Policy Search
Health and Safety- Public Safety
| EWU Policy 603-04 | Authority: Board of Trustees |
| Effective: June 25, 2026 | Proponent: Vice President for Business & Strategy |
Summary: This policy outlines the requirements for the use of security cameras and drones on campus or in an EWU leased facility. It also applies to the use of license plate recognition technology by an EWU department.
History: This policy is new. It was approved by the Board of Trustees on June 25, 2026.
1. PURPOSE, COMMITMENT & RESTRICTIONS
This chapter applies to university security cameras, drones, and license plate recognition technology (collectively “surveillance technologies”). Additional parameters and restrictions for security cameras and drones are contained in chapter 2. Additional parameters and restrictions for license plate recognition technology are contained in chapter 3. In the case of any internal conflict of language in this policy, the language in chapter 1 shall control.
1-1. Purpose
Eastern Washington University (EWU) is committed to promoting a safe and secure campus. EWU utilizes security cameras, drones, and license plate recognition technology (collectively “surveillance technologies”) to:
- Enhance the safety and security of campus; and,
- Support EWU’s ability to prepare for and respond to emergencies.
This policy establishes university standards on the installation and use of security cameras or drones on campus and the handling, viewing, retention, dissemination, and destruction of security camera footage, while respecting individual privacy and applicable constitutional protections. This policy also establishes similar standards for the use of license plate recognition technology.
1-2. Commitment
EWU is committed to operating surveillance technologies in a manner that is consistent with the protections of privacy afforded by the Constitution and laws of the United States, as well as the Washington State Constitution and laws.
Unauthorized recording, viewing, reproduction, dissemination, or retention is prohibited. University community members who violate this policy may be subject to discipline, up to and including termination or expulsion.
1-3. Restrictions
University surveillance devices can only be used for legitimate, university purposes.
University surveillance devices will not be used to evaluate or monitor employees, unless law enforcement officials are using such devices in locations of suspected criminal activity. EWU will post signs or otherwise notify employees of work areas that are being routinely monitored.
Surveillance devices will not be used to target individuals based on their protected status, including, but not limited to, race, ethnicity, shared ancestry, religion, sex, sexual orientation, gender identity/expression, or disability.
Surveillance devices may not be installed or drones used in areas where a reasonable expectation of privacy exists consistent with RCW 9.73.030. This includes restrooms, locker rooms, private offices, entrances to counseling services, and student residential rooms.
No surveillance device may be used to record audio unless clear signage is posted or verbal notice given. Consistent with state law, if audio is being recorded in a non-public setting, all participating parties must be notified that a recording is taking place before recording begins.
EWU will not use or allow a vendor to use biometric identification, facial recognition, behavioral analytics, predictive surveillance or allow EWU’s security camera data to be used in a Generative Artificial Intelligence or Large Language Model system or product.
2. SECURITY CAMERAS
2-1. Scope
This policy does not apply to vehicle dash cameras or body worn cameras. The standards for vehicle dash cameras and body worn cameras are contained in EWU Police Department policies and procedures, except the university may not allow vendors to use dash camera or body worn camera footage with any Generative Artificial Intelligence or Large Language Model system, product, or technology.
Additionally, this policy does not apply to cameras installed or drones utilized primarily for non-security purposes, including, but not limited to:
- Cameras installed in an automated teller machine (ATMs);
- Cameras installed by a non-EWU tenant in a leased facility;
- Cameras or drones used for academic or research purposes (e.g. wildlife or weather monitoring);
- Webcams for general use by members of the university community (e.g. webcam on an individual computer) used for legitimate business or educational purposes (e.g. video conferences); or,
- Use of cameras, video equipment, or drones to record public performances or events, sporting events, interviews, or for broadcast or educational purposes.
2-2. Review and Approval of Location
All security camera devices, security drones, and locations must be approved in advance by a team consisting of representatives from the Police Department, Information Technology, and Student Affairs. Requests will be evaluated on a case-by-case basis based on institutional risk, safety, and privacy considerations based on a placement rubric. The installation or deployment of any new security cameras will be communicated to the Executive Leadership Team.
Upon request, the police department will provide information to the public about the number of security cameras within different zones on campus.
