NINETEENTH JUDICIAL CIRCUIT OF VIRGINIA Fairfax County Courthouse 4110 Chain Bridge Road Fairfax, Virginia 22030-4009 703-246-2221 • Fax: 703-246-5496 • TOO: 703-352-4139 BRUCE D. WHITE. CHIEF JUDGE RANDY. BELLOWS ROBERT J. SMITH BRETT A. KASSABIAN MICHAEL F. DEVINE JOHN M. TRAN GRACE BURKE CARROLL DANIEL E. ORTIZ PENNEY S. AZCARATE STEPHEN C. SHANNON THOMAS P. MANN RICHARD E. GARDINER DAVID BERNHARD DAVID A. OBLON DONTAL L. BUGS COUNTY OF FAIRFAX CITY OF FAIRFAX April 1, 2019 JUDGES Edward S. Rosenthal, Esquire Lana M. Manitta, Esquire Jennifer A. Lucey, Esquire Rich Rosenthal Brincefield Manitta Dzubin & Kroeger, PLLC 500 Montgomery Street, Suite 600 Alexandria, VA 22314 THOMAS A. FORTKORT J. HOWE BROWN F. BRUCE BACH M. LANGHORNE KEITH ARTHUR B. VIEREGG KATHLEEN H. MACKAY ROBERT W. WOOLDRIDGE, JR. MICHAEL P. McWEENY GAYLORD L FINCH. JR. STANLEY P. KLEIN LESLIE M. ALDEN MARCUS D. WILLIAMS JONATHAN C. THACHER CHARLES J. MAXFIELD DENNIS J. SMITH LORRAINE NORDLUND DAVID S. SCHELL JAN L BRODIE RETIRED JUDGES Kimberly P. Baucom, Esquire Senior Assistant County Attorney 12000 Government Center Parkway, Suite 549 Fairfax, VA 22035 RE: Harrison Neal v. Fairfax County Police Department, et al., Case No. CL-2015-5902 Dear Counsel: This matter comes before the Court on the reversal and remand of the Supreme Court of Virginia. This case was heard on December 19, 2018, after which this Court took the matter under advisement. For the reasons that follow, the Plaintiff's petition is granted. BACKGROUND The Plaintiffs brought this action under the Government Data Collection and Dissemination Practices Act, Virginia Code § 2.2-3800 et seq ("Data Act"). The subject of the alleged violation of the Data Act is the Automatic License Plate Reader ("ALPR") system used by the Fairfax County Police Department ("FCPD"). The Data Act prescribes that "Mecordkeeping agencies of the Commonwealth," including the FCPD, "shall adhere to the following principles of information practice to ensure safeguards for personal privacy: ... Information shall not be collected unless the need for it has been clearly established in advance ..." Va. Code § 2.2-3800(C)(2). An "information system" OPINION LETTER Re: Harrison Neal v. Fairfax County Police Department, et of. Case No. CL-2015-5902 April 1, 2019 Page 2 of S subject to the Data Act is defined as "the total components and operations of a record-keeping process" that contains "personal information and the name, personal number, or other identifying particulars of a data subject." Id § 2.2-3801 (emphasis added). The Data Act does not apply to systems "that deal with investigations and intelligence gathering related to criminal activity[.]" Id. § 2.2-3802. The recitation of facts in my first opinion is appropriate now: The parties do not dispute the following facts. FCPD is the primary law enforcement agency in Fairfax County. Since at least 2010, FCPD has used ALPR technology, in the form of specialized cameras mounted on either a police cruiser or a stationary structure, to capture and thereafter maintain a database of the captured individual license plate numbers. In addition to the license plate number, the ALPR records the date, time, and location of each capture. After an ALPR camera captures an image of a license plate, optical character recognition technology converts the image into text. FCPD's ALPRs capture license plates at a rate of up to 3,600 plates per minute. The ALPR technology automatically crosschecks captured license plates against a list of known license plates associated with suspected criminal activity—the Virginia State Police (State Police) "hot list." Also called "active use," Plaintiff does not challenge the propriety of the use of the hot list. The State Police publishes the hot list twice daily, and the information is available to authorized law enforcement personnel via a secure website. The hot list is imported into the ALPR system either automatically through a server or manually by the end user. The end user may also manually enter a wanted vehicle license plate into the ALPR system along with a notation regarding the reason for entry (e.g. stolen vehicle, abduction, or robbery suspect). The ALPR software runs in the background of a Mobile Computer Terminal (MCT) and automatically alerts police operators to potential stolen vehicles or license plates in their vicinity by an audible and visual alarm on the computer screen. Irrespective of whether a "hit" occurs, FCPD stores the captured license plate information in a database for 364 days. After 364 days the data are purged from the database. This is called "passive use." The Plaintiffs complaint exclusively addresses this passive use. On May 7, 2014, Plaintiff Harrison Neal, a resident of Fairfax County, submitted a request to FCPD pursuant to The Act and the Virginia