The Policy Says Only County Employees Can Touch the Data. The Contract Says Flock Can Too.

We obtained both records: the Sheriff’s Office ALPR policy (SOP 222) and the Flock Master Services Agreement behind Contract #25-0364. Read side by side, they conflict — and the conflict is the county’s own paperwork, not our characterization of it.

What the policy promises

SOP 222 is emphatic about who may see the data. SOP 222.5(D): “Within the New Hanover County Sheriff’s Office, access to ALPR-generated data is restricted to NHCSO employees.” SOP 222.5(A) quotes the statute directly: the data “shall not be disclosed except to a criminal justice officer… pursuant to a written request from the requesting agency.” And the policy requires that every one of those employee accesses be logged — SOP 222.5(D)(2)(c) ties access to a login and password so the office can audit who looked at what. That is the picture the Sheriff presents to the public and to the Board: a closed system, county employees only, every look recorded.

What the contract actually grants

The Master Services Agreement the county signed tells a different story. Three clauses matter.

• Section 5.3, “Disclosure of Footage.” Flock reserves the right to itself “access, use, preserve and/or disclose the Footage to law enforcement authorities, government officials, and/or third parties” whenever Flock has “a good faith belief that such access, use, preservation or disclosure is reasonably necessary to… enforce this Agreement, or detect, prevent or otherwise address security, privacy, fraud or technical issues, or emergency situations.” That is a private company granting itself a broad disclosure right — including to third parties — triggered by its own discretion, not by a written request from a criminal-justice officer.
• Section 4.1, “Customer Data.” The Sheriff’s Office grants Flock “a limited, non-exclusive, royalty-free, irrevocable, worldwide license to use the Customer Data and perform all acts as may be necessary for Flock to provide the Flock Services.” “Customer Data” is defined to include the Footage — the plate images themselves.
• Section 4.3, “Anonymized Data.” Flock has “the right to collect, analyze, and anonymize Customer Data… to create Anonymized Data… including the training of machine learning algorithms.” Data does not anonymize itself. Before it becomes “anonymized,” some Flock system or Flock employee is handling the raw plate data to build that training set.

The promise and the paper don’t match

Set them next to each other. The policy tells the public that access is restricted to Sheriff’s Office employees, and that the data leaves only on a written law-enforcement request. The contract gives Flock — a private company, not a criminal-justice officer — standing rights to access, use, and in some circumstances disclose that same data on its own “good faith belief,” and to feed it into machine-learning pipelines. And nothing in the contract requires Flock to log its access the way the SOP requires the county’s own employees to be logged.

The “full-service” package also retains Flock to help educate the board that votes on it

There is one more clause worth reading before August 17, and it is not about data at all. Flock does not sell only cameras; it markets what it calls a “full-service” subscription. In Flock’s own words, that support includes “City-wide coverage mapping,” “Installation,” “Maintenance,” and — listed right beside them — “External Affairs support.” Flock’s service menu spells out what that means: “Get support educating your stakeholders, including city councils and other governing bodies,” alongside a “Media Relations” service to “share crimes solved in the local media with the help of our PR team.”

Flock’s brochure says “city councils” because it is the same language the company sends everywhere. In New Hanover the governing body is the Board of County Commissioners — and both the menu’s umbrella phrase (“other governing bodies”) and the county’s own bid language reach it. This was not Flock overreaching. The county’s own Request for Proposals required it. The RFP made it a condition of the bid: “Proposer must provide support to the agency by providing ‘external affairs,’ by educating community stakeholders, governing bodies, and other members of the public… Public Relations as needed in support to the agency for press releases to the local media outlets.”

Read plainly: the same private company that holds a standing license to the plate data is also retained — at the county’s own request — to help educate the governing body and shape the local coverage. We are not suggesting anyone has acted improperly. We are pointing to what the paperwork says. When the vendor helps “educate” the commissioners about its own product, residents deserve to know that service is written into the contract.

What North Carolina law says — and where this is unsettled

North Carolina’s ALPR statute is narrow. Captured plate data is confidential and not a public record, may be accessed only for law-enforcement purposes (N.C. Gen. Stat. § 20-183.31(b)), and may be disclosed “only to a criminal justice officer… for a legitimate law enforcement purpose pursuant to a written request” (§ 20-183.32(e)). Flock’s likely answer is that the statute covers a system “operated by or on behalf of a law enforcement agency,” and that a vendor engineer maintaining the backend is operating the agency’s own system, not making a “disclosure” to an outsider. That argument has some force for pure maintenance and uptime.

We want to be careful here. No North Carolina appellate court has construed this question, so it is genuinely unsettled — we are not asserting the contract is unlawful. But the argument gets much harder at Section 5.3, which is not maintenance: it is a self-granted right to disclose the footage to third parties on Flock’s own judgment. The statute’s disclosure exception runs to a criminal-justice officer, on a written request. It does not say “or the vendor’s employees,” and it does not say “or whenever the vendor believes it reasonably necessary.” In our reading, that clause is difficult to reconcile with a statute that makes this data confidential and limits who may receive it.

The one question the Board should ask on August 17

You do not have to resolve the legal question to expose the accountability gap — and the gap is a matter of fact. The Sheriff’s own policy requires a login-and-password audit trail for every county employee who touches this data (SOP 222.5(D)(2)(c)). So the question is simple: does the Sheriff’s Office hold any audit log of Flock employee or Flock system access to New Hanover plate data — the same kind of record it keeps for its own personnel? If yes, produce it. If no, then the county has locked its own employees behind an audit trail while handing a private company keys that leave no record at all. That is not speculation. It is the distance between the policy the county shows the public and the contract the county signed.

Read the contract yourself — we published every page. If this is a question you want the commissioners to answer, bring it to them on August 17.

Quotations are from the New Hanover County Sheriff’s Office ALPR policy (SOP 222) and the Flock Safety Master Services Agreement behind Contract #25-0364, both obtained through public records and published in full. This article describes public records and is general information, not legal advice; the statutory question it raises is unsettled, and no North Carolina appellate court has decided it. If any quotation here is inaccurate, write to mark@deflockilm.org and we will correct it in public. First published August 2, 2026.