An Introduction to the Legal Side of Automatic License Plate Recognition System Technology
May, 2022
Have you passed by a police car, driven over a bridge or overpass, or interacted with law enforcement? It is likely that automatic license plate recognition system (ALPR) cameras documented your vehicle, license plate, and surroundings. Although police have used the technology for years to enforce infractions, identify stolen cars, and streamline their law enforcement steps, the technology is also making its way into the private sector. The information these readers can provide license plate reader operators is substantial—so substantial that public interest groups and government entities have raised concerns about pertinent privacy issues. While the federal Driver’s Protection Privacy Act addresses some automatic license plate recognition system issues, most private-sector companies will need to consider state and local compliance regulations when considering how to integrate ALPR technology into their workflows.
While police, state, and local departments often use ALPR technology, private companies also use it as part of their business activities.
Overall, jurisdictional treatment of ALPR usage in the private sector varied by state and municipality. Roughly two-thirds of the 22 U.S. states and one Canadian province we surveyed did not regulate the private use of automatic license plate recognition systems. Furthermore, about 10percent of the jurisdictions overall had ALPR regulations but did not restrict private ALPR use. The remaining jurisdictions, encompassing states such as California, Florida, and New York, have established or emerging regulations that private-sector participants should be paying attention to to avoid compliance issues and sanctions. In some states, local municipalities go further in mandating additional operational requirements on private-sector ALPR operators.
For businesses operating in jurisdictions that regulate private-sector ALPR activities, organizations must account for various steps and measures to ensure their activities are fully compliant. Depending on the outcome of pending legislation, businesses should also consider avoiding ALPR use altogether in certain states. Here is how license plate reader technology can impact private-sector companies and how it will affect the compliance planning steps companies will need to take to achieve their goals.
HOW ALPR TECHNOLOGY WORKS
ALPR technology, which British police initially developed in the 1970s, has a wide variety of use cases today in both the United States and abroad. The technology captures images of vehicle license plates at high speeds and converts plate information into readable data. The software that accompanies these cameras stores information from all vehicles that pass by the cameras, which can be mounted on cars or around high-traffic areas such as traffic lights, bridges, or overpasses. The types of information these programs can collect include vehicle and driver images, time data, and GPS location data. These programs can then export this information to various public and private databases as machine-readable text. Law enforcement and private entities can then use this ALPR data for various investigatory activities. ALPR devices can come in all shapes and forms and include stationary license plate reader cameras, and semi-stationary ALPR cameras, vehicle cameras.
HOW COMPANIES USE LICENSE PLATE READERS
While police, state, and local departments often use ALPR technology, private companies also use it as part of their business activities. Some popular use cases for the technology include using it when repossessing vehicles in default, tracking down deadbeat debtors, and monitoring parking activities at privately-owned parking lots. Companies can also leverage the technology to expose garaging fraud, collect evidence on automobile insurance fraud, establish whether businesses are using personal vehicles for commercial use, and track down accomplices and associates.
ALPR technology and the data it collects can help companies arrive at powerful insights. Organizations can leverage ALPR data to generate information and reports to help organizations plan around emerging operational trends. Some companies, including TransUnion’s TLOxp division, are even using the technology to help investigators develop predictive travel maps, pinpoint possible residential addresses, and reveal travel patterns associated with people under investigation. Companies can also cross-reference the automatic license plate recognition system data against nationwide databases such as the Digital Recognition Network (DRN) and MVTRAC to retrieve even more detailed information about vehicle owners.
PRIVACY ISSUES POSED BY ALPR TECHNOLOGY
Unsurprisingly, ALPR technology has prompted privacy concerns from various groups. In a 2013 whitepaper, the ACLU railed against how ALPR systems collect and capture sensitive data from all individuals regardless of their criminal history. The ACLU was primarily concerned with how entities could use the technology to easily track and predict drivers’ movements. Its whitepaper also raised issues regarding how investigators could abuse ALPR systems to create geofencing, find witnesses, conduct abusive tracking, and perform discriminatory targeting.
