Charles County Sheriff Senior Detective Charles Baker has two tiny cameras on the roof of a cruiser that automatically scans license plates. The information is processed on a computer. (James A. Parcell/For The Washington Post)

A Fairfax County judge on Monday ordered the Fairfax County police to stop maintaining a database of photos of vehicle license plates, with the time and location where they were snapped, ruling that “passive use” of data from automated license plate readers on the back of patrol cars violates Virginia privacy law. The ruling followed a related finding by the Virginia Supreme Court last year, meaning the case could affect how long — if at all — Virginia police can keep license plate data.

The ruling by Fairfax Circuit Court Judge Robert J. Smith is a victory for privacy rights advocates who argued that the police could track a person’s movements by compiling the times and exact locations of a car anytime its plate was captured by a license plate reader. Fairfax County Police Chief Edwin C. Roessler Jr. said Monday night that he would ask the county attorney to appeal the ruling.

The issue represents another front in the ongoing conflict over the use of emerging technologies by law enforcement. Police say they can, and have, used license plate location data to find dangerous criminals and missing persons. Privacy advocates don’t oppose the use of the technology during an active investigation, but they say that maintaining a database of license plate locations for months or years provides too much opportunity for abuse by the police. Last month, the ACLU disclosed that the federal Immigration and Customs Enforcement agency was tapping into a vast, national database of police and private license plate readers. Such private databases remain unregulated.

The Fairfax judge’s ruling applies only to the Fairfax police, but it may find a receptive audience, and have statewide impact, in the Virginia Supreme Court. Last year, the state supreme court reversed Smith when he threw the case out of court, finding that “the pictures and associated data stored in the police department’s . . . database meet the statutory definition of ‘personal information’” under Virginia’s “Data Act.” The court sent the case back to Smith to determine whether the database classified as an “information system” under the Data Act. Smith then ruled that it does.

The challenge to the practice was brought by the American Civil Liberties Union of Virginia on behalf of Harrison Neal, a Fairfax man whose license plate and location had been recorded at least twice by the police. The ACLU said Monday that it “welcomes this ruling in favor of our client, as this technology should not be used to monitor the comings and goings of people’s daily lives.”

An automated license plate reader, typically mounted on the back trunk of a patrol car, can snap hundreds of photos per minute of license plates while the car is moving. It then checks those plate numbers against a database of wanted cars, which might be stolen or suspected of being tied to a crime, and alerts the driver in seconds. But it also stores the time and location of when and where the photo was snapped.


Automated license plate readers, such as the ones shown here on the back of a Fairfax City police cruiser, can capture the license plates, time and location of thousands of vehicles per hour. (Tom Jackman/The Washington Post)

Nine states have passed laws limiting how long the police can maintain the data, ranging from three minutes (New Hampshire) to 90 days (Tennessee) to three years (Colorado), according to the National Conference of State Legislatures. Seven other states, including Maryland, have laws restricting the use and dissemination of license plate data but do not put a time limit on how long the data can be kept.

In Virginia, there is no law regarding license plate readers. But the “Data Act” states that “The Commonwealth or any agency or political subdivision thereof shall not collect personal information except as explicitly or implicitly authorized by law.” In 2013, the Virginia State Police asked then-state Attorney General Ken Cuccinelli II if, under that law, they could maintain license plate data. Cuccinelli issued an opinion saying they could not, and the state police have since purged their license plate data every 24 hours.

But The Washington Post found that other agencies around Virginia ignored the nonbinding attorney general’s opinion. Fairfax police keep the data for a year. Alexandria police keep it for two years. In 2015, a new bipartisan “Ben Franklin liberty caucus” was founded in the Virginia General Assembly, and a practically unanimous legislature passed a bill limiting the license data retention to seven days.

But then-Governor Terry McAuliffe, heeding the warnings of law enforcement that they needed the data to find criminals, vetoed the bill. License plate readers had been used by police in New York to help track down a man suspected of planting bombs in Manhattan months earlier, and police in Arlington, Va., found a 67-year-old man who had been missing for two days, and was near death, when his car was recorded blocks away from his residence.

After legislation failed, the ACLU sued in Fairfax, seeking an injunction against the “passive collection” of license plate data beyond an immediate need or existing criminal investigation. In 2016, Judge Smith granted Fairfax’s motion to dismiss the case, saying that “license plate number” is not included in the Data Act’s definition of “personal information.” Smith ruled that a license plate number “does not tell the researcher where the person is, what the person is doing, or anything else about the person.”

Then the Virginia Supreme Court agreed to hear the ACLU’s appeal. Last year, Justice Cleo E. Powell wrote that, while the plate number alone doesn’t identify anyone, the photo of the vehicle and its surroundings, as well as the time and place information, would “afford a basis for inferring personal characteristics” or the presence of a person at a certain place and time — “personal information,” the court found.

The Supreme Court sent the case back to Smith to determine if the license plate database is an “information system” as defined by the Data Act. Smith held a hearing in December to learn in detail how the system works. He found that officers can log into the license plate database to get information on a vehicle’s whereabouts, and then log in separately to the federal and state criminal information systems, or the state motor vehicle database, to discover the vehicle’s owner.

The license plate database “does enable police officers to cross-reference ALPR [automated license plate reader] data with the identity of an individual,” Smith wrote. “The Police Department’s ‘passive use’ of the ALPR system therefore violates the Data Act.”

“I respect the court’s ruling,” Roessler, the Fairfax police chief, said, “but I have asked the county attorney to exercise our right to appeal.”

Va. Sen. Chap Petersen (D-Fairfax), one of the founders of the privacy caucus and a sponsor of the failed legislation, said he was “very glad to see this ruling. I hope that Fairfax County appeals it to the Supreme Court so it can become a statewide ruling.” Chapman said there was “no need for the state to collect data by spying on unsuspecting citizens without a warrant.”

It was not immediately clear how the ruling would impact the Fairfax license database. Smith granted an injunction against its use, but gave both sides until Friday to submit an order on how it would be carried out.

“This case,” the ACLU said in its statement, “demonstrates that random mass surveillance by law enforcement agencies is not exempt from the requirements of” Virginia’s Data Act. “Although this decision applies only to Fairfax County, we hope police departments across the Commonwealth will take note and adjust their practices accordingly.”

Here is Smith’s ruling:

FxLPRruling0419 by on Scribd