Court Says Virginia PD's Use Of Automatic Plate Readers Violates State's Data Privacy Law
Furnished content.
The ACLU has secured a win for privacy in Virginia after taking on the state law enforcement and their many, many automatic license plate readers.The state's ALPR track record isn't great. Law enforcement and other government agencies love the tech, even if they have a considerable amount of trouble showing that plate readers do anything more useful than catch property tax cheats. Law enforcement agencies have turned their plate readers on political rally attendees, raising First Amendment issues along with the usual privacy concerns.The ACLU attacked the state's use of plate readers using one of the state's own laws. According to the "Government Data Collection and Dissemination Act," the long-term collection of untargeted plate data was illegal. The state's attorney general even issued an official opinion to this end, pointing out that active collections seeking targeted plates was permissible, but passive collections with no end date and unrelated to ongoing investigations wasn't.That opinion -- issued in 2013 -- did nothing to alter law enforcement ALPR operations. A lawsuit followed when records requests showed plenty of passive collection was still taking place. The ACLU pointed out (again) these collections violated state law. Fairfax County Circuit Court judge Robert J. Smith agreed.In his 5-page opinion [PDF] granting the ACLU an injunction blocking the Fairfax County Police Department from engaging in passive, untargeted collections, the County Court agrees with the state Supreme Court's findings: the ALPRs are subject to the state data privacy law and the ALPRs -- despite law enforcement protests to the contrary -- collect protected personal info.The FCPD argued the passive license plate collection did not automatically connect plates to car owners. The additional steps officers needed to perform somehow exempted this collection from the state's data privacy law. The court disagrees, pointing to the part of the state law the FCPD decided to ignore when crafting its argument.
If the only issue before the Court was whether the link must be automatic to be found invalid, the defendant's position might well carry the day. However, the Data Act defines "information system" as:The total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject. Va. Code §2.2-3801 (emphasis added).The methodology here requires no less than two computer programs and three passwords. Such requirements, while perhaps cumbersome, do not necessarily preclude an establishment of a sufficient link under the Supreme Court's analysis and the Data Act.According to the court, these steps link the mass collections to individual people. While the plate readers may only collect plate and location info, the fact that this database is tied to others containing identifying info is enough to make the collection subject to privacy protections guaranteed by the state.
After reviewing the evidence presented at trial, I find that the ALPR system provides a means through which a link to the identity of a vehicle's owner can be readily made. The Police Department's "passive use" of the ALPR system therefore violates the Data Act. Accordingly, the petition for injunction is granted.This may only prevent the FCPD from passive ALPR collections but the state Supreme Court's ruling should have some effect on law enforcement's use of the tech across the state. No one else has been blocked from letting their ALPRs run day-and-night with no nexus to ongoing investigations, but that day will be coming. It might take a lawsuit to force the issue, but unless law enforcement lobbyists can pressure legislators into rolling back these privacy protections, the courts have made it clear ALPRs collect personal data in an indiscriminate fashion.
edit: Policy/auto___court_says_virginia_pd_s_use_of_automatic_plate_readers_violates_state_s_data_privacy_law.wikieditish...