Virginia Judge Rules Automated Collection Of License Plate Data Illegal

A Virginia Judge has ruled that automated license plate collection systems violate state law.

A Circuit Court Judge in Virginia has ruled that automated license plate collection systems are illegal under Virginia law:

A Virginia state judge ruled earlier this month that automated license plate data collection by police qualified as protected “personal information,” and was illegal, because it included the following elements all combined: The license plate number, images of the vehicle and license plate and immediate surroundings, plus GPS location and time and date.

The value of multiple types of data that can be interpolated is greater than one form alone.

Here is the court’s ruling [PDF Link].

EFF has done tons of work on this issue, and the EFF’s Dave Maass wrote a great technology primer you should read if you’re interested. Also, don’t miss EFF’s street-level surveillance FAQ.

This report was published Tuesday at Boing Boing, but the ruling was actually handed down at the beginning of April and The Washington Post reported on the decision at that time:

A Fairfax County judge on Monday ordered the Fairfax County police to stop maintaining a database of photos of vehicle license plates, with the time and location where they were snapped, ruling that “passive use” of data from automated license plate readers on the back of patrol cars violates Virginia privacy law. The ruling followed a related finding by the Virginia Supreme Court last year, meaning the case could affect how long — if at all — Virginia police can keep license plate data.

The ruling by Fairfax Circuit Court Judge Robert J. Smith is a victory for privacy rights advocates who argued that the police could track a person’s movements by compiling the times and exact locations of a car anytime its plate was captured by a license plate reader. Fairfax County Police Chief Edwin C. Roessler Jr. said Monday night that he would ask the county attorney to appeal the ruling.

The issue represents another front in the ongoing conflict over the use of emerging technologies by law enforcement. Police say they can, and have, used license plate location data to find dangerous criminals and missing persons. Privacy advocates don’t oppose the use of the technology during an active investigation, but they say that maintaining a database of license plate locations for months or years provides too much opportunity for abuse by the police. Last month, the ACLU disclosed that the federal Immigration and Customs Enforcement agency was tapping into a vast, national database of police and private license plate readers. Such private databases remain unregulated.

The Fairfax judge’s ruling applies only to the Fairfax police, but it may find a receptive audience, and have statewide impact, in the Virginia Supreme Court. Last year, the state supreme court reversed Smith when he threw the case out of court, finding that “the pictures and associated data stored in the police department’s . . . database meet the statutory definition of ‘personal information'” under Virginia’s “Data Act.” The court sent the case back to Smith to determine whether the database classified as an “information system” under the Data Act. Smith then ruled that it does.

The challenge to the practice was brought by the American Civil Liberties Union of Virginia on behalf of Harrison Neal, a Fairfax man whose license plate and location had been recorded at least twice by the police. The ACLU said Monday that it “welcomes this ruling in favor of our client, as this technology should not be used to monitor the comings and goings of people’s daily lives.”

An automated license plate reader, typically mounted on the back trunk of a patrol car, can snap hundreds of photos per minute of license plates while the car is moving. It then checks those plate numbers against a database of wanted cars, which might be stolen or suspected of being tied to a crime, and alerts the driver in seconds. But it also stores the time and location of when and where the photo was snapped.

Nine states have passed laws limiting how long the police can maintain the data, ranging from three minutes (New Hampshire) to 90 days (Tennessee) to three years (Colorado), according to the National Conference of State Legislatures. Seven other states, including Maryland, have laws restricting the use and dissemination of license plate data but do not put a time limit on how long the data can be kept.

In Virginia, there is no law regarding license plate readers. But the “Data Act” states that “The Commonwealth or any agency or political subdivision thereof shall not collect personal information except as explicitly or implicitly authorized by law.” In 2013, the Virginia State Police asked then-state Attorney General Ken Cuccinelli II if, under that law, they could maintain license plate data. Cuccinelli issued an opinion saying they could not, and the state police have since purged their license plate data every 24 hours.

But The Washington Post found that other agencies around Virginia ignored the nonbinding attorney general’s opinion. Fairfax police keep the data for a year. Alexandria police keep it for two years. In 2015, a new bipartisan “Ben Franklin liberty caucus” was founded in the Virginia General Assembly, and a practically unanimous legislature passed a bill limiting the license data retention to seven days.

