Virginia Lawyers Weekly VA Lawyers Weekly
Pictures and associated data stored in a police department’s automatic license plate reader database are “personal information” under the Data Act, but further factfinding is required to determine whether the record-keeping process allows a license plate number to be linked to the vehicle’s owner.
Background
In 2014, Plaintiff Harrison Neal submitted a Virginia Freedom of Information Act request to the Fairfax County Police Department seeking its automated license plate reader records regarding his vehicle “with VA tag ADDCAR.” The Department responded, “Within the last 364 days [Neal’s] tag was read twice by [the Police Department’s] ALPR system” and sent Neal two sheets of paper, each containing pictures of his vehicle with the ADDCAR license plate affixed, and a chart showing the photographs’ time, date, and GPS location.
In a lawsuit filed in 2015, Neal sought to prohibit the Department from continuing to collect and store license plate data without suspicion of any criminal activity. Neal asserted that the Department’s “passive use” of ALPRs violates several provisions of the Data Act, including the requirement in Code § 2.2-3800(C)(2) that information not be collected “unless the need for it has been clearly established in advance” of collecting that information.
The Department later moved for summary judgment on the following undisputed facts:
The Department’s ALPRs use cameras, which can be stationary or mounted on a police vehicle, and which capture images of passing vehicles’ license plates. When the ALPR captures the image, an application converts the license plate image into an alpha-numeric combination, not state specific, that is compared in real time against a “hot list” of license plate numbers.
The Department operates an electronic ALPR database that stores the captured images; the alpha-numeric conversion of the license plate number; and the time, date, and location from which the image was captured (ALPR information) for 364 days. The ALPR database is an investigative tool to detect criminal activity or respond to other calls for service, including AMBER alerts and missing or endangered person alerts. The Department may access the ALPR database to assist in its criminal investigations as well as criminal investigations of other localities. The ALPR database may only be searched by license plate number and does not list the “make, model, year, or registration information” of a vehicle.
The ALPR equipment does not “photograph or otherwise identify the owner or driver of the vehicle” or capture his or her identifying information. The ALPR information concerning the ADDCAR license plate “did not contain Neal’s name, address, date of birth, or any information related to the individual to whom the ADDCAR license plate number was registered.” During the period that the ALPR information related to the ADDCAR license plate was stored, the Police Department was participating in two regional task forces involving the criminal investigation of burglaries in the region and used the ALPR database to support their investigative efforts.
Neal also moved for summary judgment. The circuit court granted the Department’s motion and denied Neal’s cross-motion. The circuit court found “that a license plate number is not personal information” as defined in the Data Act, noting that each example of “personal information” listed in Code § 2.2-3801’s definition referred to “an individual person” but a license plate number refers to a vehicle rather than a person. Having determined that there was no material issue of fact and that a license plate number is not personal information, the circuit court concluded that the Data Act did not apply and dismissed the case with prejudice. Neal appealed.
Personal information
There are two distinct types of information in the APLR database: the license plate numbers and the picture and data associated with each license plate number. Under Code § 2.2-3801, a license plate number may be deemed “personal information” in certain contexts because it is technically an “agency-issued identification number.” Therefore, in the context of the DMV database, a license plate number, such as “ADDCAR,” is an agency-issued number that identifies the owner of the vehicle, in this case Neal.
But in other contexts, a license plate number would not be “personal information” because there is nothing about it that inherently “describes, locates or indexes anything about an individual.” Without something connecting the license plate number to an individual, it’s just a combination of letters and numbers that does not describe, locate or index anything about anyone. Moreover, this combination of letters and numbers is only unique to the state issuing the license plate number. The alpha-numeric conversion of the license plate number in the ALPR database is not state specific. Therefore, a license plate number in the ALPR database could, theoretically, be associated with over 50 different vehicles.
Furthermore, unlike a social security number or a driver’s license number, a license plate number is assigned to a specific vehicle and identifies the owner of that vehicle, which may not be an individual. Indeed, a license plate number may identify multiple individuals or no individual at all. Accordingly, a license plate number stored in the ALPR database would not be personal information because it does not describe, locate or index anything about an individual.
On the other hand, the pictures and data associated with each license plate number constitute “personal information” as defined by Code § 2.2-3801. The images of the vehicle, its license plate, and the vehicle’s immediate surroundings, along with the GPS location, time, and date when the image was captured afford a basis for inferring personal characteristics, such as things done by or to the individual who owns the vehicle, as well as a basis for inferring the presence of the individual who owns the vehicle in a certain location at a certain time. The conclusion that the picture and associated data is “personal information” is consistent with the legislature’s intent to remedy the potential mischief posed by “the extensive collection, maintenance, use and dissemination of personal information” and the potential for misuse of such information.
Information system
Under Code § 2.2-3801, the Department’s “passive use” of its ALPRs, including the ALPR database, is a “record-keeping process” that includes data that contains “personal information,” in that the ALPR database captures and stores images of the vehicle, as well as the time, date, and GPS location when the images were captured. But it remains to be seen whether a sufficient link can be drawn to qualify a license plate number as an “identifying particular.” Although the ALPR database does not contain any information related to the individual to whom a specific license plate number is registered, that does not mean that the total components of the Department’s ALPR record-keeping process do not provide a means for discerning that information. However, this court cannot say whether or not such a means exists as part of the ALPR record-keeping process. Accordingly, the court will remand the matter to the circuit court for a determination of whether the total components and operations of the ALPR record-keeping process provide a means through which a link between a license plate number and the vehicle’s owner may be readily made.
Exemption
The Department admitted in its discovery responses that, at the time they captured and stored the ADDCAR ALPR information, it “ha[d] not been deemed part of any specific law enforcement investigation or purpose.” Accordingly, storing it didn’t have any “relation to” or “connection with” criminal activity. While the Department’s “passive use” of its ALPRs may deal with intelligence gathering for general law enforcement purposes, the Code § 2.2-3802(7) exemption only applies to the collection and maintenance of “personal information” related to some specified criminal activity.
This court agrees with the Attorney General’s opinion that the legislature didn’t exempt all “personal information systems” operated by law enforcement but only those that specifically pertain to investigations and intelligence gathering relating to criminal activity. The Department’s sweeping randomized surveillance and collection of personal information doesn’t deal with investigations and intelligence gathering related to criminal activity and, therefore, if the ALPR database is determined to be an information system, it is not exempt from the operation of the Data Act.
In sum, while the pictures and associated data stored in the Department’s ALPR database meet the statutory definition of “personal information,” the court cannot determine whether the Department’s retention and “passive use” of information generated by ALPRs may be classified as an “information system” governed by the Data Act. Accordingly, the judgment of the circuit court granting summary judgment is reversed and remanded for a determination of whether the total components and operations of the ALPR record-keeping process provide a means through which a link between a license plate number and the vehicle’s owner may be readily made. If such a means exists, then the Department’s “passive use” of ALPRs is not exempt from the operation of the Data Act under the law enforcement exception.
Reversed and remanded.
Neal v. Fairfax Cnty. Police Dep’t, Record No. 170247, Apr. 26, 2018. SCV (Powell), from Fairfax Cir. Ct. (Smith). VLW No. 018-6-032, 14 pp.