Freedom of Information Act (FOIA), Va. Code §§2.2-3700, for all documents in FCPD's custody pertaining to his license plate number "ADDCAR." On May 15, 2014, FCPD produced documentation from two instances where an FCPD ALPR camera captured an image of the "ADDCAR" license plate. The first capture occurred on April 26, 2014. The second capture occurred on May 11, 2014. FCPD maintained both images in its ALPR database. The database did not contain Neal's name, address, date of birth or any information related to the registered owner of the OPINION LETTER Re: Harrison Neal v. Fairfax County Police Department, et al. Case No. CL-2015-5902 April 1, 2019 Page 3 of 5 vehicle associated with the "ADDCAR" license plate number. The only information stored as to the "ADDCAR" license plate was the photographs, and the date, time and UPS coordinates of the locations where the photos were captured. Plaintiff Neal brought this action contesting the legality of the retention of the information obtained by the ALPR readers. Specifically, Neal claimed that the ALPR database is an "information system" that gathers personal information during its "passive use" and is therefore not only subject to the Data Act, but is being used by the FCPD in direct contravention to the Act This Court heard cross-motions for summary judgment on September 8, 2016. After argument by counsel and considering the pleadings of the parties, I granted summary judgment for the FCPD and dismissed the plaintiff's motion for summary judgment. In so doing, I specifically held that a license plate is not personal information, and therefore the ALPR was not subject to the Data Act. The Plaintiff appealed to the Supreme Court of Virginia. On April 26, 2018, the Supreme Court reversed that decision and remanded the case. In examining the information collected by the ALPR system, the Supreme Court posited that "the pictures and data associated with each license plate number constitute "personal information" as defined by [the Data Act]." Id. at 346 (emphasis added). The Supreme Court also held that while a license plate number alone "would not be "personal information" because there is nothing about a license plate number that inherently "describes, locates or indexes anything about an individual," it could subject the ALPR system to the Data Act if the license plate number is used to identify the owner of the vehicle.2 Neal v. Fairfax County Police Department, et al., 295 Va. 334, 345-6 (2018). The Supreme Court then found that because the ALPR system is a "record-keeping process" that includes "personal information," namely, the pictures and data associated with the license plates, the one issue left to decide under the Data Act is whether the ALPR system also contains "the name, personal number, or other identifying particulars" of a vehicle's owner. Id. at 347; see Va. Code § 2.2-3801. Consequently, the Supreme Court left the following for the trial court to determine: "[W]hether the total components and operations of the ALPR record-keeping process provide a means through which a link between a license plate number and the [identity of the] vehicle's owner may be readily made." /d.3 This Court, as directed, conducted a hearing on December 18 and 19, 2018. This Court took the matter under advisement. The reasoning for my decision follows. 'On January 2, 2016, Neal submitted a second request pursuant to the Act and VAFOIA for copies of all documents in FCPD's custody pertaining to the license plate number "ADDCAR." On January 13, 2016, FCPD notified Neal that FCPD did not have any documents responsive to his 2016 request. 2 The Supreme Court uses the example of the Department of Motor Vehicles' database, which does just that. 3 The Court also noted that the Police Department's "passive use" of the ALPR system does not fall under the exemption to the Data Act because, as the Department admitted in its response to Neal's first request for admissions, that "at the time they (sic) captured and stored the ADDCAR ALPR information, that information had not been deemed part of any specific law enforcement investigation or purpose." Neal, 295 Va. at 349. OPINION LETTER Re: Harrison Neal v. Fairfax County Police Department, et al. Case No. CL-2015-5902 April 1, 2019 Page 4 of5 FINDINGS OF FACT AT THE DECEMBER 18111, 2018 IIEAR1NG The evidence presented and the arguments made by counsel centered on the utilization of the ALPR system by police officers to match a license plate number with the identity of the vehicle's owner through the National Criminal Information Center (NCIC), the Virginia Criminal Information Center (VCIC), and the Department of Motor Vehicles (DMV) databases. From the evidence produced at trial, the following facts are found, in addition to those from the prior hearing: The ALPR system includes