But then-Governor Terry McAuliffe, heeding the warnings of law enforcement that they needed the data to find criminals, vetoed the bill. License plate readers had been used by police in New York to help track down a man suspected of planting bombs in Manhattan months earlier, and police in Arlington, Va., found a 67-year-old man who had been missing for two days, and was near death, when his car was recorded blocks away from his residence.

After legislation failed, the ACLU sued in Fairfax, seeking an injunction against the “passive collection” of license plate data beyond an immediate need or existing criminal investigation. In 2016, Judge Smith granted Fairfax’s motion to dismiss the case, saying that “license plate number” is not included in the Data Act’s definition of “personal information.” Smith ruled that a license plate number “does not tell the researcher where the person is, what the person is doing, or anything else about the person.”

Then the Virginia Supreme Court agreed to hear the ACLU’s appeal. Last year, Justice Cleo E. Powell wrote that, while the plate number alone doesn’t identify anyone, the photo of the vehicle and its surroundings, as well as the time and place information, would “afford a basis for inferring personal characteristics” or the presence of a person at a certain place and time — “personal information,” the court found.

The Supreme Court sent the case back to Smith to determine if the license plate database is an “information system” as defined by the Data Act. Smith held a hearing in December to learn in detail how the system works. He found that officers can log into the license plate database to get information on a vehicle’s whereabouts, and then log in separately to the federal and state criminal information systems, or the state motor vehicle database, to discover the vehicle’s owner.

The license plate database “does enable police officers to cross-reference ALPR [automated license plate reader] data with the identity of an individual,” Smith wrote. “The Police Department’s ‘passive use’ of the ALPR system therefore violates the Data Act.”

It’s important to note at the offset that this ruling by Circuit Court Judge Robert Smith, who has been on the bench for more than 20 years and before whom I appeared many times, does not involve either the interpretation of the Virginia or Federal Constitution. Instead, it involves the question of whether or not the database that police in Fairfax County, the state’s most populated jurisdiction, maintain from their network of cruiser-mounted license plate readers complies with the Virginia Data Act, a law that regulates how, and for how long, personal information collected by state agencies such as law enforcement may be kept before the information must be purged from the system. As such, its applicability and usefulness outside Virginia, and indeed outside of the facts of this specific case, is entirely unclear. Nonetheless, the extent to which this is a victory for privacy rights advocates cannot be understated.

PrivacySOS has more:

The ACLU has been sounding the alarm about the use of ALPRs all over the country since 2012. While some states have regulated their use, limiting the time police departments can retain non-derogatory information, most police departments use the systems to conduct both active and passive surveillance—that is, to actively search for cars connected to suspected criminal activity, and to collect and retain for long periods information about drivers who are not suspected of any crimes.

In this ACLU lawsuit in Virginia, the key question was whether the collection and storage of Neal’s license plate data without suspicion of any criminal activity was legal under Virginia state law. To determine if the surveillance violated that law, the ACLU had to prove two things. First, the ACLU had to demonstrate that the state data protection law applied to the police department’s collection of license plate reader data—specifically, that the records constituted personal information and that the license plate reader record keeping system was an information system as defined under the state law. Second, provided the law applied, the ACLU had to prove that the police department’s passive surveillance was not exempt from the law and that therefore the creation of the database violated it. To do that, the ACLU argued that this type of surveillance violated the law’s provision requiring a clear and established need to collect information.

The ACLU lost at the circuit court, which held in favor of the police department. But the ACLU appealed, and theVirginia Supreme Court reversed the lower court’s decision, ruling in favor of the ACLU and Neal. Writing for the Court, Justice Powell’s decision hinged on three main questions. First, does ALPR information constitute “personal information” as defined by the statute? Second, is the ALPR database an “information system” protected under the state law? And finally, if the answers to the first two questions are ‘yes,’ is there an exemption from the data protection law that applies to the personal records and information system at issue?

To answer the first question, the Court looked to the nature of the information collected. The Justices used a framework that distinguished license plate numbers per se from ALPR data. While the former is not personal information, the latter is, the Court held. Under Virginia law, information is considered “personal information” when it affords a basis for inferring personal characteristics or the presence of an identified individual. The Court ruled that license plate numbers alone are just a combination of characters, and that whether or not they constitute personal information depends on the context in which they are used. But ALPR data is different, the Court held, because it contains not only the license plate number, but also images of the vehicle, its license plate, its immediate surroundings, and the GPS location, time, and date captured with the image. Taken together, this information allows its holder to infer personal characteristics and show where individuals have been. Consequently, the Justices decided, ALPR records fall under the statutory definition of “personal information.”

