Full Report
The company Flok is surveilling us as we drive: A retired veteran named Lee Schmidt wanted to know how often Norfolk, Virginia’s 176 Flock Safety automated license-plate-reader cameras were tracking him. The answer, according to a U.S. District Court lawsuit filed in September, was more than four times a day, or 526 times from mid-February to early July. No, there’s no warrant out for Schmidt’s arrest, nor is there a warrant for Schmidt’s co-plaintiff, Crystal Arrington, whom the system tagged 849 times in roughly the same period. You might think this sounds like it violates the Fourth Amendment, which protects American citizens from unreasonable searches and seizures without probable cause. Well, so does the American Civil Liberties Union. Norfolk, Virginia Judge Jamilah LeCruise also agrees, and in 2024 she ruled that plate-reader data obtained without a search warrant couldn’t be used against a defendant in a robbery case...
Analysis Summary
# Regulation/Compliance: Automated License Plate Reader (ALPR) Data Privacy and Use (Focusing on Legal Precedents)
## Overview
This summary covers the developing legal landscape surrounding the use of Automated License Plate Readers (ALPRs), specifically referencing the activities of the company Flok and associated surveillance practices in Norfolk, Virginia. The core issue addressed is the collection, retention, and use of ALPR data without user consent or specific legal authorization (like a warrant), and its intersection with constitutional privacy rights.
## Key Details
- **Issuing Authority:** U.S. District Courts (Judicial Precedents referenced: Judge Jamilah LeCruise in Norfolk, VA). Private companies (Flok) acting as data collectors.
- **Effective Date:** Precedents cited from 2024. The general legal framework (Fourth Amendment) is ongoing.
- **Jurisdiction:** United States (specific case example from Norfolk, Virginia). Applies to any jurisdiction using or contracting with ALPR vendors like Flok.
- **Status:** Judicial interpretations are 'In Effect' as precedent, but comprehensive federal/state legislation on ALPR data retention and use appears nascent or absent.
## Requirements
### Mandatory Requirements (Based on Judicial Rulings)
1. **Warrant Requirement for Data Use:** ALPR data obtained without a search warrant cannot be used against a defendant in criminal proceedings (as established by Judge LeCruise in the referenced case).
2. **Fourth Amendment Adherence:** Law enforcement utilization of ALPR data must comply with the Fourth Amendment's protection against unreasonable searches and seizures without probable cause.
3. **Private Actor Restrictions:** If private actors (like Flok) collect and sell surveillance data to law enforcement, this practice may also be challenged legally unless appropriate legal standards (like warrants) are met.
### Recommended Practices (Based on Privacy Concerns Raised)
1. **Minimization of Data Retention:** Organizations should minimize the period for which non-pertinent ALPR scans or tracking data are stored, especially if the data is not directly tied to an active investigation or wanted party.
2. **Transparent Usage Policies:** Clear policies must be established regarding how ALPR data is collected, who has access, and under what legal conditions it is shared with law enforcement.
3. **Proportionality of Collection:** The scope and frequency of surveillance (e.g., tracking an individual 526 times in a few months without cause) should be proportionate to legitimate safety needs.
## Affected Organizations
- **Industries:** Law Enforcement Agencies (Local, State, Federal), Government Contractors providing surveillance technology (e.g., Flok), and associated Data Processors. Private entities operating large-scale tracking systems.
- **Organization Size:** Applicable to any jurisdiction or agency deploying ALPRs, regardless of size.
- **Geographic Scope:** United States, with specific reliance on interpretations of the U.S. Constitution (Fourth Amendment).
## Compliance Timeline
The summary does not specify universal regulatory deadlines, as the context primarily revolves around ongoing litigation and judicial rulings.
- **2024:** Judicial ruling (Norfolk) established that warrantless ALPR data is inadmissible in court.
- **Ongoing:** Continued litigation challenges the mass, suspicionless collection of data by private vendors and law enforcement.
- **Future Legislative Deadlines:** Dependent on state or federal legal action to codify privacy standards for ALPR data.
## Implementation Guidance
### Assessment Phase
- **Data Audit:** Determine which private vendors (e.g., Flok) are currently contracted, what data they collect (location, time stamps), and current data retention policies (e.g., duration of data storage).
- **Legal Review:** Assess current internal protocols for accessing and utilizing ALPR data against the Fourth Amendment standards established by recent court rulings.
### Implementation Phase
- **Policy Revision:** Update data retention schedules to align with probable cause or warrant requirements for prolonged tracking or data correlation.
- **Vendor Contract Review:** Ensure vendor contracts explicitly define data access limitations and privacy assurances compliant with constitutional law.
### Validation Phase
- **Admissibility Testing:** Hypothetically or through simulated internal reviews, test if collected data would stand up to a warrant challenge in court.
- **Scope Review:** Verify systems are not unnecessarily capturing or correlating data on individuals absent a specific investigatory lead.
## Technical Requirements
The technical requirements are implied by the focus on *tracking*:
1. **Data Segregation:** Systems should allow for easy data segregation between investigative leads (requiring warrants/probable cause) and routine or bulk logging data.
2. **Access Controls:** Strict, auditable access controls must be implemented, logging *who* accessed *which* license plate records and *why*.
## Penalties & Enforcement
- **Fines:** Not explicitly detailed in the summary regarding statutory fines for non-compliance, but penalties would likely involve contractual breach with local governments.
- **Other Consequences:** Evidence obtained in violation of Fourth Amendment protections (unwarranted surveillance data) is subject to the **Exclusionary Rule** (inadmissible in court). Plaintiffs in civil suits (like Schmidt and Arrington) are actively seeking redress against constitutional violations.
- **Enforcement:** Primarily through criminal evidentiary challenges (Exclusionary Rule) and civil rights litigation.
## Related Standards
- **U.S. Constitution:** Fourth Amendment (protection against unreasonable searches and seizures).
- **General Privacy Frameworks:** While not specifically named, best practices would align with principles favoring data minimization, typical of strong privacy mandates (e.g., GDPR principles regarding proportionality, though not legally binding in this context).
## Resources
- **Official Documentation:** U.S. District Court ruling documentation referenced (e.g., Norfolk case documents).
- **Guidance Documents:** ACLU publications regarding ALPR use and constitutional rights.
- **Tools:** Maps showing ALPR coverage (e.g., deflock.me/map) can be used to scope the extent of collection.
## Practical Recommendations
1. **Immediate Legal Review:** Organizations utilizing ALPRs must urgently consult legal counsel to align data retention and access policies with recent judicial interpretations upholding Fourth Amendment rights against suspicionless location tracking.
2. **Audit Data Retention:** Unless legally required for a specific case, implement aggressive data purging timelines for collected ALPR metadata to reduce exposure to litigation.
3. **Focus on Safety Over Surveillance Scope:** If the goal is general traffic safety (e.g., speeding enforcement), ensure surveillance methods are narrowly tailored and do not functionally build pervasive movement profiles of the entire driving population.