There is now a legal challenge to Fairfax County’s methods of data stored by police with automated license plate readers. Although it was thrown out by a county judge in 2016, it has been given new life by the Virginia Supreme Court.
The court ruled that the photographs taken by the license plate readers constitute “personal information” that might not be legally retained by the police, depending on further investigation by the courts. Therefore, the case will ultimately determine how long a police department can keep the data the readers generate.
The license plate readers are used by law enforcement officers across the country, which take thousands of photos of license plates per hour and check their numbers against “hot lists” of stolen or wanted vehicles. As well, the readers also record the time and place the photo was taken and then store that information in a police-monitored database.
The American Civil Liberties Union (ACLU) argues that the data taken with the time and place attached is an invasion of privacy and gives police the ability to track a person’s movements.
Currently, fourteen states have laws addressing how the police shall maintain license plate data, according to the National Conference of State Legislatures, The Washington Post reports. Nine states have limits on the length of time the information can be retained – from three minutes in New Hampshire to three years in Arkansas. Virginia, however, does not have a law concerning the amount of time the data may be held.
In 2015, the Virginia General Assembly passed House Bill 1673, which would have limited the data retention to seven days.
The bill read:
“Government Data Collection and Dissemination Practices Act; collection and use of personal information by law-enforcement agencies. Provides that, unless a criminal or administrative warrant has been issued, law-enforcement and regulatory agencies shall not use surveillance technology to collect or maintain personal information where such data is of unknown relevance and is not intended for prompt evaluation and potential use regarding suspected criminal activity or terrorism by any individual or organization. The bill authorizes law-enforcement agencies to collect information from license plate readers, provided that such information is held for no more than seven days and is not subject to any outside inquiries or internal usage, except in the investigation of a crime or missing persons report. After seven days, such collected information must be purged from the system unless it is being utilized in an ongoing investigation. The bill also adds to the definition of “personal information” vehicle license plate numbers and information that affords a basis for inferring an individual’s presence at any place.”
Although there was wide bipartisan support for the measure, then-Governor Terry McAuliffe vetoed it.
Virginia’s Data Act states that there, “shall be no private information system whose existence is secret,” being maintained by the government. In 2013, then-Virginia Attorney General Ken Cuccinelli said that Virginia State Police could not legally keep the data collected from license plate readers.
Cuccinelli explained further that, “If the information is not directly related to a criminal case, it ‘may not lawfully be collected.'” The state police now erases license plate data every 24 hours.
However, other state agencies do not follow the same practice; some keep license plate data for up to two years.
According to the report, after an attempt to legislate a time limit failed, a legal representative from ACLU, on behalf of a motorist whose license plate had been captured twice, sued the Fairfax County Police Department. It was found that the Northern Virginia law enforcement department keeps the license data for at least one year.
In the end, Fairfax County Circuit Court Judge Robert Smith granted the county’s motion to dismiss the case. The judge explained that a “license plate number” is not included in the Commonwealth’s definition of “personal information.” Moreover, a license plate number, “does not tell the researcher where the person is, what the person is doing, or anything else about the person.” Though, license plate readers documented the time and place of the capture of data.
The ACLU appealed, but Virginia Supreme Court Justice Cleo Powell said the court agreed with Judge Smith that the plate number does not identify anyone, due to the fact that vehicles may be registered to more than one person or to a company.
Nevertheless, the state’s Supreme Court expanded its analysis to the full photos snapped by the license plate readers, which show the vehicle, its immediate surroundings, the time the photo was snapped, and location information. According to Judge Powell, the information would, “‘afford a basis for inferring personal characteristics’ or the presence of an individual at a certain place and time, which the Data Act prohibits.” Thus, the court concluded that the photos qualify as personal information.
However, the question that still remains is if the database of license plate numbers constitutes as an information system. The court was unsure.
The court did note that an officer with a license plate number can check the Department of Motor Vehicles (DMV) database to figure out the owner of a vehicle involved.
Judge Powell wrote further:
“Although the ALPR [automated license plate reader] database does not contain any information related to the individual to whom a specific license plate is registered…that does not mean that the total components of the Police Department’s ALPR record-keeping process do not provide a means for discerning that information.”
The court sent the case back to Fairfax to Judge Smith for further hearings on whether the Fairfax police’s, “retention and ‘passive use’ of information generated by ALPRs may be classified as an ‘information system’ governed by the Data Act.”
The Fairfax Police Department argued that they are exempt from the Data Act because of the act’s exclusion of law enforcement departments, “that deal with investigations and intelligence gathering related to criminal activity.” However, the court “strongly rejected” that claim.
Powell wrote:
“We conclude…that the Police Department’s sweeping randomized surveillance and collection of personal information does not ‘deal with investigations and intelligence gathering related to criminal activity,’ and therefore if the ALPR database is determined to be an information system, it is not exempt from the operation of the Data Act.”
Executive Director of Virginia’s ACLU chapter Claire Guthrie Gastañaga, said after the ruling that she was, “glad that the court recognized that an information system that links [license plate reader] information to the name of the vehicle owner would make subject to the [Data] Act…We don’t think that it will be difficult to establish that the system used by police results in the acquisition and storage of personally identifiable information subject to the Data Act.”
The court ruled that video captured by police which includes a location of the person is also considered personal information under the act. Regardless of how the court rules on license plates, such activity is now subject to scrutiny under the act and exposes agencies that engage in “‘just because, just in case’ surveillance” to use in potential future investigations and cases.
The ruling from Virginia’s Supreme Court can be read HERE.