Automated license plate readers, such as the ones shown here on the back of a Fairfax City police cruiser, can capture the license plates, time and location of thousands of vehicles per hour. (Tom Jackman/The Washington Post)

Police in Virginia may indefinitely keep data from automated license plate readers, noting the time and place where a car was photographed by police, the Virginia Supreme Court ruled Thursday. The court ruled that simply storing license plate numbers and photos of cars does not constitute “keeping” data because officers must connect to a separate database from the state Department of Motor Vehicles or other criminal databases to link a license plate with a name.

The ruling ends a five-year legal battle by the American Civil Liberties Union to force Virginia police to purge their databases of license plate data and photos because of the possibility that such data could be used to track residents’ movements. Virginia State Police already purge their database of license data after 24 hours, on the advice of former attorney general Ken Cuccinelli. But other police agencies in the commonwealth keep the information for up to two years, saying it can be used to solve crimes and find missing people by tracking the locations of vehicles.

The Fairfax County police, who keep license plate data for a year, were the defendants in the case and welcomed the decision. Fairfax County Police Chief Edwin C. Roessler Jr. said his department “will continue to provide the highest level of ethical service to our communities while safeguarding the privacy and constitutional rights of all that we serve.”

Police have cited examples of cases in which they were able to locate violent criminals who weren’t staying at their known residences but whose cars were photographed elsewhere and to find elderly or medically compromised people who were reported missing. Civil liberties advocates have cited cases in which police or politicians have abused the database to track people for improper purposes.

The issue is likely to be revisited by the Virginia General Assembly, which is wrapping up a special session focused in part on police oversight. After the existence of the police license plate databases was revealed by The Washington Post in 2014, a bipartisan coalition of privacy advocates pushed a law through both houses of the General Assembly that would have imposed a seven-day limit on how long police could keep the data. But then-Gov. Terry McAuliffe (D) vetoed the bill, at the urging of police and prosecutors, saying it had been rushed through the legislature and needed more study.

State Sen. Chap Petersen (D-Fairfax City), who introduced the 2015 bill, said he would revive the legislation in the General Assembly session in January. “If taken to its logical conclusion,” Petersen said of the Supreme Court’s ruling, “state or local agencies can collect and hold personal data indefinitely, as long as they keep it in separate databases with separate passwords. That misses the point of the Data Act, which is to prevent ‘the government’ from holding your personal information. Whether or not it can be shared within the government is not relevant, at least in my view.”


A terminal inside police cars can alert officers when the car's automated license plate readers have captured a wanted vehicle. The officer must then query a motor vehicle or criminal database to confirm that the car is wanted. (James A. Parcell)

After McAuliffe’s veto, the ACLU in 2015 challenged Fairfax County’s retention of the license plate data, with a plaintiff whose license plate had been photographed twice and kept in a Fairfax database. The plaintiff, Harrison Neal, had filed a freedom of information request with the Fairfax police inquiring about what records they had of his vehicle, and he was sent two photos of his car and license plate, with the time and place the photos were taken.

Virginia’s Data Act states that within government agencies in the state, “There shall be no personal information system whose existence is secret” and “Information shall not be collected unless the need for it has been clearly established in advance.”

During the case’s long legal journey, a Fairfax judge first ruled that the license plate data didn’t qualify as “personal information” because it didn’t provide a person’s name. The ACLU appealed, and the state Supreme Court sent the case back to Fairfax Circuit Court Judge Robert J. Smith, who then ruled that cross-referencing the license data with the other databases did violate the Data Act. The Fairfax police appealed, and the court ruled Thursday that “having access to data is not the same as ‘keeping’ it.”

“The court is saying it’s just fine,” said Claire Gastanaga, executive director of the ACLU in Virginia, “for police departments to engage in mass surveillance and indefinite retention of data, and share it across agencies with no limit. Since it’s multiple agencies, somehow it’s not covered. As long as Fairfax shares it and it can all be accessed in one place, it’s not a ‘system’ because it’s outside the agency.”

Gastanaga said the Virginia General Assembly should revisit the issue, but she also suggested that civilian review boards of local police, newly enacted by the legislature in its special session, should step up, as well. “These boards should consider reviewing policies,” Gastanaga said, “and begin a conversation about how people should want to be policed, to tell their department that this kind of unlimited passive collection of private information and data should stop. And, at a minimum, retention time should be limited.”

The ruling was written by Justice Stephen R. McCullough, who was elected to the state Supreme Court by a Republican-controlled General Assembly in 2016 after it ejected Justice Jane Marum Roush of Fairfax from the bench in a political squabble with McAuliffe. Previously, McCullough had worked in the state attorney general’s office under Cuccinelli, who issued an advisory opinion to the state police in 2013 saying that keeping the license plate data violated the Data Act.

Automated license plate readers are cameras, typically mounted on the back of police cars, that can photograph hundreds of license plates per minute, whether on a highway, a neighborhood street or a parking lot. The reader’s software then digitizes the license number and checks it against a “hot list” of stolen cars or other vehicles wanted for criminal or missing-person cases. It also notes the time, date and place where the photo was taken.

When the reader spots a stolen car, it alerts the officer, who must sign into a DMV database, or the state or national criminal information database, to confirm that the car is wanted and the name of a possible suspect. It is that action — switching from the local license plate database to the state or national database of people and suspects — that provided a crucial distinction for the Supreme Court, even though the officer uses the same computer to access both the local police database and the DMV and crime databases.

The local police license plate database “does not contain ‘the name, personal number, or other identifying particulars of an individual,’” McCullough wrote, citing the definition of “information system” in the Data Act. “Although other databases maintained by other agencies can allow the Police Department to learn ‘the name, personal number, or other identifying particulars of a data subject,’ the ALPR system does not. Therefore, the Police Department’s passive use of the ALPR system is lawful under the Data Act.”

McCullough noted that the court’s “task is not to reach the right public policy balance by weighing competing demands for efficiency and security against considerations of privacy. Our duty is more modest: we must determine from the text and structure of the Data Act where the legislature has drawn the line.”

L. Steven Emmert, a Virginia Supreme Court analyst, read that conclusion by McCullough and reluctantly agreed with him. “I’m a strong proponent of personal-privacy rights,” Emmert wrote. “I wholly dislike these automated readers, which I see as a form of Big Brother surveillance.” But he said McCullough limiting the decision to the text of the Data Act is “absolutely right, and I (perhaps grudgingly) find no fault with the analysis in his opinion today.”

Sixteen states have laws governing the use and retention of license plate data by police, according to the National Conference of State Legislatures, with a wide variety of requirements. Maine requires the data to be purged within 21 days, Georgia within 30 days, while Colorado allows retention for three years. In New Hampshire, license plate data “shall be purged from the system within 3 minutes of their capture, unless the number resulted in an arrest, a citation or protective custody or identified a vehicle that was the subject of a missing or wanted person broadcast.”

But some, such as Maryland and Minnesota, do not address retaining the license plate data. And there is very little regulation of license plate readers operated by private entities, such as towing companies or private security firms, which may create their own databases and then sell access to them.