Virginia Supreme Court Says License Plate Readers Collect Personal Data; Suggests Use Violates State Law
from the but-then-again,-no-one-expects-cops-to-have-much-legal-knowledge... dept
A resident of Virginia, with the ACLU's help, has won at least a partial victory against the mass collection of license plate/location info by automatic license plate readers (ALPRs). The question of whether or not mass collections of this data violated state privacy law has been answered, which may mean significant changes to the way state law enforcement deploys them.
Virginia's history of ALPR use is questionable, to say the least. Some towns in the state obtained ALPRs by claiming a need to swiftly capture the worst of the worst criminals, but decided to put them to use locating people behind on their property taxes. In 2013, state police were discovered to be using ALPRs to troll parking lots at political rallies, giving law enforcement a convenient way to connect drivers to their political leanings. Many of these devices were deployed without public comment or oversight. And law enforcement agencies drew a blank when asked for documentation of the devices' crime-fighting effectiveness.
This passive collection violated the state's "Government Data Collection and Dissemination Act," which forbids collection of personal information without a "clearly established need" to do so. The law prevents codification of abusive practices by requiring agencies looking to harvest personal information to seek approval first, rather than ask for forgiveness later.
This law -- and law enforcement's apparent inability to follow it -- prompted this lawsuit.
In 2013, the (conservative) former Virginia attorney general Ken Cuccinelli issued a strong official advisory opinion stating that under the law, “active” use of an ALPR to identify vehicles that were already involved in wrongdoing was permissible, but that “passive” use of the devices to sweep up raw location data about Virginia residents was not permissible. Nevertheless, in 2014 Harrison Neal, a Virginia resident, found that the Fairfax County Police Department was doing just that, and asked the ACLU of Virginia to file suit challenging the practice on his behalf.
The PD argued nothing "personal" was collected by its ALPRs. It claimed that it represented a vehicle only -- one that could be driven by any number of different drivers. While this is true, most vehicles are driven by one driver a large percentage of the time.
There are 268 million registered vehicles in the United States, but only 221 million licensed drivers, which strongly supports the common sense observation that most vehicles, most of the time, are driven by the same person, or at most a handful of family members.
This rolling database of license plate/location records provides a pretty good depiction of the main driver's life. All plate shots collected by the Fairfax PD are retained for 364 days, allowing officers to track people by proxy for an entire year.
The claim license plates can't be linked to people is disingenuous, at best. Even if the ALPR database is siloed (and it seemingly isn't), police also have access to vehicle registration records which link license plates to vehicle owners. Combine this with other law enforcement databases (biometric, criminal, etc.) and a license plate is as good as an entire person, even if there's a small chance someone else was driving during a few of the passive photoshoots.
The state's supreme court overturns [PDF] the lower court's finding that license plate photos aren't "personal info." The judges here note that would likely be true if all the devices captured were photos of license plates.
The images of the vehicle, its license plate, and the vehicle’s immediate surroundings, along with the GPS location, time, and date when the image was captured “afford a basis for inferring personal characteristics, such as . . . things done by or to” the individual who owns the vehicle, as well as a basis for inferring the presence of the individual who owns the vehicle in a certain location at a certain time. Code § 2.2-3801. The conclusion that the picture and associated data is “personal information” is consistent with the legislature’s intent to remedy the potential mischief posed by “the extensive collection, maintenance, use and dissemination of personal information” and the potential for misuse of such information.
But it's not a complete victory… yet. The court was unable to determine how ALPR software handled license plate data. The case has been remanded to the lower court to perform some fact-finding on law enforcement ALPR data use. If ALPR data is siloed off completely, it may technically be legal under the privacy law. If the police can easily link plate numbers to vehicle owners via registration databases (and from there to other law enforcement collections), the devices violate the law.
