Outside the Beltway

Virginia Judge Rules Automated Collection Of License Plate Data Illegal

A Virginia Judge has ruled that automated license plate collection systems violate state law.

Doug Mataconis · Thursday, May 2, 2019 · 15 comments

A Circuit Court Judge in Virginia has ruled that automated license plate collection systems are illegal under Virginia law:

A Virginia state judge ruled earlier this month that automated license plate data collection by police qualified as protected “personal information,” and was illegal, because it included the following elements all combined: The license plate number, images of the vehicle and license plate and immediate surroundings, plus GPS location and time and date.

The value of multiple types of data that can be interpolated is greater than one form alone.

Here is the court’s ruling [PDF Link].

EFF has done tons of work on this issue, and the EFF’s Dave Maass wrote a great technology primer you should read if you’re interested. Also, don’t miss EFF’s street-level surveillance FAQ.

This report was published Tuesday at Boing Boing, but the ruling was actually handed down at the beginning of April and The Washington Post reported on the decision at that time:

A Fairfax County judge on Monday ordered the Fairfax County police to stop maintaining a database of photos of vehicle license plates, with the time and location where they were snapped, ruling that “passive use” of data from automated license plate readers on the back of patrol cars violates Virginia privacy law. The ruling followed a related finding by the Virginia Supreme Court last year, meaning the case could affect how long — if at all — Virginia police can keep license plate data.

The ruling by Fairfax Circuit Court Judge Robert J. Smith is a victory for privacy rights advocates who argued that the police could track a person’s movements by compiling the times and exact locations of a car anytime its plate was captured by a license plate reader. Fairfax County Police Chief Edwin C. Roessler Jr. said Monday night that he would ask the county attorney to appeal the ruling.

The issue represents another front in the ongoing conflict over the use of emerging technologies by law enforcement. Police say they can, and have, used license plate location data to find dangerous criminals and missing persons. Privacy advocates don’t oppose the use of the technology during an active investigation, but they say that maintaining a database of license plate locations for months or years provides too much opportunity for abuse by the police. Last month, the ACLU disclosed that the federal Immigration and Customs Enforcement agency was tapping into a vast, national database of police and private license plate readers. Such private databases remain unregulated.

The Fairfax judge’s ruling applies only to the Fairfax police, but it may find a receptive audience, and have statewide impact, in the Virginia Supreme Court. Last year, the state supreme court reversed Smith when he threw the case out of court, finding that “the pictures and associated data stored in the police department’s . . . database meet the statutory definition of ‘personal information'” under Virginia’s “Data Act.” The court sent the case back to Smith to determine whether the database classified as an “information system” under the Data Act. Smith then ruled that it does.

The challenge to the practice was brought by the American Civil Liberties Union of Virginia on behalf of Harrison Neal, a Fairfax man whose license plate and location had been recorded at least twice by the police. The ACLU said Monday that it “welcomes this ruling in favor of our client, as this technology should not be used to monitor the comings and goings of people’s daily lives.”

An automated license plate reader, typically mounted on the back trunk of a patrol car, can snap hundreds of photos per minute of license plates while the car is moving. It then checks those plate numbers against a database of wanted cars, which might be stolen or suspected of being tied to a crime, and alerts the driver in seconds. But it also stores the time and location of when and where the photo was snapped.

Nine states have passed laws limiting how long the police can maintain the data, ranging from three minutes (New Hampshire) to 90 days (Tennessee) to three years (Colorado), according to the National Conference of State Legislatures. Seven other states, including Maryland, have laws restricting the use and dissemination of license plate data but do not put a time limit on how long the data can be kept.

In Virginia, there is no law regarding license plate readers. But the “Data Act” states that “The Commonwealth or any agency or political subdivision thereof shall not collect personal information except as explicitly or implicitly authorized by law.” In 2013, the Virginia State Police asked then-state Attorney General Ken Cuccinelli II if, under that law, they could maintain license plate data. Cuccinelli issued an opinion saying they could not, and the state police have since purged their license plate data every 24 hours.

But The Washington Post found that other agencies around Virginia ignored the nonbinding attorney general’s opinion. Fairfax police keep the data for a year. Alexandria police keep it for two years. In 2015, a new bipartisan “Ben Franklin liberty caucus” was founded in the Virginia General Assembly, and a practically unanimous legislature passed a bill limiting the license data retention to seven days.