Next, the Court examined whether the ALPR system constitutes an “information system” protected under the statute. Unsurprisingly, there is a direct connection between this issue and the previous one: the law defines an information system as a record-keeping process that contains both personal information and identifiers (like names or personal numbers) of particular individuals. Here, the Court ruled that the ALPR information constitutes personal information. But given the information before it, the Court could not discern if there was a sufficient link between the license plate number and Neal to characterize that number as one of the identifiers that would complete the information system equation. Accordingly, the Justices remanded the case to the lower court to decide this issue.

Finally, the Court looked at the scope of the law enforcement exemption in the state law. The exemption excludes from the statute’s protections information systems that relate to investigations and intelligence gathering related to criminal activity. Here, in accordance with the opinion of the Attorney General, issued in 2013, the Court decided that the exemption did not apply to passive surveillance. The 2013 AG opinion concluded that the state police’s passive collection of ALPR data violated state law because there was not a clear “need” for its collection. The AG reasoned that the value of records revealing where people not suspected of criminal activity have traveled to a criminal investigation was “wholly speculative”—a value the data protection statute does not incorporate in any of its exceptions. In other words, the AG and the High Court agreed: There’s no valid need for cops to track the movements of people not suspected of criminal activity.

On remand to the lower court, the only issue left to decide was whether license plate numbers could effectively identify Neal, meaning the ALPR system constituted an information system.

The evidence the lower court heard was very clear: In Virginia, police officers have unlimited access not only to ALPR information but also DMV records and other law enforcement databases—including the National Crime Information Center maintained by the FBI. It’s therefore a trivial matter for a Virigina law enforcement official to connect ALPR data to a person’s name and address. The circle therefore closed. The passive surveillance database was an information system that permitted police to identify people using ALPR data and license plate numbers. Accordingly, its existence was against the law because there was no established need for it to exist

While this case dealt solely with issues of state law, there are those who argue that there are potential Fourth Amendment issues involved in systems such as this. In all honesty, while I consider myself something of a Fourth Amendment zealot, I think the argument that these systems are a per se violation of that Amendment is incredibly weak. There does not appear to be on the surface any per se Constitutional objection to a police officer taking note of the license plates of the vehicles around him or her while out on patrol. Indeed, ever since there have been computers in patrol cars hooked into the relevant databases, it’s been common practice for officers to tap in license plate numbers while waiting in traffic or at stop lights. If a hit comes up — such as a car owned by someone who has a suspended license, or a car on the list of stolen cars — then the officer will typically either pull the car over since they now have reasonable suspicion to do so, or follow the car until further instructions are received. There’s no 4th Amendment violation here because you don’t have a reasonable expectation of privacy in your license plate number and, indeed, you most assuredly don’t if you’re sitting in a traffic jam with a police car directly behind you.  The fact that the same thing is being done with technology tied into a central database doesn’t really change the 4th Amendment analysis in the end, but that’s only part of the issue.

Notwithstanding this, as Conor Friedersdorf noted in a piece back in 2013 there is certainly something creepy and concerning about the practice:

Driving down the street, I have no reasonable expectation that my license-plate number won’t be jotted down by someone. But I am aghast at the notion that it could be recorded on all major streets, at all times, with each scan aggregated in a massive database and stored forever. I’m confident that the men who wrote and ratified the Fourth Amendment would be similarly aghast. The technology is here, and increasingly being used. 

There isn’t much time left to stop it.

Even though the practice of using technology like this to allow a police officer to determine if any of the cars around him are listed as stolen, or whether they are relevant to some ongoing criminal investigation case does not violate the Fourth Amendment, that doesn’t mean there are not concerns that should be addressed. In that respect, the issue we ought to be concerned with is how the technology is being used, and what’s happening to all the data that it collects. How long are the license plate numbers collected that don’t match up to something kept? Who has access to them? Who could they be shared with and for what purposes? These are only some of the questions that a massive data collection effort like this raises.

