VIRGINIA: IN THE CIRCUIT COURT OF THE COUNTY OF FAIRFAX HARRIS ON NEAL, Plaintiff, v. I Civil No. FAIRFAX COUNTY POLICE DEPARTMENT and COLONEL EDWIN C. ROESSLER, JR., Chief of Police, Fairfax County Police Department. Defendants. COMPLAINT Introduction 1. This is an action for an injunction and/0r writ of mandamus under the Government-Data Collection and Dissemination Practices Act, Va. Code 2.23800 et seq. (the ?Data Act?), a statute that was designed to prevent government agencies from unnecessarily collecting, storing, or disseminating the personal information of individuals. Defendants Fairfax County Police Department (FCPS) and its Chief of Police have violated the statute by using Automated License. Plate Readers (ALPRs) to scan tens or hundreds of thousands of license plates of vehicles not suspected of any involvement in criminal activity, along with the date and location at which the plate was scanned, storing the data for one year, and sharing the data with other law enforcement agencies in the District of Columbia metmpolitan area. The defendants? massive ALPR database allows the department, and the law enforcement agencies with which it shares data, to determine whether particular vehicles have been in the Vicinity of, for example, particular churches, political rallies, or doctors? offices, undermining the privacy of the drivers of those vehicles. The plaintiff, a resident of Fairfax County whose license plate data has been collected at least twice by the defendants, respectfully requests an injunction and/or writ of mandamus prohibiting the defendants from continuing to violate the Data Act. Jurisdiction and Venue 2. Jurisdiction and venue are prOper in this Court pursuant to Va. Code 22?3809, because plaintiff Harrison Neal resides in Fairfax County and because defendant Fairfax County Police Department has a place of business in Fairfax County. Parties 3. Plaintiff Harrison Neal is an adult resident of Fairfax County, Virginia. 4. Defendant Fairfax County Police Department (FCPD) is an agency of Fairfax County, Virginia, and the primary law enforcement agency for Fairfax County, Virginia. 5. Defendant Colonel Edwin C. Roessler, is the Chief of Police Fairfax County Police Department. As such, he is in command of the FCPD and makes rules and regulations concerning the operation of the FCPD and the conduct of its officers and employees. Fairfax Cnty. Charter Sec. 10.3. Factual Allegations 6. An ALPR (sometimes referred to as an is a device that automatically records every license plate that comes into its ?eld of vision, along with the date, time, and location at which the record was made. It is capable of recording thousands of license plates per minute. ALPRs are often mounted on police vehicles or on stationary objects. 7. Broadly speaking, law enforcement agencies use ALPRs in two ways. First, the agency may maintain a ?hot list? of license plate numbers, which may include the plates of vehicles that have been reported missing or that are suspected of involvement in a crime. Every time the ALPR scans a license plate, the scan is automatically checked against the hot list, so that target vehicles may be quickly identi?ed. The plaintiff does not challenge this type of use of ALPRs, which is sometimes called ?active? use. 8. . Second, law enforcement may save the data associated with every license plate scan and store it in a large database. The database may later be queried to determine whether a particular vehicle was seen at a particular date and time at a particular place. This use of ALPRs, sometimes called ?passive,? violates the Data Act. Defendants? Use of ALPRs 9. Since at least 2010, the Fairfax County Police Department has possessed one or more ALPRs. The equipment was provided to the FCPD by Arlington County, Virginia as part of a grant from the United States Department of Homeland Security. Arlington County was the administrator of the grant, which was intended to provide ALPR equipment to participating law enforcement agencies in the Washington, DC. area. 10. Pursuant to FCPD SOP 11-039, adopted in January 2010 and, upon information and belief, still in effect, the FCPD uses its ALPRS in both an ?active? and a ?passive? manner. (A cepy of SOP 11-039 is attached as Exhibit A and is fully incorporated herein.) 11. With respect to the ?passive? use of ALPRs, the policy states: generated data will be maintained on the server for a period not to exceed 365 days without specific authorization of the Chief of Police. The purpose of the retention period is to increase protection of the community by providing an investigative tool to aid in the detection or investigation of terrorism or a series of related crimes.? 12. Additionally, the FCPD is a party to a Memorandum of Understanding among an unknown number of law enforcement agencies in the Washington, DC. area pertaining to the sharing of ALPR data. Under the MOU, each participating agency agrees to allow every other participating agency to access its ALPR database for law enforcement purposes. 13. On or about May 9, 2014, plaintiff Neal submitted a request to the FCPD seeking all ALPR records related to a particular license plate number for a vehicle that he owns. In response, on May 15, 2014, the FCPD sent Neal a letter stating that ?[w]ithin the last 364 days, your tag was read twice by our ALPR syStern.? 14. The response from FCPD also included two sheets of paper, each of which had two pictures of Neal?s vehicle and a chart indicating the time, date at which the photographs were taken. Each chart also includes the words ?Mason 4866.? Upon information and belief, ?Mason 4866? designates the specific ALPR device that took the photographs. The response also included a map on which a particular location is marked, which Neal assumes is the location at which the device is or was mounted. (The entire response from FCPD is attached hereto as Exhibit and is fully incorporated herein.) 