A Virginia state judge ruled earlier this month that automated license plate data collection by police qualified as protected “personal information," and was illegal, because it included the following elements all combined: The license plate number, images of the vehicle and license plate and immediate surroundings, plus GPS location and time and date.
The value of multiple types of data that can be interpolated is greater than one form alone.
Here is the court's ruling [PDF Link].
EFF has done tons of work on this issue, and the EFF's Dave Maass wrote a great technology primer you should read if you're interested. Also, don't miss EFF's street-level surveillance FAQ.
From PrivacySOS:
The lawsuit dates back to 2015. That year, the American Civil Liberties Union of Virginia sued the Fairfax County Police Department on behalf of Harrison Neal. Through a public records request, Neal discovered that the Fairfax police department had collected data on his whereabouts using license plate readers. The police collected and maintained these records on Neal—and millions of other Virginians—even though they never suspected him of involvement in any criminal activity. The ACLU filed suit representing Neal, arguing that the police department’s collection and retention of information on his whereabouts for nearly a year violated Virginia’s Government Data Collection and Dissemination Practices Act, a state law controlling how government agencies in Virginia are allowed to collect, store, and share personal information about residents.
License plate readers are surveillance devices mounted on police vehicles or stationary objects like light poles or bridges. The cameras read and record every license plate that comes into their field of vision—as many as 3,600 plates per minute, or 216,000 an hour. Each time the cameras capture a license plate, they create a file containing an image of the car, the license plate number, and the time, date, and location where the surveillance occurred.
The ACLU has been sounding the alarm about the use of ALPRs all over the country since 2012. While some states have regulated their use, limiting the time police departments can retain non-derogatory information, most police departments use the systems to conduct both active and passive surveillance—that is, to actively search for cars connected to suspected criminal activity, and to collect and retain for long periods information about drivers who are not suspected of any crimes.
In this ACLU lawsuit in Virginia, the key question was whether the collection and storage of Neal’s license plate data without suspicion of any criminal activity was legal under Virginia state law. To determine if the surveillance violated that law, the ACLU had to prove two things. First, the ACLU had to demonstrate that the state data protection law applied to the police department’s collection of license plate reader data—specifically, that the records constituted personal information and that the license plate reader record keeping system was an information system as defined under the state law. Second, provided the law applied, the ACLU had to prove that the police department’s passive surveillance was not exempt from the law and that therefore the creation of the database violated it. To do that, the ACLU argued that this type of surveillance violated the law’s provision requiring a clear and established need to collect information.
Here's a good primer on ALPRs from the ACLU [PDF Link]
[via Eileen Clancy & onekade, Photo by Mike Katz-Lacabe (CC BY) via EFf.org.]
