Virginia Supreme Court Says License Plate Readers Collect Personal Data; Suggests Use Violates State Law

From [HERE] A resident of Virginia, with the ACLU's help, has won at least a partial victory against the mass collection of license plate/location info by automatic license plate readers (ALPRs). The question of whether or not mass collections of this data violated state privacy law has been answered, which may mean significant changes to the way state law enforcement deploys them.

Virginia's history of ALPR use is questionable, to say the least. Some towns in the state obtained ALPRs by claiming a need to swiftly capture the worst of the worst criminals, but decided to put them to use locating people behind on their property taxes. In 2013, state police were discovered to be using ALPRs to troll parking lots at political rallies, giving law enforcement a convenient way to connect drivers to their political leanings. Many of these devices were deployed without public comment or oversight. And law enforcement agencies drew a blank when asked for documentation of the devices' crime-fighting effectiveness.

This passive collection violated the state's "Government Data Collection and Dissemination Act," which forbids collection of personal information without a "clearly established need" to do so. The law prevents codification of abusive practices by requiring agencies looking to harvest personal information to seek approval first, rather than ask for forgiveness later.

This law -- and law enforcement's apparent inability to follow it -- prompted this lawsuit.

In 2013, the (conservative) former Virginia attorney general Ken Cuccinelli issued a strong official advisory opinion stating that under the law, “active” use of an ALPR to identify vehicles that were already involved in wrongdoing was permissible, but that “passive” use of the devices to sweep up raw location data about Virginia residents was not permissible. Nevertheless, in 2014 Harrison Neal, a Virginia resident, found that the Fairfax County Police Department was doing just that, and asked the ACLU of Virginia to file suit challenging the practice on his behalf.

The PD argued nothing "personal" was collected by its ALPRs. It claimed that it represented a vehicle only -- one that could be driven by any number of different drivers. While this is true, most vehicles are driven by one driver a large percentage of the time.

There are 268 million registered vehicles in the United States, but only 221 million licensed drivers, which strongly supports the common sense observation that most vehicles, most of the time, are driven by the same person, or at most a handful of family members.

This rolling database of license plate/location records provides a pretty good depiction of the main driver's life. All plate shots collected by the Fairfax PD are retained for 364 days, allowing officers to track people by proxy for an entire year.

The claim license plates can't be linked to people is disingenuous, at best. Even if the ALPR database is siloed (and it seemingly isn't), police also have access to vehicle registration records which link license plates to vehicle owners. Combine this with other law enforcement databases (biometric, criminal, etc.) and a license plate is as good as an entire person, even if there's a small chance someone else was driving during a few of the passive photoshoots.

The state's supreme court overturns [PDF] the lower court's finding that license plate photos aren't "personal info." The judges here note that would likely be true if all the devices captured were photos of license plates.

The images of the vehicle, its license plate, and the vehicle’s immediate surroundings, along with the GPS location, time, and date when the image was captured “afford a basis for inferring personal characteristics, such as . . . things done by or to” the individual who owns the vehicle, as well as a basis for inferring the presence of the individual who owns the vehicle in a certain location at a certain time. Code § 2.2-3801. The conclusion that the picture and associated data is “personal information” is consistent with the legislature’s intent to remedy the potential mischief posed by “the extensive collection, maintenance, use and dissemination of personal information” and the potential for misuse of such information.

But it's not a complete victory… yet. The court was unable to determine how ALPR software handled license plate data. The case has been remanded to the lower court to perform some fact-finding on law enforcement ALPR data use. If ALPR data is siloed off completely, it may technically be legal under the privacy law. If the police can easily link plate numbers to vehicle owners via registration databases (and from there to other law enforcement collections), the devices violate the law.

If such a means exists, then the Police Department’s “passive use” of ALPRs is not exempt from the operation of the Data Act under the law enforcement exception of Code § 2.2- 3802(7), because the Police Department collected and retained personal information without any suspicion of criminal activity at any level of abstraction, and thus created an information system that does not “deal with investigations and intelligence gathering related to criminal activity.”

This final paragraph also suggests it may not matter if the ALPR data isn't linked to other law enforcement databases. As noted earlier in the decision, a wealth information is collected with every plate photo, which would still be in violation of the law, even if cops have to access a different database to link plates to people. If so, ALPRs may be put on ice until their collection method is modified. At present, non-hit photos are kept along with everything else for 364 days. To comply with the law, the PD is probably going to have to immediately discard non-hit photos, since only those matching law enforcement hotlists will fulfill the requirement that collections like this be used only for "needs clearly established in advance." [MORE]