15. The location depicted on the map included in the FCPD response is one that Neal drives past frequently in the course of his employment and for other purposes. Application of the Data Act to Defendants? Use of ALPR 16. The Data Act governs the collection, storage, and dissemination of ?personal information? by government agencies. 17. The Data Act de?nes ?agency? in relevant part as ?any agency, authority, board, department, division, commission, institution, bureau, or like governmental entity . . . of any unit of local government including . . . counties . . . and the departments thereof." Va. Code 2.2? 3801. FCPD is an ?agency? as de?ned by the Data Act. 18. The Data Act de?nes ?personal information? in relevant part as information that ?describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver's license number, agency?issued identi?cation number, student identification number, real or personal property holdings derived from tax returns, and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record.? Va. Code 2.2?3801. 19. License plate numbers are ?personal information? under the Data Act because they are indeited to vehicle owners? social security numbers, driver?s license numbers, addresses, vehicle liens, dates of birth, and photographs in Department of Motor Vehicles databases readily accessible to law enforcement agencies. 20. The Data Act requires agencies that collect personal information to adhere to certain ?principles of information practice,? including the following: 0 Information shall not be collected unless the need for it has been clearly established in advance. I Information shall be appropriate and relevant to the purpose for which it has been collected. 0 There shall be a clearly prescribed and uncomplicated procedure for an individual to correct, erase or amend inaccurate, obsolete or irrelevant information. Va. Code (3), (9). None of these conditions are met with respect to the 3? defendants passive? use of ALPRs. 21. The Data Act also requires agencies to adhere to certain administrative requirements for information systems including personal information, including the following: - Collect, maintain, use, and disseminate only that personal information permitted or required by law to be so collected, maintained, used, or disseminated, or necessary to accomplish a proper purpose of the agency; Collect information to the greatest extent feasible from the data subject directly; 0 Maintain a list of all persons or organizations having regular access to personal information in the information system; Maintain for a period of three years or until such time as the personal information is purged, Whichever is shorter, a complete and accurate record, including identity and purpose, of every access to any personal information in a system, including the identity of any persons or organizations not having regular access authority but excluding access by the personnel of the agency wherein data is put to service for the purpose for which it is obtained, Upon information and belief, none of these conditions are met with respect to defendants? database of ALPR information. Va. Code (2), (5), (6), (7). 22. The Data Act sets forth certain rights of ?data subjects,? defined as ?an individual about whom personal information is indexed or may be located under his name, personal number, or other identi?able particulars, in an information system.? Va. Code 22?3801. 23. Harrison Neal is a ?data subject? as de?ned by the Data Act. 24. Among other things, agencies maintaining personal information must g]ive notice to a data subject of the possible dissemination of part or all of this information to another agency, nongovernmental organization or system not having regular access authority, and indicate the use for which it is intended . . Va. Code Neal did not receive such notice. 25. The Data Act provides that ?[e]very agency shall make report of the existence of any information system that it operates or develops that shall include a description of the nature of the data in the system and purpose for which it is used. An inventory listing or similar display of the information shall be made available for inspection by the general public in the office of the head of each agency. Copies of the information shall be provided upon reduest and a fee shall be charged for them suf?cient to cover the reasonable costs of reproduction.? Va. Code 22?3807. Upon information and belief, no such report exists with respect to the defendants? database of ALPR information. 26. On February 13, 2013, then?Attorney General of Virginia Kenneth T. Cuccinelli, 11, issued a legal opinion on the use of ALPRs by Virginia law enforcement agencies (the ?Legal Opinion?). The Legal Opinion was issued in response to a request by the Superintendent of the Virginia State Police, Colonel W.S. Flaherty. A copy of the Legal Opinion is attached hereto as Exhibit C. 27. The Legal Opinion advises Colonel Flaherty that the ?active? use of ALPRs is permissible under the Data Act, but that the ?passive? use of the technology is prohibited by that statute. 28. The Legal Opinion notes that data collected with ALPRs is ?personal information? as defined by the Data Act. Additionally, ALPR data collected and stored in a ?passive? manner does not fall within the Data Act?s exemption for information systems ?[rn]aintained by . . . police departments of cities, counties, and towns . . . and that deal with investigations and intelligence gathering relating to criminal activity.? Va. Code 22?38020). 29. The Legal Opinion further advises that the ?passive? collection and storage of ALPR information violates the Data Act because the need for such information has not been ?clearly established in advance,? as required under Va. Code Va. Code Rather, the information?s ?future value to any investigation of criminal activity is wholly speculative.? 