License Plate Data Isn't 'Personally Identifiable' Until The Public Asks Police For Access To It

Law enforcement agencies display a deliberate cognitive dissonance when it comes to data they claim has no "expectation of privacy." As was recently detailed here, license plate scanners are in operation across the United States, most with little to no oversight over the use of the location information obtained. Even worse, disposal of "non-hit" data seems to be an afterthought -- in some cases, the information is held onto indefinitely. One law enforcement agency was even quoted as saying the use of the data was "limited only by the officers' imagination."

These agencies excuse these efforts by claiming the information they obtain is public. After all, the vehicles are driving on public roads where anybody, even a license plate scanner, can see and record the license plate. They also argue this is no different than an officer writing down a plate number and calling it in. (Although I'd like to see an officer write down 786 plates in one hour, as one plate scanner did in the Motherboard article.)

As Shawn Musgrave points out, this information travels almost exclusively one way.

A report released this week by the ACLU explores the widespread deployment of automatic license plate recognition (ALPR) scanners by law enforcement across the country. As police tout the advantages of ALPR and seek millions in federal funds to the equipment, many departments insist that license plate and vehicle location information don't require special protection or oversight.

When pressed to put special protections on their massive license plate databases, the law enforcement community writ large argues that license plate numbers are not personally identifiable information (PII), and thus not subject to restricted access or probable cause requirements for detectives to paw through it.

One would think that, for the most part, license plate data is personally identifiable. After all, most of us use the same vehicles for day-to-day travel. If it's not you, then it's a close family member. A plate can easily be tied to a small group of individuals, generally located at the same address. But law enforcement members argue that it isn't -- that a license plate is a license plate and nothing more.

In its 2012 guidelines on ALPR, the International Association of Chiefs of Police remind us that a license plate “identifies a particular vehicle, not a particular person.” When the Drug Enforcement Agency wanted to install ALPR along Utah highways in 2012, an official told local legislators, “We're not trying to capture any personal information--all that this captures is the tag, regardless of who the driver is.”

It's a terrible argument, especially considering phone numbers and addresses are considered personal information (according to federal guidelines), even if neither specifically identifies a person. Not only that, but plate numbers seem to be "personally identifiable" enough to allow traffic cam tickets to be sent to the person (and address) linked to the plate number. (It should be noted that a few drivers have turned this weak argument against law enforcement -- most notably, the driver who wore a monkey mask while racking up traffic cam tickets and then argued the city couldn't prove who was driving the vehicle.)

So, if license plates aren't "personally identifiable information," anyone should be able to access these public records, right?

When one citizen requested anonymized ALPR data from the LA County Sheriff earlier this month via a public records request, his request was denied primarily on confidentiality grounds. Again, he wanted anonymous data, but was denied based on confidentiality.

When I asked for data from the Boston police, the department indicated it was only willing to produce redacted records “without images of license plates and license plate numbers.” (I’m still waiting for this data after three months.)

There's the one-way street. It's not "personal" but only authorized law enforcement members are allowed to view the data. It's not "personal" enough to be subject to the same restrictions addresses and phone numbers are but agencies aren't interesting in sharing their databases of "vehicles" with the public. (Of course, they will sell it to private corporations...) It's a shifting definition that serves law enforcement's desire for massive data and little oversight.

And what happens if a member of the public manages to get ahold of the "private" database full of "public" information?

After a Minneapolis open data advocate paid $5.91 last December for a USB drive packed with 2.1 million ALPR scans complete with license plate numbers and photos, including the mayor’s, the city’s police chief successfully petitioned for a change in the public records law. In the same breath, Chief Harteau asserted that an ALPR scanner “does not record personally identifiable information,” but that its scans “should be private data, available to only the subject and not the general public.” The mayor quickly obliged.

There's your doublethink. Non-private information given privacy protection by a change in law that only benefits certain (supposedly) public servants. Seems rather possessive for data that anybody with pen and paper could acquire.

Maybe the time has come for the technology to be opened to the public, which can then drive around capturing plate and location data on law enforcement vehicles. Technology has been turned against those deploying it before. After all, if it's perfectly acceptable to grab location data on the public, law enforcement should be willing to submit to the same sort of data collection.