Can Virginia police passively collect license plate reader data and store it for future use, or does the Data Act limit them to active, case-specific collection?

Plain-English summary

The State Police Superintendent asked whether the Virginia Government Data Collection and Dissemination Practices Act (the "Data Act") permitted law enforcement to collect, maintain, and disseminate data from automated license plate readers (LPRs). The opinion drew a sharp line between two uses of LPRs.

Active use is fine. When police run a plate against an alert list (vehicle larceny, AMBER/Senior/Blue alerts, wanted persons, abductions), they're using LPR data in real time as part of an investigation or intelligence-gathering related to criminal activity. The Data Act exempts personal information systems maintained by police that "deal with investigations and intelligence gathering relating to criminal activity," covering the Department of State Police, the Chesapeake Bay Bridge and Tunnel Commission police, city/county/town police, and the campus police of public colleges. Data collected actively under that exemption can be maintained, used, and disseminated.

Passive use is not fine. When an LPR is left running and captures every plate it sees, with the image, time, date, and precise location, and stores all of that for possible future use, no specific exemption applies. The Data Act says, at § 2.2-3800(C), that "[i]nformation shall not be collected unless the need for it has been clearly established in advance." Bulk capture of every plate in plain view doesn't meet that test. The future value to any specific investigation is wholly speculative. So passive LPR collection violates the Data Act's strictures and may not lawfully be done.

The AG also addressed the "criminal intelligence information" pathway under § 52-48. The Virginia Fusion Intelligence Center gathers intelligence respecting suspected criminal activity. "Criminal intelligence information" is defined as "data that has been evaluated and determined to be relevant to the identification and criminal activity of individuals or organizations that are reasonably suspected of involvement in criminal activity," and does not include criminal investigative files. That label exempts the data from the Data Act, but only if it actually meets the definition.

LPR data collected actively by the Fusion Center and evaluated against criminal activity in real time fits the definition and is exempted. LPR data collected passively by the Fusion Center, of unknown relevance and not intended for prompt evaluation, doesn't meet the definition. It's not "criminal intelligence information" and remains within the Data Act's strictures.

Currency note

This opinion was issued in 2013. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

What's the difference between active and passive LPR use?
Active means using the LPR to scan for specific plates of interest, often against a hot list (stolen vehicles, AMBER alerts, wanted persons). Passive means running the LPR continuously and storing every plate captured for possible future searches. The opinion treated active use as part of legitimate investigations, and passive use as bulk surveillance without an established need.

Does this mean police can never store any LPR data?
No. They can collect and store LPR data tied to active investigations, where the data relates to specific identified criminal activity. The opinion's prohibition was on undirected mass collection of all plates seen, without any present investigative connection.

What about the Fusion Center?
The Fusion Center can collect actively for terror-related intelligence work, and that data can qualify as "criminal intelligence information" exempt from the Data Act. But Fusion Center passive bulk collection that hasn't been evaluated against any specific criminal activity doesn't qualify and is subject to the Data Act.

Can a locality just pass an ordinance authorizing passive LPR collection?
The opinion didn't address that. The Data Act is state law, and a local ordinance generally can't authorize what state law forbids. Any change in the rule would need to come from the General Assembly.

Background and statutory framework

The Virginia Government Data Collection and Dissemination Practices Act (Data Act) places limits on how state and local government agencies collect, maintain, use, and disseminate "personal information." The General Assembly enacted it in response to concerns about potentially abusive information-gathering by government, including the enhanced availability of personal information through technology.

"Personal information" is broadly defined to include anything that describes, locates, or indexes an individual: social security number, driver's license number, real or personal property holdings derived from tax returns, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, and more. LPR data fits because it can locate an individual, document movements, and tie to personal property holdings.

Section 2.2-3800(C) sets out the principles of information practice, one of which is that "[i]nformation shall not be collected unless the need for it has been clearly established in advance." The Act also exempts certain law enforcement information systems "that deal with investigations and intelligence gathering relating to criminal activity."

The Virginia Fusion Intelligence Center is a center tasked with intelligence work. Section 52-48 defines "criminal intelligence information" as data that has been evaluated and determined to be relevant to the identification and criminal activity of individuals or organizations reasonably suspected of involvement in criminal activity, and that data is exempted from Data Act coverage. The definition is narrow: data not yet evaluated and determined relevant doesn't qualify, and the definition does not include criminal investigative files.

