasonably complies with the 2017 Minnesota Statute 13.824." Controls 7 and 8 record that no data-preservation or data-destruction requests had been received as of the review date; Controls 22-24 record that fixed cameras were not in use. Retention 60 days (Controls 6 and 10). No ghost-finding language: the only qualifying statement is the boilerplate caveat about "the risk that controls may become inadequate because of changes in conditions."