a hardware, software and a server component. The hardware is a computer in the trunk of a police cruiser that converts the images of license plates, taken by the cameras, into letter/number combination sequences. This computer processer is connected by an Ethernet cable to the laptop computer, or Mobile Data Terminal ("MDT") in the front of the cruiser. The ALPR system has a software program that is accessible on the MDT. The officer must log in to access the program. The operation system, or EOC, for the ALPR recordkeeping process is located in the County's Government Center. All information collected from the ALPR cruiser cameras are stored in the EOC. Information that is not identified as part of a criminal investigation will remain in the EOC for 364 days, after which it is purged. Only certified ALPR users, who are issued a unique user ID and password, can access the ALPR system. To search the EOC for information, an officer must log into the software on the MDT and enter the license plate number into the search field. If the license plate number is stored in the EOC, the officer will be able to view the following information on the MDT screen: a photograph of the license plate, the license plate number, and the date, time, and GPS location of the photograph capturing the license plate. The EOC and the computer processor in the trunk of the cruiser only contain ALPR information and are separate from all other databases. To access the NCIC, maintained by the Federal Bureau of Investigation (FBI), the VCIN or the DMV databases, an officer must log into a separate software program called I/MOBILE with a unique state-issued user ID, which is separate from the Fairfax County user ID. If an officer acquires a license plate number from the ALPR software on the MDT, then she may use the license plate number to discover the identity of the vehicle's owner by closing out of the ALPR software, then signing into the I/MOBILE software and entering the license plate number, all on the MDT. Thus, while an officer can access all above-mentioned databases from the same computer, human intervention is required to match personal, identifying information from one database with the license plate number in the ALPR database. ANALYSIS If the only issue before the Court was whether the link must be automatic to be found invalid, the defendant's position might well carry the day. However, the Data Act defines "information system" as: OPINION LETTER Re: Harrison Neal v. Fairfax County Police Department, et al. Case No. CL-2015-5902 April I, 2019 Page 5 of 5 The total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject. Va. Code §2.2-3801 (emphasis added). The methodology here requires no less than two computer programs and three passwords. Such requirements, while perhaps cumbersome, do not necessarily preclude an establishment of a sufficient link under the Supreme Court's analysis and the Data Act. While the Supreme Court did not define a "link," Merriam-Webster's Dictionary denotes a "link" as "an identifier attached to an element (such as an index term in a database) in order to indicate or permit connection with other similarly identified elements."4 Having now conducted a full hearing and observing the evidence presented, I must conclude that such a link exists. While the Court deduces the ALPR record-keeping process does not itself gather or directly connect to "identifying particulars" of a vehicle owner, the ALPR system does enable police officers to cross-reference ALPR data with the identity of an individual. In other words, access to the license plate number stored in the ALPR system "permit[s] connection" to the identity of the vehicle's owner with a few clicks on the screen, all from the driver's seat of a police cruiser. Under the Supreme Court's direction, therefore, I find that the ALPR record-keeping process is subject to the Data Act in its "passive use." CONCLUSION After reviewing the evidence presented at trial, I find that the ALPR system provides a means through which a link to the identity of a vehicle's owner can be readily made. The Police Department's "passive use" of the ALPR system therefore violates the Data Act. Accordingly, the petition for injunction is granted. Counsel for the plaintiff will prepare and circulate an order for the parties to sign and to submit to the Court on my civil motions docket, April 5, 2019, at 10:00 AM. Sincerely, k Robert J. Smi I Judge, Fairf ounty Circuit Court Link, MERR1AM-WEBSTER.COM, https://www.merriam-webster.com/dictionary/link (last visited March 28, 2019). In her closing argument, Counsel for FCPD provided the Court with Merriam-Webster's other definition for link, namely, as a "connecting structure." This citation led me to the definition cited above, which I think is more suitable here. 4 OPINION LETTER