Some of them can be answered by Courts utilizing the outlines of the 4th Amendment or, as in this case, state law, to place limits on what law enforcement can do with this sort of technology, just as Courts are just now starting to address the proper limits of GPS tracking technology by law enforcement. Other limits will have to be addressed by legislatures, both Federal and state, put under pressure by the public to protect privacy in an era where its beginning to feel like privacy is dying. The technology genie is out of the bottle, but we still have time to get it under some degree of control if we act.

Here’s Judge Smith’s opinion letter:

Harrison Neal v. Fairfax Co… by on Scribd

FILED UNDER: Fourth Amendment, Law and the Courts, Privacy, U.S. Constitution, , ,
Doug Mataconis
About Doug Mataconis
Doug holds a B.A. in Political Science from Rutgers University and J.D. from George Mason University School of Law. He joined the staff of OTB in May 2010. Before joining OTB, he wrote at Below The BeltwayThe Liberty Papers, and United Liberty Follow Doug on Twitter | Facebook

Comments

  1. grumpy realist says:

    I suspect we’re going to start seeing a movement back to riding on horses and sending information to each other by writing on paper with quill pens, just by people who get sufficiently ticked off about this.

  2. Daryl and his brother Darryl says:

    OT…
    Moore has dropped out of the running for the FED.

  3. OzarkHillbilly says:

    there are those who argue that there are potential Fourth Amendment issues involved in systems such as this. In all honesty, while I consider myself something of a Fourth Amendment zealot, I think the argument that these systems are a per se violation of that Amendment is incredibly weak.

    Yes, the Constitution could use some updating.

    These are only some of the questions that a massive data collection effort like this raises.

    Some of them can be answered by Courts utilizing the outlines of the 4th Amendment or, as in this case, state law, to place limits on what law enforcement can do with this sort of technology, just as Courts are just now starting to address the proper limits of GPS tracking technology by law enforcement. Other limits will have to be addressed by legislatures, both Federal and state, put under pressure by the public to protect privacy in an era where its beginning to feel like privacy is dying.

    This is also true and gives me very little hope that any doing of the “right thing” by legislatures or courts will be any longer lasting than a rose blossom. We all know that any abuse of power will happen when it is convenient for those in power, and if it is inconvenient they will find a way to make it convenient, E.g. John Yoo and the torture memo.

  4. Kathy says:

    Suppose you had to carry or wear a device that tracked you, but only when your’e not at home. after all, out in public you don’t have an expectation of privacy, right? Anyone can see you on the street, the casino, a restaurant, movie theater, etc.

    I dare say over 90% of all people carry such a device already. We call it a cell phone.

    The good news is you can turn location tracking off. And, thinking about it, past using it with Waze or Maps to find a route or avoid traffic, there’s very little use for it.

  5. Teve says:

    A few years ago Bruce Schneier had an excellent essay or series of essays posted on his blog about how technology can make something so quantitatively different that it becomes qualitatively different. We wouldn’t mind having a cop stand on a street corner one day looking at everybody who walks by to see if he can spot Vic the wanted murderer, but if you replace the cop with 10,000 police cameras doing automated searches 24/7 for everyone with any kind of warrant, legally that’s not really any different but in practice it’s extremely different.

  6. James Joyner says:

    While you and I agree that a meter maid’s marking the tire of a parked car with chalk isn’t a “search,” I tend to side with SCOTUS and this judge that sufficiently-high-tech tracking can amount to a search.

    You’re right that, if I’m driving on a public street, I have no expectation that my license plate will go unobserved. If a cop notes that my decal is out-of-date, I’ll pay the fine and not complain that I was “searched.”

    But mass electronic tracking is a situation where a difference in degree becomes a difference in kind. It’s now gone from a cop doing his job to a massive surveillance operation. (Indeed, even in the case of the individual cop, it’s a very different thing if he happens to see I have an expired decal or inspection sticker than if he follows me around all day to see if I do anything wrong. I’d consider my civil rights to have been violated in the latter case.)

    I’ve long taken the same position with photo enforcement of speed limits and traffic lights. Although, in those cases, my chief objection is that I don’t have the right to confront the accuser (and that, by the time I get the ticket in the mail, I have no idea what the circumstances were).

  7. Gustopher says:

    @Kathy:

    The good news is you can turn location tracking off.

    At the very least, your cell phone company knows what tower you are connected to, and which other towers your phone is pinging.

