A Virginia man with help from the American Civil Liberties Union is suing the Fairfax County Police Department, charging that Fairfax PD's habit of storing all license plate scanner data for a full year is not only a privacy rights violation, but also a violation of Virginia state law. The county posted a response on its website today.
Earlier this year, the Virginia State Senate and House of Delegates unanimously voted in favor of SB 965, also called the Government Data Collection and Dissemination Practices Act, which among other things would allow police to continue using Automatic License Plate Readers (ALPRs) to collect license plate data from vehicles on Virginia roads – but police would only be allowed to store those records for seven days, unless they were part of an active, ongoing criminal investigation.
Given the bills' overwhelming bipartisan popularity, observers expected Governor Terry McAuliffe would sign it into law. Instead, McAuliffe amended the bill's language so radically, the bill's author called it a “quasi-veto”: rather than require police to delete ALPR data after a week, it would allow cops to keep those records for 60 days.
McAuliffe's April action ultimately led to the ACLU of Virginia filing suit against Fairfax police the following month.
Claire Guthrie Gastañaga, Executive Director of the ACLU of Virginia, said “Governor McAuliffe had the opportunity to clarify that the Data Act prohibits law enforcement from collecting Virginians’ personal information unless there is a documented need and relevance established in advance. Instead, he chose to veto the legislation and left the ACLU of Virginia with no choice but to go to court to ensure that law enforcement follows the Data Act. While the facts of this case are focused on just one type of surveillance technology, the reasonable protections established in the Data Act apply equally to all surveillance technologies.”
The ACLU filed this suit along with Fairfax resident Harrison Neal, who is suing the police after discovering that his license plate data was scanned and entered into the police database twice, even though Neal is not the subject of any police investigation.
The mass collection and storage of ALPR data is not exclusive to Virginia, but growing ever-more common through most of the country. Last year, for example, a California man who filed a public records request learned the public record includes over 100 photos of the man's license plate in various locations — and photographs of the man's daughters standing in their own driveway.
At the same time, a California state legislator paid a private investigator to track his wife's whereabouts (presumably with her consent), and discovered the detective could, for a relatively small amount of money, pay to acquire her ALPR license-plate data to get a near-complete record of everyplace she drove and parked — including a particular gym 100 miles from her home.
And such data is being collected about every driver on every road where ALPRs are in operation, though the ACLU's lawsuit in Fairfax, Virginia is believed to be the first of its kind.
Today, Fairfax County responded to the ACLU's lawsuit by posting an announcement on the county government website:
On May 13, 2015, the Fairfax County Police Department and its chief, Edwin C. Roessler Jr., were served with a lawsuit (Neal v. Fairfax County Police Department, et al) that was recently filed in Fairfax Circuit Court challenging the Police Department’s use of Automatic License Plate Readers (ALPRs). The lawsuit does not challenge the “active” use of ALPR data, but only the “passive” use of ALPR data. … The Police Department retains the data for 364 days after which it is automatically purged unless it has become part of an active criminal investigation. Roessler strongly believes that retaining this data for 364 days serves a legitimate law enforcement purpose. This retention period is intended to increase protection of the community by providing an investigative tool to aid in the detection or investigation of terrorism or a series of related crimes. In fact, many other jurisdictions retain ALPR data for up to two years.
So Fairfax PD is basically saying that yes, it does record the whereabouts of every driver in the county and keeps these records for a whole year, but you shouldn't be disturbed by any privacy implications because the police think it's really useful and besides, other police departments hoard such data for even longer.
And it's true: other police departments and government agencies throughout the country do hoard such data. The state of California, for example, sets no legal limit on how long ALPR data can be kept. So in March, Ars Technica tried a little experiment with some disturbing results: it collected and analyzed four years' worth of ALPR data from Oakland, California as part of a public records request, and was able to deduce huge amounts of personal information about pretty much any resident of Oakland – or at least, any licensed driver in the city.
When license plate data records every place you park and drive, after all, it doesn't take Sherlock Holmes to deduce that the address where you park your car overnight every night might correspond to where you live, nor to figure out that the daytime address your car visits every Monday through Friday might have something to do with your job.
Neal's and the ACLU's lawsuit in Fairfax County, Virginia is almost certain to set a precedent nationwide. Whether that precedent helps or hinders privacy advocates – well, that's what the court will decide.