But then-Governor Terry McAuliffe, heeding the warnings of law enforcement that they needed the data to find criminals, vetoed the bill. License plate readers had been used by police in New York to help track down a man suspected of planting bombs in Manhattan months earlier, and police in Arlington, Va., found a 67-year-old man who had been missing for two days, and was near death, when his car was recorded blocks away from his residence.

After legislation failed, the ACLU sued in Fairfax, seeking an injunction against the “passive collection” of license plate data beyond an immediate need or existing criminal investigation. In 2016, Judge Smith granted Fairfax’s motion to dismiss the case, saying that “license plate number” is not included in the Data Act’s definition of “personal information.” Smith ruled that a license plate number “does not tell the researcher where the person is, what the person is doing, or anything else about the person.”

Then the Virginia Supreme Court agreed to hear the ACLU’s appeal. Last year, Justice Cleo E. Powell wrote that, while the plate number alone doesn’t identify anyone, the photo of the vehicle and its surroundings, as well as the time and place information, would “afford a basis for inferring personal characteristics” or the presence of a person at a certain place and time — “personal information,” the court found.

The Supreme Court sent the case back to Smith to determine if the license plate database is an “information system” as defined by the Data Act. Smith held a hearing in December to learn in detail how the system works. He found that officers can log into the license plate database to get information on a vehicle’s whereabouts, and then log in separately to the federal and state criminal information systems, or the state motor vehicle database, to discover the vehicle’s owner.

The license plate database “does enable police officers to cross-reference ALPR [automated license plate reader] data with the identity of an individual,” Smith wrote. “The Police Department’s ‘passive use’ of the ALPR system therefore violates the Data Act.”

It’s important to note at the offset that this ruling by Circuit Court Judge Robert Smith, who has been on the bench for more than 20 years and before whom I appeared many times, does not involve either the interpretation of the Virginia or Federal Constitution. Instead, it involves the question of whether or not the database that police in Fairfax County, the state’s most populated jurisdiction, maintain from their network of cruiser-mounted license plate readers complies with the Virginia Data Act, a law that regulates how, and for how long, personal information collected by state agencies such as law enforcement may be kept before the information must be purged from the system. As such, its applicability and usefulness outside Virginia, and indeed outside of the facts of this specific case, is entirely unclear. Nonetheless, the extent to which this is a victory for privacy rights advocates cannot be understated.

PrivacySOS has more:

The ACLU has been sounding the alarm about the use of ALPRs all over the country since 2012. While some states have regulated their use, limiting the time police departments can retain non-derogatory information, most police departments use the systems to conduct both active and passive surveillance—that is, to actively search for cars connected to suspected criminal activity, and to collect and retain for long periods information about drivers who are not suspected of any crimes.

In this ACLU lawsuit in Virginia, the key question was whether the collection and storage of Neal’s license plate data without suspicion of any criminal activity was legal under Virginia state law. To determine if the surveillance violated that law, the ACLU had to prove two things. First, the ACLU had to demonstrate that the state data protection law applied to the police department’s collection of license plate reader data—specifically, that the records constituted personal information and that the license plate reader record keeping system was an information system as defined under the state law. Second, provided the law applied, the ACLU had to prove that the police department’s passive surveillance was not exempt from the law and that therefore the creation of the database violated it. To do that, the ACLU argued that this type of surveillance violated the law’s provision requiring a clear and established need to collect information.

The ACLU lost at the circuit court, which held in favor of the police department. But the ACLU appealed, and theVirginia Supreme Court reversed the lower court’s decision, ruling in favor of the ACLU and Neal. Writing for the Court, Justice Powell’s decision hinged on three main questions. First, does ALPR information constitute “personal information” as defined by the statute? Second, is the ALPR database an “information system” protected under the state law? And finally, if the answers to the first two questions are ‘yes,’ is there an exemption from the data protection law that applies to the personal records and information system at issue?

To answer the first question, the Court looked to the nature of the information collected. The Justices used a framework that distinguished license plate numbers per se from ALPR data. While the former is not personal information, the latter is, the Court held. Under Virginia law, information is considered “personal information” when it affords a basis for inferring personal characteristics or the presence of an identified individual. The Court ruled that license plate numbers alone are just a combination of characters, and that whether or not they constitute personal information depends on the context in which they are used. But ALPR data is different, the Court held, because it contains not only the license plate number, but also images of the vehicle, its license plate, its immediate surroundings, and the GPS location, time, and date captured with the image. Taken together, this information allows its holder to infer personal characteristics and show where individuals have been. Consequently, the Justices decided, ALPR records fall under the statutory definition of “personal information.”