Privacy groups have also weighed in and expressed similar concerns. For example, the Electronic Frontier Foundation (EFF) warned that ALPR devices can chill First Amendment protections and create “an intimate portrait of a driver’s life” through the way they help operators uncover travel patterns with the help of algorithmic analysis, discover associated vehicles, and track visits to sensitive places such as protests and union halls. The group also expressed concerns that the systems can misread plates and prompt accidental arrests. Even some government agencies have expressed reservations about ALPR technology. As reported in WIRED, the FBI was advised by its own lawyers in 2012 to stop purchasing ALPR devices due to privacy concerns.
While most of these criticisms relate to how law enforcement uses ALPR technology, these types of concerns are among the many that underlie today’s ALPR regulations.
FEDERAL REGULATIONS THAT ADDRESS AUTOMATIC LICENSE PLATE READER TECHNOLOGY
While license plate reader technology does collect license information and other data from moving vehicles, information disclosure issues are subject to federal regulations. Driver data is protected by the federal Driver’s Protection Privacy Act (DPPA) on the national level. The law prohibits state DMVs from disclosing photographs, social security numbers, client identification numbers, names, addresses, telephone numbers, medical information, disability information, and other personally-identifiable information (PII) to third parties. The DPPA, however, does allow for the disclosure of zip code information. It also permits driver PII disclosures if they fall under one of fourteen permissible uses that mainly involve legal procedures, information verification, toll-related billing activities, vehicle impounding, and background checks.
The regulation does open the door for private-sector players to request data collected in conjunction with license plate readers. However, it does not make it widely available for the taking. The Shelby Amendment, which took effect in 2000, requires states to obtain a driver’s express permission before releasing information regarding that driver for marketing or other non-enforcement purposes.
License plate reader operators who collect and store data must also account for jurisdiction-specific retention policies regarding the data they collect. For instance, Minnesota requires private-sector operators that collect ALPR data not related to criminal investigations to destroy it no later than 60 days from the date of collection. Private companies may additionally need to undergo audits related to their activities. San Francisco’s SFMTA, for example, requires parking lot operators and SFMTA operators using ALPR technology to undergo yearly audits with an ALPR data custodian. These audits assess whether operators are following SFMTA data retention policies, properly reviewing ALPR data requests, and ensuring all staff who work with and collect ALPR data have proper training and access authorizations. Contractors working with state agencies in other jurisdictions would also need to consult similar standards for government agencies, as would be the case in Florida.
HOW ALPR OPERATORS CAN ADDRESS AUTOMATIC LICENSE PLATE RECOGNITION SYSTEM REGULATIONS
Companies in most states should not expect substantial, if any, restrictions on launching their ALPR initiatives and using the technology in their day-to-day operations. Still, organizations would be wise to consult with and confirm applicable automatic license plate recognition system regulations in each state and municipality where they plan to operate. Private-sector license plate reader operators should also work with their in-house and outside legal teams to analyze the terms of their agreements with their government and state agency agreements to confirm whether they would need to implement additional compliance measures.
Any company considering adopting ALPR technology into their workflows should be mindful of the compliance costs and measures they must take to ensure their operations are compliant. Otherwise, they will need to plan around current and emerging regulations. Working in tandem with an alternative legal service provider (ALSP) can be an efficient strategy for leveraging ALPR subject matter expertise and developing compliance initiatives that can meet your goals. With an ALSP’s assistance, organizations can implement process mapping to visualize their data collection processes and leverage analytics programs to identify and rectify high-risk workflows. They can even run AI and predictive analytics programs against existing data to uncover settlement opportunities and litigation mitigation strategies when responding to imminent disputes.
In the end, companies looking to roll out ALPR technology will likely face massive opportunities when using it to meet their business objectives. That being said, your organization will need to be mindful of applicable state and local regulations to avoid compliance risks and sanctions when doing so.
LegalEase Solutions offers corporate legal departments and law firms innovative support with regulatory compliance needs. Our team is designed to complement your legal practice or department, providing you with the capabilities and resources to stay up to date with your needs. We have also helped legal departments and firms leverage AI, data and predictive analytics, customized apps, and software to help them make informed decisions about their day-to-day issues. To see how LegalEase Solutions can help, contact us at support@legaleasesolutions.com.
