Level 3
Examples
Real documents, read against the Standard. None of them is perfect. Each one does at least one thing well enough to copy, and each one leaves something out that a reader should know to ask for. Documents are annotated, not scored. Scores are for cities.
Ordinance
Cambridge, Massachusetts · Ordinance No. 1402, adopted December 2018
The strongest Stage 1 and Stage 8 in this library. Nothing gets bought, funded, or shared with an outside entity without an impact report, a use policy, and a council vote. The council can turn it off, and in 2026 it did.
Does wellDocumented necessity; Public notice and a recorded vote; Published use policy before deployment; Purpose limitation in writing; and 4 more.
3 of 26 practices missing or failed
Statute
Minnesota · 2015, amended 2021 and 2024
The strictest license plate reader law in the country on paper: a 60-day clock, a public audit trail, an audit every two years, and a commissioner who can shut a program down. It never asks whether the cameras were needed.
Does wellPurpose limitation in writing; Logged justification for every query; Access control and separation of duties; Shortest retention that serves the stated purpose; and 2 more.
7 of 26 practices missing or failed
Policy
St. Louis Park, Minnesota · October 31, 2024 (Lexipol)
A five-page Lexipol template that restates the statute. It says 60 days where the city practices 30, and says nothing about immigration, network sharing, or the quarterly audits the council added in 2026.
Does wellPurpose limitation in writing; Signage and notice; Logged justification for every query.
15 of 26 practices missing or failed
Contracts
National (Portland, Oregon copy) · Form Q3.21.v1; Portland executed August 2024
The three-page form more than 2,400 agencies have signed. It grants LexisNexis an irrevocable worldwide license, lets any subscriber use the records for any mission, and keeps the data forever unless someone writes to ask.
19 of 20 practices missing or failed
Duluth, Minnesota · Signed May 2020; renewed January 12, 2026
LexisNexis has a version of the form with the license grant removed. Duluth signed that one. The question is whether it still governs the subscription the council renewed in 2026.
Does wellPublic notice and a recorded vote; No irrevocable license to the vendor; No sharing without a published policy.
11 of 18 practices missing or failed
Contract amendment
Oklahoma City, Oklahoma · Signed by LexisNexis March 13, 2026; adopted April 21, 2026
The only contract in this library that names federal agencies and shuts the door. It restricts where the data can go. It says nothing about how long it stays or whether it ever comes back.
Does wellPublic notice and a recorded vote; No sharing without a published policy; Consortium and platform terms are public.
17 of 24 practices missing or failed
Audits
Beltrami County, Minnesota · November 28, 2025
The one Minnesota audit that tested the live system. It found that Flock lets any user export plate data with no audit-trail entry, a flaw that applies to every agency on the platform.
Does wellPublished use policy before deployment; Signage and notice; Misuse is reported like a near miss; No sharing without a published policy; and 2 more.
3 of 18 practices missing or failed
Maple Grove, Minnesota · April 17, 2018
Two pages. Every section ends “was found to be compliant.” The auditor is the consortium that sells the department its software.
11 of 18 practices missing or failed
Annual report
Cambridge, Massachusetts · March 9, 2026 (covering 2025)
A hundred and one pages covering 37 technologies, from body cameras to a throwable robot. It names who received the data. It reports no audits, no violations, and no query counts for the plate readers it removed.
Does wellPublic notice and a recorded vote; Published use policy before deployment; No off-label use; Chain of custody; and 3 more.
8 of 26 practices missing or failed