30. Following the issuance of the Legal Opinion, the Virginia State Police ceased using its ALPR equipment for ?passive? data collection, and purged its database of any information so collected that was not directly related to a criminal investigation. 31. Notwithstanding the Legal Opinion and the actions of the Virginia State Police in re5ponse to the Legal Opinion, the defendants and other Northern Virginia law enforcement agencies who are parties to the MOU continued to use their ALPR equipment for the purpose of ?passive? data collection, to store such information in databases, and to make such information available to other parties to the MOU. Cause of Action Violation of the Data Act, Va. Code 2.2-3800 et seq. 32. Plaintiffs are ?aggrieved persons? entitled to relief pursuant to Va. Code 2.2- I 3809. 33. The defendants? collection, storage, and dissemination of ?passively? collected ALPR data, including personal information about the plaintiffs that has been, and likely will be in the future, collected and maintained in defendant?s ALPR database, violates the Data Act. Request for Relief For the foregoing reasons, plaintiffs request the following relief pursuant to Va. Code 2.2-3 809: A. An injunction and/or a writ of mandamus prohibiting the defendants from using ALPR equipment for the ?passive? collection of license plate information, and requiring the defendants to purge all databases containing all ?passively? collected license plate information; B. Plaintiffs? costs and reasonable attorneys? fees for pursuing this action; and C. Such other relief as this Court deems just and preper. Dated: May 4, 2015 Res ctfully submitted: rte/x Rebecca K. Glenberg (VSB No. 44099) Hope R. Amezquita (VSB No. 74629) American Civil Liberties Union Foundation of Virginia, Inc. 701 E. Franklin St., Suite 1412 Richmond, VA 23219 (804) 644-8080 Facsimile: (804) 649-2733 rglenberg@acluva.org hamezquita@ac1uva.org RULE CERTIFICATE Pursuant to Rule of the Rules of the Supreme Court of Virginia, counsel for plaintiff certi?es that plaintiff?s clairh for attorneys? fees arises from the Government Data Collection and Dissemination Practices Act, Va. Code 22?3809, which provides: ?In the case of any successful proceeding by an aggrieved party, the agency enjoined or made subject to a writ of mandamus by the court shall be liable for the costs of the action together with reasonable attorneys' fees as determined by the court.? Dated: May 4, 2015 Rebecca K. Glenberg Attorney for Plaintiff 10 I a I Automatic License Plate Readers o1~01-11 i l. PURPOSE The purpose of this SOP is to establish speisi?c procedures pertaining to the operating guidelines, maintenance, data retention, storage, access, release of information, and the responsibilities relevant to the use and operation of Automatic License Plate Readers (ALPR) and associated, data. The ALPR Program will be housed and coordinated by the Commanderiof Patrol Bureau Division I, with technical assistance from the Information Technology Bureau and Resource Management Bureau. 5 II. POLICY The use of ALPR technology is intended as a tool for law enforcement to identify stolen license plates and vehicles or any vehicle identi?ed as having a speci?c interest to law enforcement. It shall be the policy of the Fairfax County Police Department to use ALPR technology for law enforcement functions that will detect criminal activity and promote the health. safety and welfare of Fairfax County residents and visitors. This technology shall be: used in a manner consistent with legal and constitutional limitations, privacy cjoncerns and the highest ethical standards. Ill. DEFINITIONS ALARM (aka hit): A positive indication or ?hit? by audio and/or visual signal, of a potential match between data on the ?hot list? and a license plate scanned by the ALPR System. An alarm is NOT conclusive con?rmation that a license plate or vehicle is wanted, but an indicator that additional investigation is warranted. CD-RlCornpact Disc Recordable: A format that ailows data to be recorded to a blank disc one time. 2 ELSAG Operations Center Software: Manages fall data collected by ALPR units for ease of analysis. The software seamlessly monitors all ALPR units to ensure each unit is up to date with the most accurate information. The software also downloads data from the ALPR unit to the server automatically. 3f 13. IV. Effective Date: 01-01-11 DOWN LOAD: Transfer of data from the Virginia?8tate Police database consisting of license plate associated data. HOT LIST: A ?hot list" is a list of targeted licenise plate numbers and partial plate numbers that are uploaded to ALPR units on a .daily basis. UPLOAD: Transfer of data from ALPR units toistorage on the ALPR server. OVERVIEW Each day the Virginia State Police generates a ?ghot list? containing all active stolen license plates and vehicles entered into This information is available to authorized law enforcement personnel via a secure Web site. The ?hot list? is imported either automatically through a server or manually by the end user into the License Plate Reader System. Wanted vehiclesjmay also be entered into the ALPR manually by the end user as circumstances dictate. The ALPR scans license plates and compares them to data provided by the Virginia State Police. The ALPR software runs in the background of the MOT, and automatically alerts the police operator to a potential stolen vehicle or license plate. The ALPR maintains the date, time and location of each license plate it scans. PROCEDURES The following procedural guidelines have been established to ensure the proper use of the Automatic License Plate Reader System. A. Operation of the ALPR System shall only be performed by those authorized employees who have successfully completed the Fairfax County Police Department?s approved training for ALPR devices. All operators shall receive training prior to using the ALPR System. Training will be conducted in a ?train the trainer? format. The Patrol Bureau will arrange for at least one annual "train the trainer? class. Commanders will be responsible for ensuring employees under their respective command receive proper training. Training documentation willibe forwarded to the Fairfax County Criminal Justice Academy. B. A dedicated server forthe ALPR System and software will automatically update the ALPR ?hot list? on the MCTs as they become available from the Virginia State Police server. FCPD SOP 11?039, Page 2 of 8 VI. INTERNAL DATA ACCESS, STORAGE: AND RETENTION A. The Patrol Bureau will have overall respojnsibility of the collection, storage, dissemination, and retention of non-evidentiary data associated with the program. Technical assistance will be provided by the Information Technology Bureau or the vendor (ELSAG North America 1-866-9674900). 