The Data Privacy Challenge in Electronic Monitoring

A single GPS ankle monitor generates 100-300 location data points per day. For a 500-offender program operating for 3 years, that is 54-164 million location records — a dataset that reveals where each monitored individual sleeps, works, worships, receives medical care, and socializes. This data has legitimate supervision purposes, but it also creates significant privacy obligations and security risks.

Government agencies operating electronic monitoring programs are custodians of this data. They face overlapping compliance requirements from federal law (CJIS Security Policy), state privacy statutes, court rules, and increasingly, constitutional limits established by US Supreme Court decisions on location surveillance.

Federal Requirements: CJIS Security Policy

The FBI’s Criminal Justice Information Services (CJIS) Security Policy governs all criminal justice information shared through CJIS systems. GPS monitoring data that is linked to criminal records, stored alongside case information, or accessible through systems connected to CJIS infrastructure must comply with the policy.

Key CJIS Requirements for EM Data

• Encryption: Data in transit must use FIPS 140-2 certified encryption (minimum AES 128-bit). Data at rest must be encrypted on servers and portable devices.
• Access control: Role-based access ensuring only authorized personnel can view location data. Multi-factor authentication for remote access.
• Audit trails: Complete logging of who accessed monitoring data, when, and what data was viewed or exported.
• Background checks: All personnel with access to monitoring data — including vendor employees — must pass fingerprint-based background checks.
• Incident response: Documented breach notification procedures within 24 hours of discovery.

Vendor Compliance

When GPS monitoring is provided by a third-party vendor (as is typical), the vendor becomes a “non-criminal justice agency” with access to criminal justice information. The vendor must sign a CJIS Security Addendum and comply with all applicable security requirements. The agency remains ultimately responsible for ensuring vendor compliance.

State Privacy Laws

State-level privacy requirements vary significantly:

• California (CCPA/CPRA): While law enforcement data is largely exempt, agencies should be aware of data minimization principles and the trend toward expanding privacy rights to criminal justice data.
• Illinois (BIPA): If monitoring systems collect biometric data (voice, facial recognition for check-ins), the Biometric Information Privacy Act may apply.
• State court rules: Many states have specific rules governing the admissibility and handling of electronic monitoring data in court proceedings. Location data used as evidence may require specific chain-of-custody documentation.

Constitutional Framework

Carpenter v. United States (2018)

The Supreme Court held that accessing historical cell-site location information (CSLI) constitutes a Fourth Amendment search requiring a warrant. While this case addressed law enforcement investigations (not offender supervision), it established that long-term location tracking creates a comprehensive record of a person’s movements that enjoys constitutional protection.

For EM programs, the Carpenter principle suggests:

• GPS monitoring data should be treated as constitutionally sensitive information
• Access should be limited to supervision purposes and not shared freely with other law enforcement agencies for unrelated investigations
• Retention periods should be reasonable and defined by policy

Grady v. North Carolina (2015)

GPS monitoring itself is a Fourth Amendment “search.” Courts have upheld it as reasonable for supervised offenders, but the scope of data collection and use must be proportional to the supervision purpose.

Data Governance Best Practices

Data Retention Policy

Establish clear retention periods:

Data Minimization

• Collect only the location data frequency necessary for the supervision level (not maximum frequency for all offenders)
• Limit historical data queries to defined time periods relevant to specific investigations
• Anonymize or aggregate data used for program evaluation and reporting

Vendor Security Requirements

Include these requirements in GPS monitoring vendor contracts:

• SOC 2 Type II certification or equivalent
• Data stored within the United States (or within the agency’s jurisdiction for international programs)
• CJIS Security Addendum compliance
• Right to audit vendor security practices
• Data deletion upon contract termination
• Breach notification within 24 hours
• Prohibition on secondary use of monitoring data (vendor cannot use location data for analytics, advertising, or any purpose beyond service delivery)

Practical Steps for Agencies

1. Appoint a data governance lead responsible for EM data compliance
2. Audit current vendor agreements for CJIS compliance language and data handling terms
3. Establish a written data retention policy with automatic purge schedules
4. Limit monitoring platform access to personnel with documented need and current background checks
5. Train staff annually on data handling procedures and breach reporting
6. Include privacy terms in offender agreements documenting what data is collected and how it will be used

Frequently Asked Questions

Does GPS monitoring data fall under CJIS Security Policy?

Yes, when GPS monitoring data is linked to criminal records or stored in systems connected to CJIS infrastructure. The CJIS Security Policy requires FIPS 140-2 encryption, role-based access control, multi-factor authentication for remote access, complete audit trails, and fingerprint-based background checks for all personnel with data access — including vendor employees.

How long should agencies retain GPS monitoring data?

Best practice: retain real-time location data for the monitoring duration plus 3-5 years, alert and violation records for monitoring duration plus 7 years, and system access logs for a minimum of 7 years. Establish automatic purge schedules to avoid indefinite retention of sensitive location data.

Can GPS monitoring data be shared with other law enforcement agencies?

Data sharing should be governed by written policy. Location data collected for supervision purposes should generally not be shared with other agencies for unrelated investigations without a court order. The Carpenter v. United States (2018) Supreme Court decision established that long-term location data enjoys Fourth Amendment protection, suggesting agencies should limit sharing to supervision-related purposes.

What security certifications should GPS monitoring vendors have?

At minimum, vendors should comply with the CJIS Security Addendum and provide evidence of FIPS 140-2 encryption, SOC 2 Type II certification (or equivalent), US-based data storage, and documented incident response procedures with 24-hour breach notification. Agencies should retain the right to audit vendor security practices.

Are there privacy rights for people being electronically monitored?

Monitored individuals retain limited privacy rights. Courts have held that GPS monitoring is a reasonable condition of supervised release, but the scope must be proportional to the supervision purpose. Some jurisdictions require that offenders be informed of what data is collected. Data should not be used for purposes beyond the supervision conditions ordered by the court.