Submit to Digest

Neal v. Fairfax County Police Department: Use of Automatic License Plate Reader Violates Data Privacy Law

Reports Privacy

RE: Neal v. Fairfax County Police Department, et al., Case No. CL-2015-5902

On April 1, the Virginia circuit court held Fairfax County Police Department’s (“FCPD”) use of the Automatic License Plate Reader (“ALPR”) to be a violation of the state’s Government Data Collection and Dissemination Practices Act, Virginia Code § 2.2-3800 et seq (“Data Act”). The Court granted the plaintiff’s petition for an injunction that prohibited the police from scanning and storing untargeted license plate data unless a license plate scan specifically related to investigations of suspected criminal activity.

According to the Court, since at least 2010, Fairfax County police have used ALPR technology, in the form of specialized cameras mounted on the back of patrol cars, to scan and maintain a database of license plate photos. In addition to the license plate numbers, the ALPR records the date, time, and location of each capture, and converts the image into text with optical character recognition technology. The reader system can process license plates at a rate of up to 3,600 plates per minute.

After recording the license-plate data, the ALPR automatically crosschecks the plates against a list of known license plates associated with suspected criminal activity. Regardless of whether a “hit” occurs, all captured data are stored for 364 days before being purged from the database. This is called “passive use.”

Under Virginia’s Data Act, recordkeeping agencies including the FCPD shall not collect and store personal information “unless the need for it has been clearly established in advance.” Va. Code § 2.2-3800(C)(2). In examining the information collected by the ALPR, the Supreme Court of Virginia held that “the pictures and data associated with each license plate number constitute ‘personal information’ as defined by [the Data Act].” While a license plate number alone “would not be ‘personal information’ because there is nothing about a license plate number that inherently ‘describes, locates or indexes anything about an individual,’ it could subject the ALPR system to the Data Act if the license plate number is used to identify the owner of the vehicle.” Neal v. Fairfax County Police Department, et al., 295 Va. 334, 345-6 (2018). The Supreme Court remanded the case to the Fairfax County Circuit Court, and instructed the lower court to determine “whether the total components and operations of the ALPR record-keeping process provide a means through which a link between a license plate number and the [identity of the] vehicle’s owner may be readily made.”

Fairfax County Circuit Court Judge Robert Smith heard the case on remand and held that, while the ALPR does not itself directly connect to a specific individual, police officers may access the ALPR system and other databases to determine a vehicle owner’s identity. “The methodology here requires no less than two computer programs and three passwords.” Smith wrote in his opinion. “ Such requirements, while perhaps cumbersome, do not necessarily preclude an establishment of a sufficient link” between a license plate and the vehicle owner. “The Police Department’s ‘passive use’ of the ALPR system therefore violates the Data Act.” Smith concluded. “Accordingly, the petition for injunction is granted.”

This decision is a victory for data privacy rights advocates in the ongoing conflict over the use of digital technologies by law enforcement. The ALPR technology can help, and has helped, police locate criminals or missing persons. While privacy advocates don’t oppose the use of the technology in all cases, they worry about untargeted mass surveillance because it can provide too much opportunity for abuse by the police. For example, advocates have been concerned about the US Immigration and Customs Enforcement’s access to an ALPR database containing more than six billion data points of location information, which the ACLU of Northern California recently revealed.

In the 2015 Virginia General Assembly, nearly unanimously passed a bill limiting the license data retention to seven days, but then-Governor Terry McAuliffe vetoed the bill for concerns that law enforcement needed the data to find criminals.

After the Court’s decision, the FCPD defended its use of ALPR, claiming it has been instrumental in resolving Amber and Silver alerts. “I respect the court’s ruling,” Fairfax County Police Chief Edwin Roessler Jr. said, “but I have asked the county attorney to exercise our right to appeal.”