Neal v. Fairfax County Police Department

OPINION BY JUSTICE CLEO E. POWELL In this appeal, we consider whether the Circuit Court of Fairfax County erred when it determined, on summary judgment, that the retention of information gathered and stored by a police department using automated license plate readers ("ALPR") did not constitute a violation of the Government Data Collection and Dissemination Practices Act ("Data Act"), Code §§ 2.2-3800 to -3809. I. BACKGROUND On May 9, 2014, Harrison Neal ("Neal") submitted a Virginia Freedom of Information Act ("FOIA") request to the Fairfax County Police Department ("Police Department") seeking its ALPR records regarding his vehicle "with VA tag ADDCAR." The Police Department responded that "[w]ithin the last 364 days [Neal's] tag was read twice by [the Police Department's] ALPR system" and sent Neal two sheets of paper, each of which contained two pictures of his vehicle with the ADDCAR license plate affixed, and a chart that indicated the time, date, and GPS location from which at least one of the photographs was taken. On May 5, 2015, Neal filed a complaint against the Police Department and Chief of Police Colonel Edwin C. Roessler, Jr. (hereafter collectively "FCPD") seeking "an injunction and/or writ of mandamus" pursuant to the Data Act. Neal sought to prohibit the Police Department from continuing to collect and store license plate data without suspicion of any criminal activity, which is sometimes referred to as the "passive use" of ALPRs. 1 The Data Act governs "recordkeeping agencies" and "political subdivisions" of the Commonwealth and was enacted to better "ensure safeguards for personal privacy" by government agencies. Code § 2.2-3800. Specifically, Neal alleged that the Police Department's "passive use" of ALPRs violates several provisions of the Data Act, including the requirement in Code § 2.2-3800(C)(2) that information not be collected "unless the need for it has been clearly established in advance" of collecting that information. Subsequently, FCPD filed an answer and grounds of defense. FCPD admitted that the Police Department uses ALPRs in the "active" and "passive" manners described in Neal's complaint, but denied that either use violated the Data Act. It further denied that Neal had a right to relief under the Data Act because "[a] license plate number is not personal information." On August 4, 2016, FCPD filed a motion for summary judgment. In support, FCPD identified the following as facts not genuinely in dispute: 1. The Police Department's ALPRs use "cameras, which can be stationary or mounted on a police vehicle, and which capture images of passing vehicles' license plates;" 2. when the ALPR captures the image, an application converts the license plate image into an alpha-numeric combination, not state specific, that is compared in real time against a "hot list" of license plate numbers; 3. the Police Department operates an electronic ALPR database that stores the captured images; the alpha-numeric conversion of the license plate number; and the time, date, and location from which the image was captured (ALPR information) for 364 days; 4. the ALPR database is an investigative tool to detect criminal activity or respond to other calls for service, including AMBER alerts and missing or endangered person alerts; 5. the Police Department may access the ALPR database to assist in its criminal investigations as well as criminal investigations of other localities; 6. the ALPR database may only be searched by license plate number and does not list the "make, model, year, or registration information" of a vehicle; 7. the ALPR equipment does not "photograph or otherwise identify the owner or driver of the vehicle" or capture his or her identifying information; 8. the ALPR information concerning the ADDCAR license plate "did not contain Neal's name, address, date of birth, or any information related to the individual to whom the ADDCAR license plate number was registered;" 9. during the period that the ALPR information related to the ADDCAR license plate was stored, the Police Department was participating in two regional task forces involving the criminal investigation of burglaries in the region and used the ALPR database to support their investigative efforts. Given these facts, FCPD argued that Neal's complaint should be dismissed and that Neal was not entitled to relief because he failed to establish that the ALPR database "contain[ed] information specific to Neal." They also argued that, even if the license plate number was considered Neal's "personal information," Neal failed to prove that the ALPR database contained "a second piece of information that constitutes 'the name, personal number, or other identifying particulars of the data subject,' " to constitute an "information system" as defined by the Data Act. Finally, FCPD argued that the ALPR database is exempt from the operation of the Data Act because it " 'deal[s] with investigations and intelligence gathering related to criminal activity,' " and is thereby excluded under Code § 2.2-3802(7). Later that same day, Neal also filed a motion for summary judgment, arguing that the Police Department's ALPR system was governed by the Data Act. Neal's statement of undisputed facts was similar to FCPD's but included the following additional facts: (1) the Police Department's ALPR database stored images of Neal's vehicle and Virginia license plate; and (2) the Police Department can readily access databases operated by the Virginia Department of Motor Vehicles ("DMV") and can obtain "personal information" from those databases using ALPR information, including social security numbers, dates of birth, and addresses. In support of his motion, Neal cited the General Assembly's stated purpose in creating the Data Act, including the increased possibility of harm that can come from developments in information technology and the effect this can have on "[a]n individual's opportunities to secure employment, insurance, credit and his right to due process." Code § 2.2-3800(B)(3). Neal also cited an opinion of the Attorney General, in which the Attorney General concluded that the Virginia Department of State Police's ("State Police") "passive" collection and storage of information obtained by ALPRs violated the Data Act because the need for this information was not "clearly established in advance." 2013 Va. Op. Att'y Gen. 12-073, 2013 WL 653025 , at *3, 2013 Va. AG LEXIS 9, at *8 (Feb. 13, 2013) ("Attorney General Opinion"). FCPD and Neal each filed briefs in opposition to the other party's motion on similar grounds as their respective cross-motions. The parties did not contest the facts the other identified as undisputed. 2 The circuit court held a hearing on the cross-motions for summary judgment on September 8, 2016. During the hearing, FCPD conceded that if (1) the ALPR information related to the ADDCAR license plate is considered "personal information" protected by the Data Act and (2) the Police Department's ALPR database is "an 'information system' that houses 'personal information' about a 'data subject' " and (3) the ALPR database is not exempt from the Data Act, then the "current policy does not follow the parameters of the [Data] Act" and Neal is entitled to relief. After the hearing, the circuit court took the motions under advisement and subsequently issued a letter opinion in which it granted FCPD's motion for summary judgment and denied Neal's cross-motion. The circuit court found "that a license plate number is not personal information" as defined in the Data Act, noting that each example of "personal information" listed in Code § 2.2-3801 's definition referred to "an individual person" but a license plate number refers to a vehicle rather than a person. Having determined that there was no material issue of fact and that a license plate number is not personal information, the circuit court concluded that the Data Act did not apply and dismissed the case with prejudice. Neal appeals. II. ANALYSIS On appeal, Neal argues that the circuit court granted FCPD's motion for summary judgment based on an erroneous interpretation of the term "personal information" and that, under a correct interpretation of the Data Act, the ALPR information pertaining to his vehicle was clearly "personal information" that was stored in violation of the Data Act. Neal argues that the General Assembly intentionally defined "personal information" broadly to "encapsulate[ ] 'all information' that ... allows any inference about an individual's 'personal characteristics,' activities, or associations." Code § 2.2-3801 (emphasis added). He contends that, because a vehicle is registered to an owner, it is a fair inference that the vehicle is being driven by that owner. Thus, the license plate number, the location where that license plate was seen, photos of the vehicle containing the license plate, decals, bumper stickers, and "sometimes the silhouette(s) of vehicle occupant(s)" all constitute "personal information" as defined by the Data Act. Further, Neal argues that the license plate number is itself an "agency-issued identification number" because it is issued to the registered owner or owners of the vehicle. In response, FCPD argues that the circuit court did not err in holding that a vehicle's license plate number is not "personal information" because a license plate number is associated with a vehicle rather than with a specific individual. It also argues that the ALPR database is not an "information system" because the Police Department's "ALPR database maintains only the vehicle license plate number" and does not contain any other personally identifying information about the owner or driver of the vehicle. In turn, because the ALPR database is not an "information system," FCPD contends that Neal cannot be a "data subject" because he is not "an individual about whom personal information is indexed ... in an information system." Additionally, FCPD argues that the Police Department's ALPR database is expressly exempt from operation of the Data Act, because the database "deals with investigations and intelligence gathering related to criminal activity" in that it is used to solve crimes and apprehend criminals. Our analysis in this case turns on the proper construction and interpretation of the Data Act. Where the issue on appeal is "the construction and application of a statute by a circuit court ruling upon cross-motions for summary judgment," this Court reviews "de novo both the construction of the relevant statute and its application to the undisputed facts stipulated in the record." Board of Supervisors of James City County v. Windmill Meadows, LLC , 287 Va. 170 , 175, 752 S.E.2d 837 , 839 (2014) (citation omitted). A statute whose purpose is to "provide protections to those otherwise not in a position to effectively defend themselves" is "remedial." Board of Supervisors of Richmond County v. Rhoads , 294 Va. 43 , 51, 803 S.E.2d 329 , 333 (2017) (classifying Code § 15.2-2311(C) as a remedial statute because it is intended to provide relief to property owners who detrimentally rely in good faith on an erroneous zoning determination). The Data Act expressly declares its remedial purpose is to "preserve the rights guaranteed a citizen in a free society" by "establish[ing] procedures to govern information systems containing records on individuals." Code § 2.2-3800(B)(4). Notably, the General Assembly includes in the statute specific findings, including that "[a]n individual's privacy is directly affected by the extensive collection, maintenance, use and dissemination of personal information;" "sophisticated information technology has greatly magnified the harm that can occur from these practices;" "[a]n individual's opportunities to secure employment, insurance, credit, and his right to due process, and other legal protections are endangered by the misuse of certain of these personal information systems;" and "legislation is necessary to establish procedures to govern information systems containing records on individuals." Code § 2.2-3800(B)(1)-(4). Further, to achieve the legislature's stated purpose, Code § 2.2-3809 provides a mechanism for relief to "[ a ] ny aggrieved person" by which that person "may institute a proceeding for injunction or mandamus against any person or agency that has engaged, is engaged, or is about to engage in any acts or practices in violation of the provisions of this chapter." (Emphases added.) "Every statute is to be read so as to promote the ability of the enactment to remedy the mischief at which it is directed." Board of Supervisors of King and Queen County v. King Land Corp. , 238 Va. 97 , 103, 380 S.E.2d 895 , 897 (1989) (citation and internal quotation marks omitted). Remedial statutes are to be liberally construed "so as to suppress the mischief and advance the remedy in accordance with the legislature's intended purpose." University of Virginia v. Harris , 239 Va. 119 , 124, 387 S.E.2d 772 , 775 (1990) (citation and internal quotation marks omitted) (emphasis removed). "All other rules of construction are subservient to that intent." Id. FCPD has conceded that if ALPR information is "personal information" and the Police Department's ALPR database is an "information system," as defined within the Data Act, and the ALPR database is not exempt from the Data Act, then the "passive use" of ALPRs is in violation of the Data Act. Thus, this Court must examine the language of the Data Act as well as the undisputed facts to determine whether (1) the Police Department's ALPR information constitutes "personal information," (2) its ALPR database is an "information system," and (3) its ALPR database is exempt from the Data Act. We must also discern the proper interpretation of the Data Act in light of its remedial purpose. A. Personal information Our analysis on this issue begins by noting that the ALPR information stored in the ALPR database consists of two distinct types of information: the license plate numbers and the picture and data associated with each license plate number. Accordingly, we will analyze each type of information in turn to determine whether it constitutes "personal information" under the Data Act. The Data Act defines "personal information" as all information that (i) describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver's license number, agency-issued identification number , student identification number, real or personal property holdings derived from tax returns, and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, or (ii) affords a basis for inferring personal characteristics , such as finger and voice prints, photographs, or things done by or to such individual; and the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Code § 2.2-3801 (emphases added). Under this definition, a license plate number may be deemed "personal information" in certain contexts because it is technically an "agency-issued identification number." The DMV is an agency of the Commonwealth of Virginia. Code § 46.2-200. Upon registration of a motor vehicle, the DMV issues license plates that "shall display the registration number assigned to the motor vehicle ... and to the owner thereof ." Code §§ 46.2-711(A) and -712(A) (emphases added). Therefore, in the context of the DMV database, a license plate number, such as "ADDCAR," is an agency-issued number that identifies the owner of the vehicle, in this case Neal. See Collins v. Commonwealth , 292 Va. 486 , 489-90, 790 S.E.2d 611 , 613 (2016) ("The license plate was most recently registered to [an individual]."); Frye v. Commonwealth , 231 Va. 370 , 386-87, 345 S.E.2d 267 , 279 (1986) ("A DMV computer check showed the license [number of the vehicle] was registered to a Hampton, Virginia, resident."). However, in other contexts, a license plate number would not be "personal information" because there is nothing about a license plate number that inherently "describes, locates or indexes anything about an individual." Without something connecting the license plate number to an individual, it is just a combination of letters and numbers that does not describe, locate or index anything about anyone. Moreover, this combination of letters and numbers is only unique to the state issuing the license plate number. As previously noted, the alpha-numeric conversion of the license plate number in the ALPR database is not state specific. Therefore, a license plate number in the ALPR database could, theoretically, be associated with over 50 different vehicles. Moreover, unlike a social security number or a driver's license number, both of which are assigned to and identify a specific individual, a license plate number is assigned to a specific vehicle and identifies the owner of that vehicle which may not be an individual. Indeed, a license plate number may identify multiple individuals. See Code § 46.2-622 (permitting the issuance of a certificate of title to multiple individuals). Alternatively, the owner of a vehicle may not be an individual at all. See Code § 46.2-623(A)(ii) (permitting vehicles to be registered to businesses). Accordingly, a license plate number stored in the ALPR database would not be personal information because it does not describe, locate or index anything about an individual. On the other hand, the pictures and data associated with each license plate number constitute "personal information" as defined by Code § 2.2-3801. The images of the vehicle, its license plate, and the vehicle's immediate surroundings, along with the GPS location, time, and date when the image was captured "afford a basis for inferring personal characteristics, such as ... things done by or to" the individual who owns the vehicle, as well as a basis for inferring the presence of the individual who owns the vehicle in a certain location at a certain time. Code § 2.2-3801. The conclusion that the picture and associated data is "personal information" is consistent with the legislature's intent to remedy the potential mischief posed by "the extensive collection, maintenance, use and dissemination of personal information" and the potential for misuse of such information. Code § 2.2-3800(B)(1) ; see University of Virginia , 239 Va. at 124 , 387 S.E.2d at 775 . B. Information System The Data Act defines an "information system" as "the total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject." Code § 2.2-3801. In turn, a "data subject" is defined as "an individual about whom personal information is indexed or may be located under his name, personal number, or other identifiable particulars, in an information system." Id. Thus, an agency's "record-keeping process" is an "information system" if it contains both "personal information and the name, personal number, or other identifying particulars" of an individual. Id. Here, as explained above, the Police Department's "passive use" of its ALPRs, including the ALPR database, is a "record-keeping process" that includes data that contains "personal information," in that the ALPR database captures and stores images of the vehicle, as well as the time, date, and GPS location when the images were captured. Thus, the determination of whether the ALPR database is an "information system" under the Data Act turns on whether it also contains "the name, personal number, or other identifying particulars" of an individual. The term "identifying particulars" is not defined, but "according to the maxim noscitur a sociis (associated words) when general and specific words are grouped, the general words are limited by the specific and will be construed to embrace only objects similar in nature to those things identified by the specific words." Wood v. Henry Cty. Pub. Sch. , 255 Va. 85 , 94-95, 495 S.E.2d 255 , 260-61 (1998) (internal citations omitted). Unless otherwise indicated, "the general words" are construed to include "those matters of the same import as that of the specific items listed." Kappa Sigma Fraternity, Inc. v. Kappa Sigma Fraternity , 266 Va. 455 , 470, 587 S.E.2d 701 , 710 (2003). Construing "identifying particulars" to include "matters of the same import" as the more specific terms listed, a license plate number may be an "identifying particular" because it has the potential to identify the individual to whom the plate number is registered in the same way a "name" or "personal number" identifies the individual to which it is assigned. In the present case, however, it remains to be seen whether a sufficient link can be drawn to qualify a license plate number as an "identifying particular." Although the ALPR database does not contain any information related to the individual to whom a specific license plate number is registered, that does not mean that the total components of the Police Department's ALPR record-keeping process do not provide a means for discerning that information. On the record before this Court, however, we cannot say whether or not such a means exists as part of the ALPR record-keeping process. Accordingly, we will remand the matter to the circuit court for a determination of whether the total components and operations of the ALPR record-keeping process provide a means through which a link between a license plate number and the vehicle's owner may be readily made. C. Exemption Having determined that the Police Department's ALPR database may fall under the Data Act because the pictures and associated data may be considered "personal information," the Police Department's retention of the information captured by ALPRs may create an "information system," and that Neal may be a "data subject," it is necessary for us to also examine FCPD's claim that the Police Department's "passive use" of ALPRs is, nevertheless, exempt from the operation of the Data Act. Code § 2.2-3802 provides that the Data Act "shall not apply to personal information systems: ... that deal with investigations