2-3. Active Monitoring
Security cameras and drones will not be actively monitored except on dates of large events that include external participants, such as commencement or a football game. Exceptions can be made if law enforcement is responding to a real time emergency. In such instances, the Chief of Police can permit access to the cameras and drones in real time. Real time monitoring of drones is also permitted as necessary for flight or when conducting an inspection of a premises for security concerns.
2-4. Access and Retention
Security camera recordings will be stored within the appropriate system for 30 days unless an incident has occurred. Security drone recordings will be stored within the appropriate system for 90 days unless an incident has occurred. Records may be preserved for longer periods if required under a lawful order, in connection with litigation or potential litigation, as part of an investigation or agency or court proceeding, or when otherwise required by law.
Access to security camera footage or security drone recordings is limited to the Chief of Police or designee, or Chief Information Officer or designee. Personnel involved in video monitoring will be appropriately trained and supervised. When activity warranting further investigation is reported or detected at any camera location, the available information should be provided to the appropriate investigative unit in a timely manner.
During emergent circumstances, the Chief of Police may authorize video feeds from the security camera or security drones to be forwarded to a specified location for monitoring by other police personnel, such as allied government agencies, road or traffic crews, or fire or emergency operations personnel.
Security camera and drone recordings may be released by the police department for legitimate law enforcement purposes. Records may also be released to university departments for official university business, such as student conduct hearings. Records will only be released to non-law enforcement entities, including immigration enforcement, or the public in response to a public records request, warrant, or subpoena to the extent required by law.
2-5. Audit log
A log must be maintained for all locations where surveillance devices are located, and must be maintained for at least three years. The log should be used to document every person who has been given access to view or monitor images from the system, as well as the dates and times records are accessed. The logs should, at minimum, record the:
- Date and time access was given;
- Name and agency of the person being given access to the images.
- Name of person authorizing access.
- Reason for accessing such records.
- Date and time of the recording, along with a general description of the images viewed.
The log is available to the public upon receipt of a public records request.
2-6. Account and Audit Log Review
The Office of Information Technology shall conduct an annual review of access to surveillance systems and associated administrative platforms.
- The purpose of this review is to:
- Verify that access is limited to individuals with legitimate need
- Identify and remove orphaned, inactive and unnecessary accounts
- Review system access patterns for compliance with authorized use requirement set forth in this policy
- Validate that access permissions remain aligned with least privilege principles
- Identify opportunities to improve system security account management and auditing.
Results of the annual review shall be documented and retained for at least 3 years.
2-7. Vendor requirements
Third-party vendors providing security camera or drone services may access the system solely to the extent necessary to fulfill the university-authorized purpose.
EWU shall not sell, lease, rent, or purchase security camera or drone recordings or audit trail data.
The third-party vendor that provides security cameras and drones must provide technical controls that prevent unauthorized data sharing, secondary transfer, or access by nonauthorized agencies, including federal civil immigration enforcement consistent with state law restrictions. Data must be stored within the United States.
Vendors must default any settings related to sharing to prevent any sharing of EWU’s data with any agency, person, or entity not affirmatively authorized by EWU.
3. AUTOMATED LICENSE PLATE RECOGNITION TECHNOLOGY
3-1. Authorized uses
Automated license plate recognition technology may only be used by EWU’s police department or EWU’s parking services department consistent with the following restrictions established by state law:
(A) Law enforcement: law enforcement may only use information from an automated license plate reader system for the purpose of comparing captured automated license plate reader data with:
(i) Data in any of the following databases maintained by either a federal or Washington state agency: the Department of Licensing, the State Criminal Justice Information System, the Federal Bureau of Investigation Kidnappings and Missing Persons List, the National Center for Missing and Exploited Children List, and the Washington State Missing Persons List, or,
(ii) License plate numbers or vehicle characteristics that have been entered into a state or local automated license plate reader system database or entered in order to perform a search, upon an officer’s determination that the license plate numbers or vehicle characteristics are relevant and material to an investigation of a vehicle that is:
- Stolen;
- Associated with a missing or endangered person;
- Registered to an individual for whom there is an outstanding felony or gross misdemeanor warrant; or,
- Related to or involved in a felony or gross misdemeanor.
A positive match by an automated license plate reader system alone does not constitute reasonable suspicion as grounds to stop the vehicle. The officer must develop independent reasonable suspicion for the stop or immediately confirm visually that the license plate on the vehicle matches the image of the license plate displayed on the automated license plate reader system and confirm by other means that the license plate numbers is one of the databases specified in state law.