    I’ve lost track of how much of the rest of the stories are Snowden revelations or fictional tv shows. Fake towers to get phones to ping them near a demonstration, real or fiction? I can’t remember. Pretty sure it’s real.

    This is why I leave my phone at home and ride a bicycle when I’m going out on a crime spree.

  8. Kit says:

    Allow dim-witted local cops access to basic data, and suddenly people are up in arms over privacy; allow the NSA billions of dollars, the countries top minds, minimal oversight, and a mission to suck up all data, and people are… indifferent. The average Joe hasn’t a clue about what’s really afoot.

  9. Kathy says:

    @Gustopher:

    At the very least, your cell phone company knows what tower you are connected to, and which other towers your phone is pinging.

    Yes, but that’s not directional. The phone company has to triangulate using other towers, which may not be possible at all locations. A ping from a single tower locates you within X kilometers radius of a tower.

    Of course, you can turn the phone off (pardon me while I laugh).

    Just the same, I’ve taken to switching location off when I’m not driving, and I’ve turned off history in Maps, too.

  10. Timothy Watson says:

    @Doug:
    I’ve been somewhat skeptical of this interpretation of Virginia’s Government Data Collection and Dissemination Practices Act. I am not sure how a license plate, time/location, and a photograph is personal information under the act, but the Supreme Court of Virginia apparently disagreed. I remember having a disagreement with a college professor when he brought it up several years ago. I was a civilian employee with the Virginia State Police at the time (I made it clear I was expressing my personal opinion) and the professor was something of a data privacy advocate.

    As for constitutional issues, I don’t think the Supreme Court of the United States has ever distinguished between, say, an individual officer writing down someone’s license plate number versus the bulk collection of data through an information system.

    P.S.: I hadn’t had a chance to post on here recently, but, Doug, it’s good to see you back!

  11. Tyrell says:

    Another car data collection issue that came up a few years ago is the “black box” that the car owners are not allowed access to. This is not the computer that sends out those “check engine” signals.
    Some state attorney generals were looking into this. Toyota Corporation says that those boxes are their property not the car owners. Of course if the car owner dares to tinker with the darn thing the car stops and you have to pay the dealer to get it going again.

  12. The abyss that is the soul of cracker says:

    @Kit: Yeah, but the NSA is part of the Federal Government–you know, the entity that vacillates between the power that is so magnificent that it can transform nations from feudal satrapies to full-fledged democracies [tm] and a bunch of nincompoops who’d not be “able to run a popcorn stand let alone 1/7th of the US economy.”

  13. Just nutha ignint cracker says:

    @Tyrell: It’s worse than you feared, Event Data Recorders have been around for over 20 years (cue–gasp, scream, gunshot, ominous organ music) link.

    Fortunately, you’ve overblown the problem in your mind and you can protect yourself from your own worst fears by reading what Kim Komando noted about the systems 5 years ago. (BTW, the problem isn’t that the owner “isn’t allowed” to have the data, it’s that most owners don’t have the training and the $2-20k necessary to retrieve and understand it.) Link

  14. DrDaveT says:

    @James Joyner:

    You’re right that, if I’m driving on a public street, I have no expectation that my license plate will go unobserved. If a cop notes that my decal is out-of-date, I’ll pay the fine and not complain that I was “searched.”

    Good. That’s sensible.

    But mass electronic tracking is a situation where a difference in degree becomes a difference in kind. It’s now gone from a cop doing his job to a massive surveillance operation.

    Wait, what? You would be OK with (literally) a cop on every corner, watching cars go by, but not with a machine doing that instead? Or is it that you think you have some kind of implied right to inefficient enforcement of the law? I seriously do not understand your argument.

    I will also note (and I’m sure y’all are getting tired of this argument, but nobody has yet bothered to rebut it) that a key word in the phrase “license plate” is license. The very act of driving a car on a public road involves you having agreed in advance to abide by all of the conditions of that license, in exchange for the privilege of operating a motor vehicle on public infrastructure. This is utterly unlike any other public privacy issue, in that it involves specific enforcement of the terms of a license, not general behavior in public.

  15. Matt says:

    @Gustopher: They are generally grouped under the term “stingray” which is an “IMSI catcher”. It’s a man in the middle attack that has popped up all over the place including the US capital…