Automated License Plate Readers and the Growing Public Pushback on Data Retention

Seems harmless enough: an automated license plate reader (ALPR) in a police cruiser scans the license plate of any vehicle it chooses to follow and up pops lots of data on whoever owns it.

But just as red light cameras sparked a citizens' revolt - especially when it was learned that the red light cycle was sped up by contract in order to generate more tickets and thus more revenue - getting in the way of a person and her car can provoke previously sublimated interests in rights and laws.

Because of public concern about the nature of the data being gathered, the potential for mistakes and the inability to correct them, cities and states are beginning to pass regulations mandating destruction of any ALPR data in as little as seven days.

Like any organization for which data has increased the chances of success, police forces are loathe to let go so quickly. This will become even more interesting if continued thefts of massive quantities of credit card data force commercial firms to dump their data as well. JL

Cyrus Farivar reports in ars technica:

The Oakland Police Department (OPD) reported that after using just four LPR units for 16 months, it had read 793,273 plates, with hits on just 2,012 of them—a "hit rate" of just 0.2 percent. In other words, nearly all of the data collected is innocuous.
Virginia has become the first state in America to impose a very short data retention limit on the use of automated license plate readers (LPRs, or ALPRs). VA cops will now only be able to keep such data for seven days unless there is an active, ongoing criminal investigation.
New Hampshire previously banned the devices outright, while Maine has imposed a 21-day limit. However, many jurisdictions nationwide, ranging from the New York State Police to the Oakland Police Department, have no formal data retention limit. That means the location data—often resulting in millions of records collected over years—is effectively kept forever.
Governor Terry McAuliffe (D) signed the Virginia bill into law on March 10, and it will take effect on July 1. His spokesman did not immediately respond to Ars' request for comment.
"It is great to see that Virginia legislators have recognized the threats to privacy posed by longer ALPR retention periods and also recognized that longer retention periods aren’t necessary to serve the main purposes of ALPRs—finding wanted and stolen vehicles," Jennifer Lynch, an attorney with the Electronic Frontier Foundation, told Ars by e-mail.
"In 2013, Virginia’s Attorney General issued a formal opinion on ALPRs where he stated that Virginia shouldn’t be keeping ALPR data on innocent citizens. However, that opinion didn’t have the force of law. If passed, this bill will, and I hope other states will follow Virginia’s lead."
The law, entitled the "Government Data Collection and Dissemination Practices Act," expands the state’s definition of "personal information" to include license plate number and "presence at any place," or location data.
As the statute explains:

The General Assembly finds that:
An individual's privacy is directly affected by the extensive collection, maintenance, use and dissemination of personal information;
The increasing use of computers and sophisticated information technology has greatly magnified the harm that can occur from these practices;
An individual's opportunities to secure employment, insurance, credit, and his right to due process, and other legal protections are endangered by the misuse of certain of these personal information systems; and
In order to preserve the rights guaranteed a citizen in a free society, legislation is necessary to establish procedures to govern information systems containing records on individuals.

The bill’s author, State Senator Chap Petersen (D-Fairfax), told Ars that this language is designed to be broad, a hedge against potential threats.

"My bill speaks broadly to any technology that is used to capture data in a passive or indiscriminate way," he said. "It could be used for facial recognition or VIN numbers. I'm not just worried about this technology, I'm worried about future technologies.
"It was clear to me that the state had no business collecting this information. I wasn't a criminal suspect, so why are they taking pictures of me? Or my wife? Law enforcement only has powers that we authorize them. They shouldn't just be able to use any tech that they want or to surveil people when they're not subject to an investigation. You can't just do it because you feel like it, and that to me is very critical."

Petersen said the bill was designed with a nod toward George Mason, an 18th century Founding Father from Virginia who authored the Virginia Declaration of Rights (which later influenced the Bill of Rights). "I sent a bill in last year and had joint support with the [American Civil Liberties Union] and Tea Parties," Petersen added. "Left wing and right wing crazies working together!"
As Ars has reported for more than two years, LPRs are used in cities big and small across America. Typically, the specialized cameras scan a given plate using optical character recognition technology, checking that plate against a "hot list" of stolen or wanted vehicles. The device records the date, time, and GPS location of any plates—"hot" or not—that it sees. (There have been incidents where LPR misreads have led to dangerous confrontations.)
In many cases, nearly all collected LPR data has been shown to be useless, as one example from California illustrates.
In 2008, the Oakland Police Department (OPD) reported to the city council that after using just four LPR units for 16 months, it had read 793,273 plates, with hits on just 2,012 of them—a "hit rate" of just 0.2 percent. In other words, nearly all of the data collected is innocuous. Despite this, in that same report, then-OPD Deputy Chief Dave Kozicki (who has since retired) dubbed the LPR setup an "overwhelming success."