8. Access to stored ALPR records shall be for a speci?c investigative or patrol purpose(s). ALPR data is considered an of?cial record and shall be handled as such in accordance with Regulation Improper or misuse of any ALPR data is grounds for disciplinary action. All data collected by the ALPR System is the sole property of the Fairfax County Police Department and shall not be released without authorization from the Chief of Police or his designee. C. Crime and sworn employees trained in the use of the ELSAG Operations Center software shall have full access to ALPR data to conduct analysis of data and processing requests for data from any Police Department employee having a legitimate law enforcement request. Any disputes which result from a request will be resolved by a; supervisor. The Department has limited licenses for the ELSAG Operations Center software, so only select terminals throughout the agency will have access to the program. D. in those circumstances when data is identi?ed as having evidentiary value, a supervisor shall review the facts and determine if the data should be saved. If the reviewing supervisor determines it is reasonable to believe the data has evidentiary value, he will authorize the downloading of the applicable data from the ALPR server onto a CD-R for ?ling. E. The Master Copy CD-R disc containing the original ALPR data and images will be placed in a paper CD sleeve with the following information: Case number Date Location of event Event type Investigating of?cer's name Brief description of data extracted F. The sleeved will be placed in the departmental standard 9?x12" stamped envelope with all required information indicated above. The sealed envelope containing the sleeved will be submitted directly to the Record Room for ?ling. Nothing in this policy shall preclude the investigating of?cer or detective from making one additional copy for his case ?le. Effective Date: 01-01-11 CPD SOP 11-039. Page 3 of 8 G. ltshall be the responsibility of the operator?to ensure the most current "hot list" available has been transferred into the prior to its use. A ?hot list" more than 24 hours old may be utilized. H. ?hot list" more than 72 hours old shall no}: be utilizeditself sufficient reasonable suspicion to make a stop or effect an arrest without further verification. After receiving an audible or visual alarm ofa potential stolen vehicle or license plate the information shall be verified prior to taking any law enforcement action. The operator must use due diligence in verifying any alarms received when utilizing a hot list more than 24 hdurs old. Alarm veri?cations will be accomplished in a two step process. 1. The ALPR operator shall visually verify the subject tag with the data displayed on the ALPR screen same state, characters). 2. Once a visual comparison is con?rmed, the operator shall verify the hit is still active by running the information via MCT or voice a request for a through DPSC. Nothing shall preclude officers acting-ton other indicators to develop reasonable suspicion based on training and experience. .J. Stolen vehicle or license plate responses from shall be con?rmed by Teletype in accordance with established procedures as soon as practical. K. At the discretion of the ALPR operator, additional information may be entered into the ALPR System at any time. The reason for the entry shall be included in the "note" portion of the entry mask stolen vehicle, missing person, abduction, Amber Alert, robbery suspect). The name of the investigating of?cer or detective with a 24/7 contact number shall also be included. Of?cers entering information are responsible for ensuring that all custom manual inputs have a speci?c criminal investigative or patrol ufse. The data will be overwritten automatically by the next scheduled update of the ?hot list" from the Virginia State Police. L. After completing a manual entry the operator should query the ALPR data to determine if the license plate was scanned previously. M. All contacts resulting from ALPR use shall be documented as appropriate in the l/Leads Records Management System. In rare cases where documentation is not otherwise required, of?cers shall entericomments into the event using the COMMENT button from the event screen in [Mobile Effective Date: 01-01-11 . FCPD SOP 11-039, Page 4 of 8 N. Any data extracted from the ALPR server to be retained as evidence shall be documented in the Incident Module or as afsupplement to an existing case in IILEADS. O. ALPR generated data will be maintained ion the server for a period not to exceed 365 days without speci?c authorization of the Chief of Police. The purpose of the retention period is to increase protection of the community by providing an investigative tool to aid in the detection or investigation of terrorism or series of related crimes. VII. EXTERNAL DISSEMINATION of A. Requests for secondary dissemination of information to outside law enforcement agencies shall be made to any commander who will either approve or deny the request based on the validity of the request which must be supported by a speci?c law enforcement need. Law enforcement agencies making a request for ALPR information must complete an ALPR Secondary Dissemination Form. Each form will contain the following information: 1. The date and time the form was received 2. The name and department of the requestor 3. The purpose for which the ALPR data was requested including the agency?s case number. 