By Jay Stanley, Senior Policy Analyst, ACLU national Speech, Privacy, and Technology Project
When the police keep records of the times and places where our cars have been spotted by an automatic license plate reader, does that implicate our privacy? That question lay behind an important victory that the ACLU won on Thursday in the Virginia Supreme Court.
It might seem obvious that license plate data threatens our privacy. Automatic license plate readers (ALPRs) have the ability to capture location data that can reveal details about Americans’ religious, sexual, political, medical, and associational activities. Yet we have seen repeated efforts around the country to claim that license place information does not constitute “personally identifiable information” and so is not worthy of the kind of privacy protection that such information deserves.
The Virginia case involved a challenge to the collection of ALPR data under a Virginia privacy law called the “Government Data Collection and Dissemination Act,” which says that personal information “shall not be collected” by state agencies “unless the need for it has been clearly established in advance.” The Virginia court ruled that police license plate data collection is not exempt from the requirements of this law.
In 2013, the (conservative) former Virginia attorney general Ken Cuccinelli issued a strong official advisory opinion stating that under the law, “active” use of an ALPR to identify vehicles that were already involved in wrongdoing was permissible, but that “passive” use of the devices to sweep up raw location data about Virginia residents was not permissible. Nevertheless, in 2014 Harrison Neal, a Virginia resident, found that the Fairfax County Police Department was doing just that, and asked the ACLU of Virginia to file suit challenging the practice on his behalf.
One of the arguments that the Fairfax County police made in its defense was that a “license plate number is not personal information.” The department argued that a license plate tag is associated with a vehicle, not with a person, and a vehicle can be driven by multiple people. A plate number, it argued, “says absolutely nothing about an individual, his personal characteristics… or his membership in an organization.” It argued that its ALPR equipment does not “photograph or otherwise identify the owner or driver of the vehicle,” and that its ALPR database can only be searched by plate number.
But obviously a license plate number should be considered personally identifying information. While in some ridiculously literal sense it may not describe a person, it functions as an effective “index” that allows law enforcement to learn facts (and potentially very intimate ones) about a person with the click of a mouse. There are 268 million registered vehicles in the United States, but only 221 million licensed drivers, which strongly supports the common sense observation that most vehicles, most of the time, are driven by the same person, or at most a handful of family members. Even if there is some fuzziness at the margins about who exactly may have been driving a car in a particular instance, there is a strong assumption that it was the vehicle’s registered owner. Most people do not loan out their cars often, if ever. Even when it comes to corporate vehicle fleets, a plate number and time of day combined with a fleet owner’s records is probably enough to identify a driver.
Nor does the police department’s argument hold any weight that the ALPR database itself does not contain names or other personally identifiable information. The department pretends that databases exist in isolation, rather than being distributed across increasingly cross-referenced and interlinked sets of data. In fact, the Virginia Supreme Court could not find information in the record about how the police can link plate numbers with vehicle owners, so in its ruling it sent the case back to the lower court for fact-finding on that question. But is there any doubt that if the police want to identify the owner of a vehicle captured by an ALPR device, they can easily do so?
Virginia’s data act defines “personal information” as including “all information that… affords a basis for inferring personal characteristics.” It’s becoming easier and easier to connect separate sets of data about people, and data scientists are getting increasingly good at inferring things through fancy analytic techniques. So it’s good that Virginia’s privacy law includes that language, because hidden inferences will likely become an ever-growing threat to privacy.
But no sophisticated analytics are necessary to cross-reference “vehicle location data” and “registered vehicle owner” datasets, or to understand that license plate location data is “personally identifiable” and a threat to privacy. The fact that the Fairfax County police made these arguments is a reminder that law enforcement and security agencies will push the interpretive flexibility of language past its limits when they want to preserve their power — something we've also seen with the National Security Agency. Drafters of privacy-protecting rules everywhere, take notice.