If such a means exists, then the Police Department’s “passive use” of ALPRs is not exempt from the operation of the Data Act under the law enforcement exception of Code § 2.2- 3802(7), because the Police Department collected and retained personal information without any suspicion of criminal activity at any level of abstraction, and thus created an information system that does not “deal with investigations and intelligence gathering related to criminal activity.”
This final paragraph also suggests it may not matter if the ALPR data isn't linked to other law enforcement databases. As noted earlier in the decision, a wealth information is collected with every plate photo, which would still be in violation of the law, even if cops have to access a different database to link plates to people. If so, ALPRs may be put on ice until their collection method is modified. At present, non-hit photos are kept along with everything else for 364 days. To comply with the law, the PD is probably going to have to immediately discard non-hit photos, since only those matching law enforcement hotlists will fulfill the requirement that collections like this be used only for "needs clearly established in advance."
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: 4th amendment, alpr, license plate readers, privacy, virginia
Reader Comments
Subscribe: RSS
View by: Time | Thread
car registration-by-proxy service?
Although dodgy shell corporations of all types are literally the way this country works, perhaps it's a grey area of law when it comes to individuals, in much the same way as gun trusts (which BTW the ATF is now cracking down on) allow for collective rather than individual gun ownership.
[ link to this | view in chronology ]
Re: car registration-by-proxy service?
Just like the "law" was changed to ensure that every person who owns a website is positively identified, even if the public listing is still anonymous.
[ link to this | view in chronology ]
So they lied? Big deal, they lie about everything. Most people here are all too happy to sign up for more government control and regulations over multiples sectors and industries to protect us, why should ALPRs be any different?
This is what you wanted, shut-up and sleep in the beds you helped make!
[ link to this | view in chronology ]
"Except for when WE use it, totally identifies them then."
The PD argued nothing "personal" was collected by its ALPRs. It claimed that it represented a vehicle only -- one that could be driven by any number of different drivers.
A fact that I'm sure they would make sure to stress to any judge that they might want to get a warrant from based upon where a car was during a specific time period according to an ALPR.
"We don't actually have any evidence that the owner of the vehicle was in the area during the time period the crime was committed, but based upon... uh... other evidence that we seem to have forgotten in our other pants, we believe we have sufficient justification to conduct a search of their property."
And of course there's the 'turnabout is fair play test', where the question is asked 'What if if was done to them?' Would they accept someone who set up a system to track their personal vehicles around the city as 'not involving personal information'? The hypothetical person after all would not be creating records that could easily allow one to track a cop, they would merely be taking pictures of cars on the road, and by their own argument there's nothing wrong with that.
[ link to this | view in chronology ]
Re: "Except for when WE use it, totally identifies them then."
Also: parking tickets, speed-camera/red-light-camera tickets, etc.—those get sent to the owner, and saying your car "could [have been] driven by any number of different drivers" isn't going to get you out of those.
Hell, we should create a system showing the real-time location of every cop car. Recognizable design, giant numbers printed on top, it's not a hard image-recognition problem.
[ link to this | view in chronology ]
Re: "Except for when WE use it, totally identifies them then."
[ link to this | view in chronology ]
no plates
But if you still really love them in this 21st Century -- you should be free to voluntarily buy them from your DMV for yourself.
[ link to this | view in chronology ]
Re: no plates -- SO, no problem if hit-and-run driver hits YOU?
I don't like license plates, but as ever, the "libertarian" notion that we can just do away with all restraints because there are no bad people is vastly worse, stupid and literally self-destructive.
Just try to bear the few drawbacks to civilization while stuffing yourself with food and watching stolen entertainments.
[ link to this | view in chronology ]
Re: Re: no plates -- SO, no problem if hit-and-run driver hits YOU?
This topic has nothing to do with either food or "stolen entertainments" but yet you once again took the opportunity to unfairly attack Techdirt readers.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: no plates
[ link to this | view in chronology ]
Done. Now, let's just check the new Virginia law enforcement hotlist:
[ link to this | view in chronology ]
lol
[ link to this | view in chronology ]