4. A description of the ALPR data disseminated 5. The date and time the information Was released 6. The identity of the individual to whom the information was released, including agency and contact information 7. The name of the person processing the request 8. The ?nal status of the request (APPROVED or DENIED) B. The Crime Analyst Program director wili maintain a secondary dissemination ?le which will contain completed ALPR Secondafry Dissemination Forms and a copy of any information that was provided. ALPR Secondary Dissemination Forms and associated released ?le shall be retained electronically for a minimum of three years. C. Third party dissemination rules shall not apply to any law enforcement agency within the National Capital Region (NCR) having an MOU which grants access to Fairfax County ALPR ?les. Automatic data access will be facilitated by ITB for approved MOUs. Effective Date: 01-01-11 CPD SOP 11-039, Page Set 8 D. Given special circumstances, Department authorized public and/or private entities offering assistance with regard to a high pro?le case or speci?c investigation may be provided corresponding ALPR data upon authorization from the Chief of Police or his designee, for the sole purpose of furthering the investigation. The data shall be destroyed by the receiving party when it becomes no longer relevant to the initial investigative need. I E. All other requests for ALPR information shail be in accordance with the Virginia Freedom of Information Act (F OIA). OIA requests are time sensitive and shall immediately be forwarded to the Inspections Division of the Internal Affairs Bureau. i DEPLOYMENT A. ALPR equipped vehicles may be used during routine patrol operations or for special operations by personnel properly trained in the use of ALPR. The role of the ALPR in special operations shall be outlined in the operations plan. and reviewed by a supervisor or commander. Operation of police vehicles equipped shall be in accordance with General Order 501.1, Operation of Police Vehicles. ALPR Systems shall be inspected prior to operation. Supervisors should make every effort to deploy ALPR equipped vehicles, and when deployed, the units will be identi?ed in IiNetDispatcher and on squad lineups. IX. MAINTENANCE A. Effective Date: 01-01-11 When ALPR equipment is removed from the vehicle for any reason it shall be placed in its protective case to prevent accidental damage. ALPR cameras shall be removed from vehicles prior to entering an automatic car washing facility. 2 ALPR camera lenses may be cleaned with glass cleaner or mild soap and water. Damage to ALPR equipment shall be immediately reported to a first line supervisor. The supervisor shall document the damage in the form of a memorandum to the Logistics and Property Division director through his FCPD SOP 11-039, Page 6 of 8 respective commander. COpies of all docjumentation shall be faxed to the Resource Management Bureau (RMB) by the end of shift. E. No alterations or repairs of any kind shall be made to ALPR equipment or software. . F. The Logistics and Property Division of the PMB shall be noti?ed of any ALPR equipment needing maintenance or repair. RMB will coordinate all maintenance and repair with the appropriate vendor. x. ADMINISTRATIVE RESPONSIBILITIES A. The system administrator of the ELSAG Operations Center is housed in the Patrol Bureau. The functions of Diagnofstics, Query Statistics, Hot List Management, User Con?guration, Software Management, Data Mining, Parameters Management and Role Management will be determined by Patrol Bureau. 5 B. Server maintenance, software updates; and security of data are the responsibility of the Patrol Bureau with technical assistance from the Information Technology Bureau as needed. C. Functionality issues with ELSAG software on the MCT shall be examined by the CAD Tech Support at PSTOC. D. Installation, maintenance, and tracking of ALPR equipment are the responsibility of Logistics and Property Division director.? E. The station logistics technicians will be? responsible for coordinating the installation, tracking, maintenance; and coordinating the repair of software and hardware issues of ALPR equipment with the respective entities named above. Effective Date: 01-01?11 FCPD SOP 11?039, Page 7 of 8 This SOP becomes effective January 1, 2011, and: rescinds all previous rules and regulations pertaining to the subject. Issued by: Chief of Police Effective Date: 01-01-11 SOP 11-039. Page 8 Of8 Colonel Edwin C. Roessier Jr. Chief of Police Lt. Colonel Thomas Ryan Deputy for Administration Lt. Colonel Ted Aron Deputy ChiefofPoiice for hivesn'gatz'om/ Operations Support Lt. Colonel Erin F. Schai hle Deputy Chief of Police for Patrol Mai or Michael A. Kline Commenter; Internet A?nirs Bureau Lieutenant Justin P. Palenscar Commander, Inspections Division County of Fairfax, Virginia To protect and enrich the quality of life for the people, neighborhoods, and diverse communities of Fairfax County May 15, 2014 Harrison Neal . 5125 Chowan Avenue Alexandria, Virginia 22312 Re: ALPR Information Our Re: Dear Mr. Neal: This letter is in response to your request received by this department on May 9, 2014 reference your vehicle with VA tag ADDCAR. Within the last 364 days your tag was read twice by our ALPR system. Your documents are- enclosed. Please remit the amount indicated on the invoice making your check payable to the ?County of Fairfax?. It should then be mailed to my attention at the below listed address. To ensure your payment is properly credited please also enclose a copy of your invoice and reference our control number on your check. It [can be of further assistance please do not hesitate to contact me at (703) 246-2564 or stin P. Palenscar, First Lieutenant Internal Affairs Bureau JPP/aks Fairfax County Police Departme: 4100 Chain Bridge . Fairfax, Virginia 22 - I Facsimile 703?246?9 - - User Crime A Dare 20} 4/05/17 5 11:36:00 Gate Mason 4366 Lane 1 Transit Date 11/05/2014 Vehicle type Transit status Normal Transit and Time 16:37:25 License Plate ADDCAR State User CrimeAIza??sr Dare 2014/05/15 11:35:51 Gate Mason 4866 Lane . 0 Transit Date 26!04/2014 Vehicle type Transit status Normal Transit and Time 19:57:46 License Plate ADDCAR State .. .mmH? Harrison Neal 5125 Chowan Avenue Alexandria, Virginia individual 5/15/14 Research Time Employee Name and Position Em Number of Last Name Position Hourly Rate Hours Total Expense $11.41 Abbott Crime Analyst 302193 $38.0353 0.3 Total Staff Research Time: 0.3 Comments Research SubTotal $11.41 Services Provided City' - Description otService(s) Provided I - In Cost Total Amount $0.30 3 Charge per page copied . $0.10 Comments (Note Shipping Weights Over 1lb.) Services SubTotal Please make all Checks payable to: County of Fairfax, Virginia Ali payments should be mailed to the above listed address. Please include a copy of this satement so that your payment will be properly credited to your request. (Tax ID . 54-0787833) Be sure to reference: . . .1- ., . - l! -- Latitude: 33.317173500415039 Longitude: -77.14073944091797 . m. ?5 - lil'c of WRGINM Office of the Attorney General Kenneth T. Cu'ccinelli, II 900 East Street Attorney General February 13, 2013 Richmond, Virginia 23219 804-786-2071 FAX Ella-7864991 Virginia Relay Services 300?8284 120 7-1-1 Colonel W.S. laherty Superintendent, Virginia Department of State Police Post Of?ce Box. 27472 Richmond, Virginia 23261-7472 Dear Colonel Flaherty: I am responding to your request for an of?cial advisory opinion in accordance with 22-505 of the Code of Virginia. Issues Presented You inquire regarding the collection, maintenance, and dissemination of data collected ?'om an automated license plate reader Speci?cally, you ask whether the Government Data Collection and Dissemination Practices Act (the ?Data Act?) permits law enforcement agencies to collect, maintain, and disseminate LPR data. You also ask whether such data can be classi?ed as ?criminal intelligence information? under applicable Virginia law and thereby exempted from the Data Act?s provisions. Response It is my opinion that the Data Act does not preclude law enforcement agencies from maintaining, using and disseminating personal information collected by an LPR, provided such data Speci?cally pertains to investigations and intelligence gathering relating to criminal activity. It further is my Opinion that data collected by an LPR may be classi?ed as ?criminal intelligence information? and thereby exempted ??om the Data Act?s coverage only if the data is collected by or on behalf of the Virginia Fusion Intelligence Center, evaluated and determined to be relevant to criminal activity in accordance with, and maintained in confonnance with the criteria Speci?ed in 52?48 of the Code of Virginia. Finally, it is my opinion that data collected by an LPR that is not properly classi?ed as ?criminal intelligence information? and not otherwise relating directly to law enforcement investigations and intelligenco gathering respecting criminal activity, is subject to the Data Act?s strictures and prohibitions. Background LPRS me a combination of cameras and optical character recognition technology to read license plates. The camera captures an image of a license plate and the Optical character recognition technology converts the image into data that can be searched against an existing database or the data may be stored for future use, along with the time, date, and location of the observation. You describe two methods to collect data utilizing an LPR: an ?active? manner, whereby law enforcement collects, evaluates, and analyzes the LPR data in real time to determine the relevance to an ongoing case or emergency, and, alternatively, a Col. W.S. Flaherty February 13, 2013 Page 2 ?passive? manner, whereby law enforcement collects unanalyzed data for potential future use if a need for the collected data arises respecting criminal or terroristic activities. In your letter, you speci?cally describe these collection methods as follows: Uses of LPR technology include searching for a speci?c plate number in cases involving vehicle larceny, abductions, wanted persons and in Amber/Senior/Blue Alerts. In these situations, the system allows law enforcement to process many more plates more accurately and much faster than they could through normal observation techniques. These systems are a vital tool in combating crime and protecting our most vulnerable p0pulations. The reason of this inquin is another growing use of this technology. LPR systems can also be used to collect raw data. Whether the LPR reader is mobile or ?xed, the data collected includes the image of the place, the time, date and precise location the license plate in . question was captured by the system. This is accomplished passively and continuously. If the LPR system is on, it will capture and store the data for every license in plain view to the public it encounters. On a routine patrol, this may include thousands of license plate numbers and locations . . . . This can, and has been an invaluable tool in developing leads in terrorism investigations and criminal cases. Applicable Law and Discussion The Government Data Collection and Dissemination Practices ActI governs the collection, maintenance, and dissemination of personal information by government agencies.2 The General Assembly enacted the Data Act in response to concerns about potentially abusive infonnation-gatherin practices by the govemment, including enhanced availability of personal information through technology.3 The Data Act serves tr; guide state agencies and political subdivisions in the collection and maintenance of personal information. - The Data Act seeks to protect individual privacy, by placing strictures upon the governmental collection, maintenance, use and dissemination of personal information? ?Personal information? includes all information that describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver?s license number, agency-issued 1 VA. CODE ANN. 22-3300 through 2.2-3 309 (2011). 2 Your inquiry does not implicate the Fourth Amendment prohibition against unlawful search and seizure. See U.S. CONST. amend IV. Fourth Amendment protections are triggered only when the state conducts'a search or seizure in an area in which there is a ?constitutionally protected rea50nable expectation of privacy.? New York v. Class, 475 U.S. 106 (1986). When there is no reasonable expectation of privacy, the Fourth Amendment is not implicated. See, United States v. Dionisio, 410 U.S. 1, 14 (1973) (no reasonable expectation of privacy in one?s voice); United States v. Mara, 410 U.S. 19, 21 (1973) (no reasonable expectation of privacy in one?s handwriting); California v. Greenwood, 486 U.S. 35, 37 (1988) (same as to trash left by the curb). Because there is no reasonable expectation of privacy to one?s license plate in public places, the use of LPRs by law enforcement does not violate the Fourth Amendment; for ?it is unreasonable to have an expectation of privacy in an object required by law to be located in a place ordinarily in plain view from the exterior of the automobile.? Class, 475 U.S. at 114 (?nding no reasonable expectation of privacy in a VIN). . 3 Hinderliter v. Humphries, 224 Va. 439, 443?44, 297 684, 686 (1982). See 2.2-3 (listing General Assembly?s ?ndings leading to the Data Act?s enactment). 4 See 2002 Op. Va. Att?y Gen. 3, 4. 5 Section and (C). Col. W.S. Flaherty February 13, 2013 Page 3 identi?cation number, student identi?cation number, real or personal preperty holdings derived from tax returns, and his education, ?nancial transactions, medical history, ancestry, religion, political ideology, criminal or employment record . . . Data collected utilizing LPR technology falls within this statutory de?nition, as, for example, it may assist in locnting an individual data subject, documenting his movements, or determining his personal property holdings? The collection of such information may adversely affect an individual who, at some point in time, may be suspected of and or charged with a criminal violation.s Accordingly, data collected by an LPR generally meets the de?nition of ?personal information? and thus falls within the scope of the Data Act. Therefore, the analysis of the issues you present must explore any exemptions to the Data Act?s coverage that may be applied to data collected through LPR technology. The Data Act?s provisions afford an exemption for certain personal information systems that are ?[m]aintained by the Department of State Police; the police department of the Chesapeake Bay Bridge and Tunnel Commission; police departments of cities, counties, and towns; and the campus police departments of public institutions of higher education . . . 3?9 This exemption applies exclusively to information ?that deal[s] with investigations and intelligence gathering relating to criminal Clearly, data collected by an LPR in the active manner and maintained by such law enforcement entities relates directly to the immediate public safety threat of criminal activity. Thus, such data is exempted ?om the application of the Data Act by its speci?c terms. With respect to LPR data collected to date in the passive manner, you note that it has proven ?an invaluable tool in developing leads in terrorism investigations and criminal cases . . ., [including] in high profile cases like the Museum of the Marine Corps sniper case.? Nevertheless, because no speci?c exemption applies to it, 1 must conclude that data so collected is subject to the Data Act?s regulatory provrsrons. At of the Code of Virginia, and fundamental to the Data Act, the General Assembly enunciated several ?principles of information practice to ensure safeguards for personal privacy?. Among those principles is one particularly relevant to LPR data collected in the passive manner, stating that, ?[i]nformation shall not be collected unless the need for it has been clearly established in advance.?? You state that data collected by an LPR in the passive manner is considered ?raw data?, and is continuously recorded. It captures the ?image of the place, the time, date and precise location the license plate in You also explain that, ?[t]he system only translates letters and numbers. This data is 5 Section 2.2-3 801. 7 Readily attainable information may include the vehicle registrant?s name, address, vehicle information, and potential lien status. The de?nition of ?information system" also broadly encompasses records ?containing personal information and the names, personal number, or other identifying particulars of a data subject.? Section 22-3801. A ?data subject? is ?an individual about whom personal information is indexed or may be located under his name, personal number, or other identi?able particulars, in an information system." Id. 3 See 22?3301. 