UPDATE: On May 15, 2020, the Brennan Center, in conjunction with the Electronic Frontier Foundation, filed an amicus brief urging the Virginia Supreme Court to uphold the Fairfax County Circuit Court’s ruling that automatic license plate readers (ALPRs) are an “information system” under Virginia’s Government Data Collection & Dissemination Practices Act. Read the brief here.
Case Background:
Neal v. Fairfax County Police Department challenges the practice of retaining automated license plate reader data on drivers in Virginia without any suspicion of criminal activity. In 2017 the Brennan Center, in conjunction with the Electronic Frontier Foundation, filed an amicus brief urging the Virginia Supreme Court to consider the civil liberties implications of collecting and indefinitely storing the sensitive data generated by automated license plate readers.
Automated license plate readers (ALPRs) are small, high-speed cameras, typically mounted to the back of police cars or road signs, that record images of passing cars to identify and track license plate information. The images are then stored in a database alongside a time-stamp and location information.
Virginia’s Government Data Collection & Dissemination Practices Act restricts the retention of information that “describes, locates, or indexes anything about an individual.” In 2011, Virginia State Attorney General Ken Cuccinelli determined that ALPR data fell into this category, and prohibited state law enforcement agencies from “passively” collecting ALPR data – i.e., tracking every car that passes a reader and retaining the data for future investigative use. Police departments in Northern Virginia, however, including Fairfax County Police Department, have ignored the ruling. Harrison Neal, represented by the ACLU of Virginia, has sued to challenge the collection and retention of ALPR data by the Fairfax County PD.
The indiscriminate collection and retention of sensitive location information like ALPR data poses grave risks to civil liberties. Long-term storage of such information can create a virtual “time machine” of individual movements, ripe for abuse. A seemingly innocuous data point, such as a time-stamped image of a license plate, can become a powerful tool of surveillance when retained indefinitely and integrated with other disparate databases. Given rapid advances in technology and data storage in the last decade, courts and legislatures must take decisive action to protect individual privacy in the modern era.
The Virginia Supreme Court issued an order in this case on April 26, 2018. The Court found that “sweeping randomized surveillance and collection” of ALPR information, unrelated to any specific criminal investigation, does not qualify for a law enforcement exception to Virginia’s data protection laws; and remanded the case back to circuit court to better determine if individual vehicle owners can be identified within automated license plate reader databases. If the lower court determines that individual owners can be readily linked to the location information stored in the Fairfax County Police Department’s ALPR database, Fairfax County’s collection of this data will likely be ruled unacceptable under current Virginia law. Read the 2018 order here.
On April 1, 2019, the Fairfax County Circuit Court enjoined the Fairfax County Police Department from maintaining its automated license plate reader database in contravention of Virginia’s privacy law. The Court found that while the ALPR system itself does not “gather or directly connect to ‘identifying particulars’ of a vehicle owner,” the system enables police officers to easily connect the ALPR data with the identity of an individual within a matter of “a few clicks"; and therefore, found that the “passive use” of the ALPR system violates Virginia’s Data Act. Although the order only applies to the Fairfax County Police Department, the ruling may have state-wide effects for police departments who are considering adopting similar systems. Read the 2019 order here.
On October 22, 2020, the Supreme Court of Virginia dissolved the injunction ordered by the Fairfax County Circuit Court and ruled in favor of the Fairfax County Police Department. The Court found the circuit court’s ruling that the police department’s automated license plate reader system did not itself contain individuals names, personal numbers, or “identifying particulars” to be dispositive in its reading of the Government Data Collection & Dissemination Practices Act. Noting the Data Act’s reference to a “‘record-keeping process,’ singular,” the Court determined that the circuit court erred in including queries made of other sources in its evaluation of the ALPR system because the Data Act could not be read to hold the police department accountable for the databases maintained by other agencies. The Court further opined that the plaintiff-appellant’s argument “conflate[d] the ultimate goal of the ALPR system – accurately locating suspects or stolen vehicles – with the ALPR system itself.” Thus, despite the fact that the use of the ALPR system in conjunction with other easily accessible databases allows for the discovery of individuals’ “identifying particulars,” the Court found the Police Department’s suspicionless use of the ALPR system to be lawful. Read the Supreme Court’s final judgement here.
For more information on the Brennan Center’s research and advocacy efforts regarding government data, please see Hiding in Plain Sight: A Fourth Amendment Framework for Analyzing Government Surveillance in Public What the Government Does with Americans’ Data