Automated license plate readers, such as the ones shown here on the back of a Fairfax City police cruiser, can capture the license plates, time and location of thousands of vehicles per hour. (Tom Jackman/The Washington Post)

A challenge to the Fairfax County police storage of data collected by automated license plate readers, thrown out by a county judge in 2016, was revived by the Virginia Supreme Court on Thursday. The court ruled that the photos snapped by the readers constitute “personal information” that might not be legally retained by the police, depending on further investigation by the courts. The case could ultimately affect every police department in Virginia that uses the license plate readers, in terms of how long they can keep the data the readers generate.

The license plate readers are used by police departments across the country, often placed on patrol cars to snap thousands of photos of license plates per hour and check their numbers against “hot lists” of stolen or wanted vehicles. The readers also record the time and place the photo was taken, and then store that information in a database, which groups such as the American Civil Liberties Union argue is an invasion of privacy giving police the ability to track a person’s movements. Police have used the information to link vehicles to crime scenes and to find missing people.

Fourteen states have laws addressing how the police shall maintain license plate data, according to the National Conference of State Legislatures, and nine of those states impose limits on the length of time it can be kept, from three minutes (New Hampshire) to three years (Arkansas). Virginia has no such law. The General Assembly in 2015 passed a bill that would have limited the data retention to seven days, but then-Gov. Terry McAuliffe (D) vetoed it.

Virginia already has the Data Act, which says that there “shall be no private information system whose existence is secret” and maintained by the government. In 2013, the Virginia State Police asked the then-state attorney general, Ken Cuccinelli (R), whether they could legally keep license plate reader data.

Cuccinelli said no. If the information is not directly related to a criminal case, it “may not lawfully be collected,” the attorney general opined. The state police now purge their license plate data every 24 hours.

But The Washington Post found that other agencies in the state disregarded Cuccinelli’s nonbinding opinion and continued to keep the data for up to two years. After an attempt to legislate a time limit failed, the ACLU, on behalf of a motorist whose license plate had been captured twice, sued the Fairfax County Police Department, which keeps the license data for one year.

After hearings, Fairfax County Circuit Court Judge Robert J. Smith granted the county’s motion to dismiss the case in 2016. He noted that “license plate number” is not included in Virginia’s definition of “personal information” and that a license plate number “does not tell the researcher where the person is, what the person is doing, or anything else about the person.”

A Charles County, Md., Sheriff’s Office car equipped with automatic license plate readers on the back sends information to the in-car terminal, above, which checks it against a “hot list” of stolen cars and other wanted vehicles. (James A. Parcell for The Washington Post)

The ACLU appealed, and the state Supreme Court agreed to hear the case. In an opinion written by Justice Cleo E. Powell, the court agreed with Smith that the plate number does not identify anyone, in part because vehicles might be registered to more than one person or to a company.

But the Supreme Court expanded its analysis to the full photos snapped by the license plate readers, which show the vehicle itself and its immediate surroundings, as well as the time and place information. That would “afford a basis for inferring personal characteristics” or the presence of an individual at a certain place and time, which the Data Act prohibits, Powell wrote. The photos qualify as personal information, the court concluded.

But does the database of license plate numbers qualify as an information system? The court wasn’t so sure. They noted that an officer with a plate number can then check the Department of Motor Vehicles database to figure out whose vehicle is involved. “Although the ALPR [automated license plate reader] database does not contain any information related to the individual to whom a specific license plate is registered,” Powell wrote, “that does not mean that the total components of the Police Department’s ALPR record-keeping process do not provide a means for discerning that information.”

The court sent the case back to Smith for further hearings on whether the Fairfax police’s “retention and ‘passive use’ of information generated by ALPRs may be classified as an ‘information system’ governed by the Data Act.”

Fairfax police also argued that they are exempt from the Data Act because it excludes police departments “that deal with investigations and intelligence gathering related to criminal activity.” The court strongly rejected that claim. “We conclude,” Powell wrote, “that the Police Department’s sweeping randomized surveillance and collection of personal information does not ‘deal with investigations and intelligence gathering related to criminal activity,’ and therefore if the ALPR database is determined to be an information system, it is not exempt from the operation of the Data Act.”

Claire Guthrie Gastañaga, executive director of the Virginia ACLU chapter, said she was “glad that the court recognized that an information system that links [license plate reader] information to the name of the vehicle owner would make subject to the [Data] Act. … We don’t think that it will be difficult to establish that the system used by police results in the acquisition and storage of personally identifiable information subject to the Data Act.”

She also noted that the Supreme Court “has ruled that video capturing a person’s location is personal information under the act. Such activity — regardless of how the court rules on license plates — is now subject to scrutiny under the act and exposes agencies that engage in ‘just because, just in case’ surveillance to potential future litigation under the act.”

Fairfax County spokesman Tony Castrilli said that “the court sent the case back to the Fairfax County Circuit Court for trial on the narrow question of whether the FCPD’s license plate reader database is an ‘information system’ as defined in the act. With the upcoming trial, this case is still in litigation and therefore neither the county nor the FCPD are at liberty to comment any further at this time.”

Here is the state Supreme Court’s ruling: