In 2017, EFF urged the Supreme Court of Virginia to protect the state's residents from a police surveillance database created with automated license plate readers (ALPRs). Fairfax County Police Department uses ALPRs that read every license plate that goes by, and stores the records for up to a year. Harrison Neal’s plate was collected at least twice, and he sued with the help of the ACLU of Virginia.

In 2018, the Virginia Supreme Court held that the photographic and location data stored in the department’s database met the state Data Act’s definition of ‘personal information,’ holding that the Police Department collected and retained personal information without any suspicion of criminal activity at any level of abstraction, and thus created an information system that does not “deal with investigations and intelligence gathering related to criminal activity.”  However, the court sent the case back to the trial court to determine whether the database met the Act’s definition of an “information system.”

In 2019, Fairfax County Circuit Court Judge Robert J. Smith, ordered an injunction against the use of the license plate database, finding that the “passive” use of Fairfax County Police Department’s Automated License Plate Reader (ALPR) system violated Virginia’s Government Data Collection and Dissemination Practices Act (Data Act). This meant that the Fairfax County Police would be required to purge its database of ALPR data that isn’t linked to a criminal investigation and stop using ALPRs to passively collect data on people who aren’t suspected of criminal activity. However, later in 2019, the Fairfax police appealed this ruling. EFF filed another amicus brief in the case, arguing that the state supreme court should find that the ALPR system is an "information system" and order the Fairfax police to purge its database of passive ALPR data once and for all. 

In 2020, the Virginia Supreme Court held that the Fairfax County Police Department's ALPR database is not an "information system" under the Virginia Data Act, and therefore does not violate the Virginia Data Act. It explained that the database is not an "information system" because the data that the system captures, such as license plate numbers and images of vehicles, can be used to identify individuals only once law enforcement officers consult information in a separate database, such as the state DMV database - even though officers can consult other databases to identify the vehicles captured in just a few clicks of a screen, right from the driver's seat of a police car.

We hope that the Virginia legislature will amend the Data Act in response to this decision and ensure that privacy protections extend to ALPR data.