(B) Parking enforcement: EWU’s Parking Services department may use license plate recognition technology for the purpose of enforcing restrictions on the use of parking spaces on campus or in immediate surrounding areas consistent with EWU’s agreement with the City of Cheney.
3-2. Restricted uses
License plate recognition technology shall not be used for immigration investigation or enforcement, for any protected health care services under RCW 7.115, or to track or otherwise monitor activity protected by the state or federal constitutions.
EWU does not maintain any parking lots that are used primarily or exclusively for food bank purposes. However, if that changes in the future, license plate reader data shall not be collected on the premises or immediate surroundings of food banks or any other locations restricted by state law.
3-3. Retention
Automated license plate reader data shall not be used or shared for any other purpose and shall not be retained longer than 21 days, with the following exceptions:
(A) When retained pursuant to a valid, court-issued, probable cause felony or gross misdemeanor warrant or subpoena, or as permitted by court order in criminal or civil cases, provided the data is deleted at the conclusion of the criminal or civil case, pursuant to the applicable record retention schedule. Automated license plate reader data may be shared in discovery in accordance with applicable court rules;
(B) When retained for the purpose of parking enforcement, provided the data is deleted no later than 12 hours after final disposition of a parking enforcement case, including exhaustion of any applicable appeals process;
(C) When retained for law enforcement purposes consistent with section 2-1(A) for as long as such captured automated license plate reader data is needed as evidence of a crime.
3-4. Release of information and confidentiality
EWU will not disclose, share, or permit access to automated license plate reader data except as required in a judicial proceeding. EWU will also not provide any other entity with direct access to the automated license plate reader system, unless the other agency is also authorized under state law to collect and access such information. Third-party vendors providing these services may access the system solely to the extent necessary to fulfill the university-authorized purpose.
EWU shall not sell, lease, rent, or purchase automated license plate reader data or audit trail data.
Automated license plate reader data is not subject to disclosure under the Public Records Act, except it may be used for bona fide research as defined in RCW 42.48.010, if it does not include individually identifiable information.
3-5. Vendor requirements
The third-party vendor that provides license plate recognition technology must provide technical controls that prevent unauthorized data sharing, secondary transfer, or access by nonauthorized agencies, including federal civil immigration enforcement consistent with state law restrictions. Vendors are also prohibited from selling, leasing, renting, or otherwise allowing access to automated license plate reader data to any nonauthorized agency, person, or entity. Vendors are also prohibited from making any changes to the automated license plate reader system, including but not limited to software updates that may change sharing permissions, without the knowledge or explicit consent of EWU. Vendors must default any settings related to sharing to prevent any sharing of EWU’s data with any nonauthorized agency, person, or entity.
3-6. Annual Reporting
Parking Services, in collaboration with the EWU Police Department, is responsible for submitting an annual report to the legislature and posting the report on the university website. This report must contain all of the data required by state law.
3-7. Audits
Parking Services must maintain audit trail data documenting all access to the license plate reader system. This data must be retained for two years and must include, at minimum, the information specified in state law.
3-8. Violations
In addition to violating university policy, any person who willfully and intentionally queries, accesses, or uses an automated license plate reader system for a purpose not authorized in this policy, or who willfully and intentionally retains, sells, shares, permits access, or disseminates automated license plate reader system data or audit trail data in violation of this policy and state law, is guilty of a gross misdemeanor.
4. DEFINITIONS
“Artificial Intelligence” means the use of machine learning and related technologies that use data to train statistical models for the purpose of enabling computer systems to perform tasks normally associated with human intelligence or perception, such as computer vision, speech or natural language processing, and content generation.
“Generative Artificial Intelligence” means a machine-based technology that can create content, including text, images, audio, or video, when prompted by a user. Generative AI technologies learn patterns and relationships from large amounts of data, which enables systems to generate new content that may be similar, but not identical, to the underlying training data.
“Large Language Model (LLM)” means an artificial intelligence model trained on extensive collections of text and other data that can process, generate, summarize, classify, or otherwise manipulate natural language in response to user inputs. LLMs are designed to predict and generate text based on patterns learned during training and may be used for tasks such as content creation, information retrieval, analysis, translation, and conversational interactions.
“Machine Learning” means the process by which artificial intelligence is developed using data and algorithms to draw inferences therefrom to automatically adapt or improve its accuracy without explicit programming.