and intelligence gathering related to criminal activity ." Code § 2.2-3802(7) (emphasis added). The exclusion goes on to identify such investigative and intelligence gathering bodies as including "(c) Police departments of cities, counties, and towns." Here, FCPD admitted in its response to Neal's first request for admissions, that, at the time they captured and stored the ADDCAR ALPR information, that information "ha[d] not been deemed part of any specific law enforcement investigation or purpose." Accordingly, storing that information did not have any "relation to" or "connection with" criminal activity. While the Police Department's "passive use" of its ALPRs may deal with intelligence gathering for general law enforcement purposes, the Code § 2.2-3802(7) exemption only applies to the collection and maintenance of "personal information" related to some specified criminal activity. In an opinion considering whether Code § 2.2-3802(7) applied to the State Police ALPR system, the Attorney General stated: "the Data Act does not preclude law enforcement agencies from maintaining, using and disseminating personal information collected by [ALPRs], provided such data specifically pertains to investigations and intelligence gathering relating to criminal activity ." 2013 Va. Op. Att'y Gen. 12-073, 2013 WL 653025 , at *1, 2013 Va. AG LEXIS 9, at *1 (February 13, 2013) (emphasis added). The Attorney General Opinion further states that, by contrast, when "personal information" is stored to remain searchable at a later date "to determine if, when and where a license plate matching the query was encountered," "[i]ts future value to any investigation or criminal activity is wholly speculative," and the law enforcement exemption in Code § 2.2-3802(7) does not apply. Id. at *3, 2013 Va. AG LEXIS 9, at *8. Although not binding authority, the prior interpretation of the exemption in Code § 2.2-3802(7) in an Attorney General Opinion is entitled to due consideration. City of Virginia Beach v. Virginia Rest. Ass'n , 231 Va. 130 , 135, 341 S.E.2d 198 , 201 (1986). We agree with the Attorney General's conclusion that the General Assembly did not exempt all "personal information systems" operated by law enforcement but only those that "specifically pertain[ ] to investigations and intelligence gathering relating to criminal activity." 2013 Va. AG LEXIS 9, at *1. We conclude that the Police Department's sweeping randomized surveillance and collection of personal information does not "deal[ ] with investigations and intelligence gathering related to criminal activity" and, therefore if the ALPR database is determined to be an information system, it is not exempt from the operation of the Data Act. 3 III. CONCLUSION The pictures and associated data stored in the Police Department's ALPR database meet the statutory definition of "personal information." Code § 2.2-3801. However, on the record before the Court, we are unable to determine whether the Police Department's retention and "passive use" of information generated by ALPRs may be classified as an "information system" governed by the Data Act. Accordingly, the judgment of the circuit court granting summary judgment in favor of FCPD is reversed. The case will be remanded for a determination of whether the total components and operations of the ALPR record-keeping process provide a means through which a link between a license plate number and the vehicle's owner may be readily made. If such a means exists, then the Police Department's "passive use" of ALPRs is not exempt from the operation of the Data Act under the law enforcement exception of Code § 2.2-3802(7), because the Police Department collected and retained personal information without any suspicion of criminal activity at any level of abstraction, and thus created an information system that does not "deal with investigations and intelligence gathering related to criminal activity." Reversed and remanded. Footnotes [1] Neal does not challenge and we do not address the "active use" of ALPRs, which consists of a real time check of license plate numbers against a "hot list" of license plate numbers to quickly identify vehicles that have been reported stolen, missing, or suspected of involvement in a crime. [2] The only "undisputed fact" that Neal appeared to contest was that FCPD stated in their motion for summary judgment that "the ALPR images ... are 'not state specific,' " but in fact FCPD did not state the ALPR images were not state specific but only that the alpha-numeric conversion of the license plate was not state specific. [3] Nothing in our opinion suggests that "investigations and intelligence gathering related to criminal activity," as used in Code § 2.2-3802(7), is limited to past or present criminal activity to the exclusion of future criminal activity. The Fourth Amendment does not make this distinction. See United States v. Perkins , 363 F.3d 317 , 326 (4th Cir. 2004) (observing that officers may "take preventive action ... before crimes are committed, based on what they view as suspicious-albeit even legal-activity.") (emphasis in original). We see no reason why the statutory authority to conduct "investigations and intelligence gathering" under Code § 2.2-3802(7) would either. However, because this case provides no occasion to determine the statutory standard applicable to investigating or gathering intelligence concerning suspected future crimes under Code § 2.2-3802(7), we offer no opinion on it.