Citations

• Va. Code § 2.2-505 (Attorney General opinions)
• Va. Code § 2.2-3800 (Government Data Collection and Dissemination Practices Act; principles of information practice)
• Va. Code § 52-48 (criminal intelligence information definition)

Source

• Landing page: https://www.oag.state.va.us/annual-reports-opinions/official-opinions
• Original PDF: https://www.oag.state.va.us/files/Opinions/2013/12-073_Flaherty.pdf

Original opinion text

COMMONWEALTH of VIRGINIA
Office of the Attorney General
Kenneth T. Cuccinelli, II
Attorney General

February 13, 2013

Colonel W.S. Flaherty
Superintendent, Virginia Department of State Police
Post Office Box 27472
Richmond, Virginia 23261-7472

Dear Colonel Flaherty:
I am responding to your request for an official advisory opinion in accordance with § 2.2-505 of the Code of Virginia.

Issues Presented
You inquire regarding the collection, maintenance, and dissemination of data collected from an automated license plate reader ("LPR"). Specifically, you ask whether the Government Data Collection and Dissemination Practices Act (the "Data Act") permits law enforcement agencies to collect, maintain, and disseminate LPR data. You also ask whether such data can be classified as "criminal intelligence information" under applicable Virginia law and thereby exempted from the Data Act's provisions.

Response
It is my opinion that the Data Act does not preclude law enforcement agencies from maintaining, using and disseminating personal information collected by an LPR, provided such data specifically pertains to investigations and intelligence gathering relating to criminal activity. It further is my opinion that data collected by an LPR may be classified as "criminal intelligence information" and thereby exempted from the Data Act's coverage only if the data is collected by or on behalf of the Virginia Fusion Intelligence Center, evaluated and determined to be relevant to criminal activity in accordance with, and maintained in conformance with the criteria specified in § 52-48 of the Code of Virginia. Finally, it is my opinion that data collected by an LPR that is not properly classified as "criminal intelligence information" and not otherwise relating directly to law enforcement investigations and intelligence gathering respecting criminal activity, is subject to the Data Act's strictures and prohibitions.

Background
LPRs use a combination of cameras and optical character recognition technology to read license plates. The camera captures an image of a license plate and the optical character recognition technology converts the image into data that can be searched against an existing database or the data may be stored for future use, along with the time, date, and location of the observation. You describe two methods to collect data utilizing an LPR: an "active" manner, whereby law enforcement collects, evaluates, and analyzes the LPR data in real time to determine the relevance to an ongoing case or emergency, and, alternatively, a "passive" manner, whereby law enforcement collects unanalyzed data for potential future use if a need for the collected data arises respecting criminal or terroristic activities.

In your letter, you specifically describe these collection methods as follows:

Uses of LPR technology include searching for a specific plate number in cases involving vehicle larceny, abductions, wanted persons and in Amber/Senior/Blue Alerts. In these situations, the system allows law enforcement to process many more plates more accurately and much faster than they could through normal observation techniques. These systems are a vital tool in combating crime and protecting our most vulnerable populations.

The reason of this inquiry is another growing use of this technology. LPR systems can also be used to collect raw data. Whether the LPR reader is mobile or fixed, the data collected includes the image of the place, the time, date and precise location the license plate in question was captured by the system. This is accomplished passively and continuously. If the LPR system is on, it will capture and store the data for every license in plain view to the public it encounters. On a routine patrol, this may include thousands of license plate numbers and locations . . . . This can, and has been an invaluable tool in developing leads in terrorism investigations and criminal cases.

Applicable Law and Discussion

The Government Data Collection and Dissemination Practices Act governs the collection, maintenance, and dissemination of personal information by government agencies. The General Assembly enacted the Data Act in response to concerns about potentially abusive information-gathering practices by the government, including enhanced availability of personal information through technology. The Data Act serves to guide state agencies and political subdivisions in the collection and maintenance of personal information.

The Data Act seeks to protect individual privacy, by placing strictures upon the governmental collection, maintenance, use and dissemination of personal information. "Personal information" includes

all information that (i) describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver's license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record . . . .

Data collected utilizing LPR technology falls within this statutory definition, as, for example, it may assist in locating an individual data subject, documenting his movements, or determining his personal property holdings. The collection of such information may adversely affect an individual who, at some point in time, may be suspected of and or charged with a criminal violation. Accordingly, data collected by an LPR generally meets the definition of "personal information" and thus falls within the scope of the Data Act.

Therefore, the analysis of the issues you present must explore any exemptions to the Data Act's coverage that may be applied to data collected through LPR technology.

The Data Act's provisions afford an exemption for certain personal information systems that are "[m]aintained by the Department of State Police; the police department of the Chesapeake Bay Bridge and Tunnel Commission; police departments of cities, counties, and towns; and the campus police departments of public institutions of higher education . . . ." This exemption applies exclusively to information "that deal[s] with investigations and intelligence gathering relating to criminal activity[.]"

