Peru - AI License Plate Regulation (PL 07651/2023)

Overview

Project 7651/2023 (registered as PL 07651/2023-CR) is a draft law presented to the Peruvian Congress on 22 April 2024 that aims to regulate the deployment and use of algorithms and artificial intelligence techniques for the recognition of vehicle license plates ("reconocimiento de placas de rodaje"). The draft frames the intervention as a public-safety measure to prevent and investigate crimes involving stolen vehicles and altered plates by enabling real-time detection using video surveillance systems with AI modules. The bill text and parliamentary listing can be consulted on the official legislative portal of the Congress (Congress of the Republic of Peru) and the specific expediente entry (Expediente PL 07651), while additional copies of the proposed text are available in the congressional archive (Bill PDF (archivo MTc4NTA5)). The project has attracted commentary from legal and technology observers and is summarized in public repositories such as the University of the Andes' IA/regulation database and practitioner notes (Uniandes IA repository, CMS Legal bytes).

Definitions

The bill defines core terms to delimit scope: "algorithm and AI techniques" refers to software and models used to detect, read and match license-plate characters (including optical character recognition and computer-vision models); "recognition in real time" denotes automated processing of live video streams or near-real-time processing of recently captured images; "authorized registry" describes a national or inter-agency register containing plates authorized to circulate and plates reported as stolen or altered; "operator" includes any public agency, municipal body, or private entity that deploys or operates plate-recognition systems; "match event" refers to an automated positive identification requiring follow-up. These definitions delimit obligations such as registration, logging, and human verification requirements to avoid purely automated enforcement outcomes.

Governance and Institutional Framework

The draft assigns regulatory, oversight and coordination roles to a set of public bodies. It contemplates technical rules and operational coordination by the Ministry of Transport and Communications (MTC) for deployments related to transport infrastructure, while data protection obligations and supervisory authority fall under the Autoridad Nacional de Protección de Datos Personales (ANPD). Operational access and law-enforcement follow-up are expected to involve the Policía Nacional del Perú (PNP) and the Ministry of the Interior. The Congress remains the legislative and oversight authority and the bill contemplates inter-institutional memoranda of understanding for data sharing. The draft requires that any public or private operator obtain prior registration/authorization and submit technical documentation, privacy impact assessments, and security plans to the designated authorities for approval.

Key Focus Areas

The bill concentrates on several intersecting policy pillars: (1) Risk management and necessity: deployments must demonstrate a specific public-safety purpose, documented risk assessment, and proportionality analysis; (2) Data protection and privacy: mandatory data protection impact assessments (DPIAs), minimum retention periods, anonymization/pseudonymization where feasible, and strict access controls; (3) Transparency and accountability: public disclosure of authorized deployments, registries of systems and operators, mandatory logging and tamper-evident audit trails; (4) Human oversight: requirement that automated matches be subject to human review before administrative or criminal measures are taken; (5) Cybersecurity and model security: technical standards for encryption, secure model update procedures, and vulnerability management; (6) Conformity and registration: compulsory system registration and periodic conformity assessments by accredited evaluators; and (7) Remedies and redress: complaint mechanisms and obligations to rectify incorrect matches and delete improperly retained images. The draft therefore intersects privacy, fundamental rights, and surveillance regulation.

Implementation Framework

Implementation is organized into pre-deployment, operational and post-deployment phases. Pre-deployment requires operators to: register systems; provide system architecture, datasets descriptions, model provenance, training/validation metrics, and DPIAs; obtain authorization from the designated regulator(s); and run third-party audits or conformity assessments. Operational requirements include secure logging, role-based access controls, encryption of stored media and model artifacts, predefined retention schedules, and procedures for human verification and escalation. Post-deployment mandates periodic reporting to regulators, incident notification procedures for breaches or misuse, and scheduled audits. The bill contemplates technical regulations and secondary norms to be issued by the MTC in coordination with the ANPD and relevant security bodies to define technical standards for cameras, model accuracy, false-positive thresholds, and interoperability with vehicle registries.

Monitoring and Evaluation

Monitoring mechanisms include mandatory operational reports to the ANPD and the coordinating ministry, independent audits by accredited entities, and public transparency reports summarizing deployments, incidents, and enforcement actions. The draft requires impact evaluations at specified intervals (for example, 12 and 36 months after authorization) to measure accuracy, social impact on rights (freedom of movement, privacy), and effectiveness in crime reduction. The bill also contemplates an independent oversight committee or ombudsperson function to review complaints and advise on policy adjustments. Metrics to be tracked include detection accuracy, false positive/false negative rates, number of matches leading to actions, complaints received, and incidents of data breaches.

Penalties, Liability, and Appeals

Proposed enforcement measures range from administrative sanctions (warnings, fines graduated by severity and repeat violations), suspension or revocation of system registrations, mandatory corrective measures, and referral to prosecutorial authorities for criminal misuse. The bill envisages civil liability for damages caused by negligent or unlawful operation, and allows affected individuals to seek correction, deletion, and compensation through administrative and judicial channels. Operators are required to maintain documentary evidence to defend decisions and are subject to inspection. Appeals procedures are to be defined in implementing regulations and require timely administrative review and access to evidentiary material for affected persons while balancing confidentiality of investigatory data.

Relationship to Other Instruments

The draft explicitly interfaces with existing Peruvian legal instruments: the Law on Personal Data Protection (Law No. 29733 and its regulatory framework) and rules governing vehicle registries and transport regulation. It calls for coordination with the Autoridad Nacional de Protección de Datos Personales for compliance with data-protection principles and with transport and interior ministries for operational rules. The proposal does not supersede general criminal or traffic laws but creates a specialized compliance layer for automated plate-recognition systems. Observers recommend alignment with administrative procedure laws to ensure due process in enforcement actions.

International Alignment

Project 7651/2023 draws on international debates about automated surveillance and AI governance, sharing policy elements present in other jurisdictions such as mandatory DPIAs, transparency registers, human-in-the-loop requirements, and conformity assessments. It references comparative practices and the need to align with international human-rights standards. The bill's measures can be compared to EU regulatory trends (e.g., rules in the AI Act proposals) and Latin American initiatives on algorithmic control and data protection. Observers urge that Peru consider international standards and best practices, and build interoperability and data-protection reciprocity where cross-border data flows are involved.

Implementation Timeline

Phase	Milestone	Target Date
Introduction	Project presented to Congress (PL 07651/2023-CR)	2024-04-22
Committee review	Referral to Commission(s) for study, hearings	2024 Q2 (ongoing)
Regulatory design	MTC & ANPD draft implementing regs after approval	Post-approval + 6-12 months
Registration & audits	Operators register systems; initial conformity assessments	Implementation year + 0-6 months
Monitoring	First mandatory impact evaluation	12 months after major deployments

Compliance Checklist

Requirement	Operator action
Registration	Submit application, system architecture, DPIA
Authorization	Obtain prior approval from designated authority
DPIA	Conduct and publish non-sensitive summary of DPIA
Human review	Ensure human-in-the-loop for match validation
Retention limits	Apply anonymization and delete raw images per schedule
Auditability	Maintain tamper-evident logs; permit audits
Security	Implement encryption and model-security measures

Sources and References

Source	Type
Congress of the Republic of Peru — legislative agenda listing (includes PL 07651/2023-CR)	Primary Source
Expediente PL 07651 — Congress legislative portal	Primary Source
Bill PDF (congress archive file)	Primary Source
University of the Andes — IA regulation repository summary	Secondary Source
CMS Peru — legal bulletin (analysis)	Secondary Source