Next, the Court examined whether the ALPR system constitutes an “information system” protected under the statute. Unsurprisingly, there is a direct connection between this issue and the previous one: the law defines an information system as a record-keeping process that contains both personal information and identifiers (like names or personal numbers) of particular individuals. Here, the Court ruled that the ALPR information constitutes personal information. But given the information before it, the Court could not discern if there was a sufficient link between the license plate number and Neal to characterize that number as one of the identifiers that would complete the information system equation. Accordingly, the Justices remanded the case to the lower court to decide this issue.

Finally, the Court looked at the scope of the law enforcement exemption in the state law. The exemption excludes from the statute’s protections information systems that relate to investigations and intelligence gathering related to criminal activity. Here, in accordance with the opinion of the Attorney General, issued in 2013, the Court decided that the exemption did not apply to passive surveillance. The 2013 AG opinion concluded that the state police’s passive collection of ALPR data violated state law because there was not a clear “need” for its collection. The AG reasoned that the value of records revealing where people not suspected of criminal activity have traveled to a criminal investigation was “wholly speculative”—a value the data protection statute does not incorporate in any of its exceptions. In other words, the AG and the High Court agreed: There’s no valid need for cops to track the movements of people not suspected of criminal activity.

On remand to the lower court, the only issue left to decide was whether license plate numbers could effectively identify Neal, meaning the ALPR system constituted an information system.

The evidence the lower court heard was very clear: In Virginia, police officers have unlimited access not only to ALPR information but also DMV records and other law enforcement databases—including the National Crime Information Center maintained by the FBI. It’s therefore a trivial matter for a Virigina law enforcement official to connect ALPR data to a person’s name and address. The circle therefore closed. The passive surveillance database was an information system that permitted police to identify people using ALPR data and license plate numbers. Accordingly, its existence was against the law because there was no established need for it to exist

While this case dealt solely with issues of state law, there are those who argue that there are potential Fourth Amendment issues involved in systems such as this. In all honesty, while I consider myself something of a Fourth Amendment zealot, I think the argument that these systems are a per se violation of that Amendment is incredibly weak. There does not appear to be on the surface any per se Constitutional objection to a police officer taking note of the license plates of the vehicles around him or her while out on patrol. Indeed, ever since there have been computers in patrol cars hooked into the relevant databases, it’s been common practice for officers to tap in license plate numbers while waiting in traffic or at stop lights. If a hit comes up — such as a car owned by someone who has a suspended license, or a car on the list of stolen cars — then the officer will typically either pull the car over since they now have reasonable suspicion to do so, or follow the car until further instructions are received. There’s no 4th Amendment violation here because you don’t have a reasonable expectation of privacy in your license plate number and, indeed, you most assuredly don’t if you’re sitting in a traffic jam with a police car directly behind you.  The fact that the same thing is being done with technology tied into a central database doesn’t really change the 4th Amendment analysis in the end, but that’s only part of the issue.

Notwithstanding this, as Conor Friedersdorf noted in a piece back in 2013 there is certainly something creepy and concerning about the practice:

Driving down the street, I have no reasonable expectation that my license-plate number won’t be jotted down by someone. But I am aghast at the notion that it could be recorded on all major streets, at all times, with each scan aggregated in a massive database and stored forever. I’m confident that the men who wrote and ratified the Fourth Amendment would be similarly aghast. The technology is here, and increasingly being used. 

There isn’t much time left to stop it.

Even though the practice of using technology like this to allow a police officer to determine if any of the cars around him are listed as stolen, or whether they are relevant to some ongoing criminal investigation case does not violate the Fourth Amendment, that doesn’t mean there are not concerns that should be addressed. In that respect, the issue we ought to be concerned with is how the technology is being used, and what’s happening to all the data that it collects. How long are the license plate numbers collected that don’t match up to something kept? Who has access to them? Who could they be shared with and for what purposes? These are only some of the questions that a massive data collection effort like this raises.

Some of them can be answered by Courts utilizing the outlines of the 4th Amendment or, as in this case, state law, to place limits on what law enforcement can do with this sort of technology, just as Courts are just now starting to address the proper limits of GPS tracking technology by law enforcement. Other limits will have to be addressed by legislatures, both Federal and state, put under pressure by the public to protect privacy in an era where its beginning to feel like privacy is dying. The technology genie is out of the bottle, but we still have time to get it under some degree of control if we act.

Here’s Judge Smith’s opinion letter:

Harrison Neal v. Fairfax Co… by on Scribd