Clearly, data collected by an LPR in the active manner and maintained by such law enforcement entities relates directly to the immediate public safety threat of criminal activity. Thus, such data is exempted from the application of the Data Act by its specific terms.

With respect to LPR data collected to date in the passive manner, you note that it has proven "an invaluable tool in developing leads in terrorism investigations and criminal cases . . . , [including] in high profile cases like the Museum of the Marine Corps sniper case." Nevertheless, because no specific exemption applies to it, I must conclude that data so collected is subject to the Data Act's regulatory provisions.

At § 2.2-3800(C) of the Code of Virginia, and fundamental to the Data Act, the General Assembly enunciated several "principles of information practice to ensure safeguards for personal privacy". Among those principles is one particularly relevant to LPR data collected in the passive manner, stating that, "[i]nformation shall not be collected unless the need for it has been clearly established in advance."

You state that data collected by an LPR in the passive manner is considered "raw data", and is continuously recorded. It captures the "image of the place, the time, date and precise location the license plate in question[.]" You also explain that, "[t]he system only translates letters and numbers. This data is then stored by the capturing agency and can be searched at a later date by an alphanumeric query to determine if, when and where a license plate matching the query was encountered."

On these facts I conclude that the need for such data has not been "clearly established in advance," so as to conform to the applicable principle of information practice. Its future value to any investigation of criminal activity is wholly speculative. Therefore, with no exemption applicable to it, the collection of LPR data in the passive manner does not comport with the Data Act's strictures and prohibitions, and may not lawfully be done.

With regard to your second inquiry, information that can be classified as "criminal intelligence information" also is expressly exempt from the application of the Data Act. This exemption is found in another part of the Code, one that relates to the Virginia Fusion Intelligence Center ("the fusion center"). "Criminal intelligence information" is defined as "data that has been evaluated and determined to be relevant to the identification and criminal activity of individuals or organizations that are reasonably suspected of involvement in criminal activity." This definition, however, "shall not include criminal investigative files."

You ask whether data obtained through LPRs meets this definition. When construing a statute, the primary objective is "'to ascertain and give effect to legislative intent,'" as expressed by the language used in the statute. Where the language of a statute is unambiguous, the courts are bound by the plain meaning of that language. Also, where a statute specifies certain things, the intention to exclude that which is not specified may be inferred, and "[courts] may not add to a statute language which the legislature has chosen not to include."

In defining the term "criminal intelligence information," the General Assembly specifically limited such information to "data that has been evaluated and determined to be relevant to the identification and criminal activity . . . " Thus, only information that has been both evaluated and determined to be relevant to the identification and criminal activity of individuals or organizations that are reasonably suspected of involvement in criminal activity constitutes "criminal intelligence information." Information that has not been evaluated or determined to be so relevant does not meet the definition.

Accordingly, data collected by the fusion center through use of an LPR in the active manner, and specifically, the data that is evaluated and analyzed in real-time respecting suspected criminal activity, meets the definition of "criminal intelligence information." It thus is exempted from the scope of the Data Act.

Conversely, any data that may be collected in the passive manner by the fusion center through use of an LPR that is of unknown relevance and not intended for prompt evaluation and potential use respecting suspected criminal activity, is not "criminal intelligence information." It therefore is not exempted from the scope of the Data Act.

Therefore, in sum, I conclude that whether an LPR can be used to collect personal information depends on the manner in which the device is employed to obtain the data. If the data is collected in the active manner, including data that can be deemed "criminal intelligence information," such data can be collected, maintained and disseminated in accordance with law. On the other hand, LPR technology may not lawfully be used to collect personal information in the passive manner, including "the image of the place, the time, date and precise location [of a] license plate[.]"

Conclusion

Accordingly, it is my opinion that the Data Act does not preclude law enforcement agencies from maintaining, using and disseminating personal information collected by an LPR, provided such data specifically pertains to investigations and intelligence gathering relating to criminal activity. LPR data so collected is exempted from the Data Act's coverage. It further is my opinion that data collected by an LPR may be classified as "criminal intelligence information," and thereby exempted from the Data Act's coverage, if the data is collected by or on behalf of the Virginia Fusion Intelligence Center, is evaluated and determined to be relevant to criminal activity in accordance with, and is maintained in conformance with the criteria specified in § 52-48 of the Code of Virginia. Finally, it is my opinion that because the need for such data has not been "clearly established in advance", LPR data collected in the continuous, passive manner, that is not properly classified as "criminal intelligence information" and not otherwise relating directly to law enforcement investigations and intelligence gathering respecting criminal activity, is subject to the Data Act's strictures and prohibitions, and it may not lawfully be collected through use of LPR technology.

With kindest regards, I am
Very truly yours,

Kenneth T. Cuccinelli, II
Attorney General