9 Section 2.2?3 302(7). ?0 Id. Section Col. W.S. Flaherty February 13, 2013 Page 4 then stored by the capturing agency and can be searched at a later date by an alphanumeric query to determine if, when and where a license plate matching the query was encountered.? On these facts I conclude that the need for such data has not been ?clearly established in advance,? so as to conform to the applicable principle of information practice.12 Its future value to any investigation of criminal activity is wholly speculative. Therefore, with no exemption applicable to it, the collection of LPR data in the passive manner does not comport with the Data Act?s strictures and prohibitions, and may not lawfully be done.I3 With regard to your second inquiry, information that can be classi?ed as ?criminal intelligence information? also is expressly exempt from the application of the Data Act."1 This exemption is found in another part of the Code, one that relates to the Virginia Fusion Intelligence Center (?the fusion ?Criminal intelligence information? is de?ned as ?data that has been evaluated and determined to be relevant to the identi?cation and criminal activity of individuals or organizations that are reasonably suspected of involvement in criminal This de?nition, however, ?shall not include criminal investigative ?les.? You ask whether data obtained through LPRs meets this de?nition. When construing a statute, the primary objective is ??to ascertain and'give effect to legislative intent,? as expressed by the language used in the statute.? Where the language of a statute is unambiguous, the courts are bound by the plain meaning of that language.13 Also, where a statute specifies certain things, the intention to exclude that which is not speci?ed may be inferred,19 and ?[courts] may not add to a statute language which the legislature has chosen not to include?? In defining the term ?criminal intelligence information,? the General Assembly speci?cally limited such information to ?data that has been evaluated and determined to be relevant to the identi?cation and . . . - . criminal activity . . Thus, only informatlon that has been both evaluated and determined to be relevant '2 Section '3 See and (C), and 22-3309. 1" Section (Supp. 2012). '5 See Chapter 11 of Title 52 of the Code of Virginia, VA. CODE ANN. 52-47 through 52-49 (2009 Supp. 2012). I note that the term ?criminal intelligence information? is used only in this part of the Code, which deals exclusively with the Virginia Fusion Intelligence Center, and not with law enforcement practices more generally. The Virginia Fusion Intelligence Center is a multiagency center tasked speci?cally with gathering and reviewing terrorist- related information. See 52-47 (2009). The Department of State Police Operates the fusion center, and it ?shall collect, analyze. disseminate, and maintain such information to support local, state, and federal law-enforcement agencies, and other governmental agencies and private organizations in preventing, preparing for, responding to, and recovering from any possible or actual terrorist attack." Id. ?5 Section '7 Commonwealth v. Amerson, 281 Va. 414, 418, 706 879, 882 (2011) (quoting Conger v. Barrett, 280 Va. 627, 630, 702 117, 118 (2010)) (internal quotation marks omitted). ?3 Kozmina v. Commonwealth, 281 Va. 347, 349, 706 860, 862 (2011) (quoting Conyers v. Martial Arts World of Richmond, Inc., 273 Va. 96, 104, 639 174, 178 (2007)). ?9 See 2A NORMAN J. SINGER .D SHAMBIE SINGER, STATUTORY CONSTRUCTION 47 :23 (7th ed. 200?) (explaining maxim of statutory construction ?expressio zmius est exclusio See also, 2008 Up. Va. Att?y Gen. 126, 127 and citations therein. 3? Cnty. of Amherst v. Broclonan, 224 Va. 391, 397 297 805, 808 (1982). 21 Section 52-48(13) (emphasis added). Col. W.S. Flaherty February 13, 2013 Page 5 to the identi?cation and criminal activity of individuals or organizations that are reasonably suspected of involvement in criminal activity constitutes ?criminal intelligence information.? Information that has not been evaluated or determined to be so relevant does not meet the de?nition. Accordingly, data collected by the fusion center through use of an LPR in the active manner, and speci?cally, the data that is evaluated and analyzed in real?time respecting suspected criminal activity, meets the de?nition of ?criminal intelligence information.? It thus is exempted from the scope of the Data Act. Conversely, any data that may be collected in the passive manner by the fusion center through use of an LPR that is of unknown relevance and not intended for prompt evaluation and potential use respecting suspected criminal activity, is not ?criminal intelligence information.? It therefore is not exempted from the of the Data'Act. Therefore, in sum, I conclude that whether an LPR can be used to collect personal information depends on the manner in which the device is employed to obtain the data. If the data is collected in the active manner, including data that can be deemed ?criminal intelligence information,? such data can be collected, maintained and disseminated in accordance with law. On the other hand, LPR technology may not lawfully be used to collect personal information in the passive manner, including ?the image of the place, the time, date and precise location [of a] license Conclusion Accordingly, it is my Opinion that the Data Act does not preclude law enforcement agencies from maintaining, using and disseminating personal information collected by an LPR, provided such data speci?cally pertains to investigations and intelligence gathering relating to criminal activity. LPR data so collected is exempted from the Data Act?s coverage. it further is my opinion that data collected by an LPR may be classi?ed as ?criminal intelligence information,? and thereby exempted item the Data Act?s coverage, if the data is collected by or on behalf of the Virginia Fusion Intelligence Center, is evaluated and determined to be relevant to criminal activity in accordance with, and is maintained in conformance with the criteria speci?ed in 5248 of the Code of Virginia. Finally, it is my Opinion that because the need for such data has not been ?clearly established in advance?, LPR data collected in the continuous, passive manner, that is not properly classi?ed as ?criminal intelligence information? and not otherwise relating directly to law enforcement investigations and intelligence gathering respecting criminal activity, is subject to the Data Act?s strictures and prohibitions, and it may not lawfully be collected through use of LPR technology. With kindest regards, I am Very truly yours, ?noun-4- Kenneth T. Cuccinelli, II Attorney General