Mata v. Digital Recognition Network, Inc.

Opinion

Filed 7/20/26 CERTIFIED FOR PUBLICATION

COURT OF APPEAL, FOURTH APPELLATE DISTRICT

DIVISION ONE

STATE OF CALIFORNIA

GUILLERMO MATA, D084781

Plaintiff and Appellant,

v. (Super. Ct. No. 37-2021- 00023321-CU-MC-CTL) DIGITAL RECOGNITION NETWORK, INC.,

Defendant and Respondent;

SCOTT AKER,

Movant and Appellant.

APPEALS from a judgment and an order of the Superior Court of San Diego County, Joel R. Wohlfeil, Judge. Affirmed. Edelson and J. Aaron Lawson for Plaintiff and Appellant and Movant and Appellant. Matthew T. Cagle, Jacob A. Snow; Juelsgaard Intellectual Property and Innovation Clinic, Mills Legal Clinic at Stanford Law School, Phillip R. Malone, Nina K. Srejovic; and Nicole A. Ozer for the American Civil Liberties Union of Northern California, the American Civil Liberties Union of Southern California, the American Civil Liberties Union of San Diego and Imperial Counties, the Center for Constitutional Democracy and the Electronic Frontier Foundation as Amici Curiae on behalf of Plaintiff and Appellant. Kilpatrick Townsend & Stockton, Nancy L. Stagg, Xiao Jing Diego Wu Min, Cole B. Ramey, Timothy E. Taylor and John D. Robinson for Defendant and Respondent. INTRODUCTION California’s Automated License Plate Recognition (ALPR) statute requires public and private ALPR operators and end-users to implement certain procedural safeguards regarding the collection and storage of ALPR

information. (Civ. Code, 1 § 1798.90.5 et seq.) “[A]n individual who has been harmed by a violation” of the statute is authorized to bring a civil action against “a person who knowingly caused the harm.” (§ 1798.90.54, subds. (a) & (b), italics added.) The question presented in this appeal is whether a person, like Guillermo Mata, who alleges a violation of the ALPR statute but identifies no resulting harm—other than his own subjective belief that his privacy has been invaded by the collection and storage of his data—has standing to sue under the ALPR statute. We conclude the answer is no. Based on the plain text, standing under the ALPR statute requires actual harm. For this reason, we affirm the trial court’s grant of summary judgment in favor of Digital Recognition Network, Inc. (DRN) on the basis that Mata, as class representative, lacked standing under the ALPR statute. We also affirm the trial court’s order denying class member Scott Aker leave to intervene as a named plaintiff on the basis he has forfeited any challenge to the order.

1 All further undesignated statutory references are to the Civil Code. 2 BACKGROUND I. The ALPR Statute Enacted in 2015, the ALPR statute (Stats. 2015, ch. 532, § 3, eff. Jan. 1, 2016) regulates both public agencies and private entities in the operation and use of an “ ‘ALPR system,’ ” which is defined as “a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.” (§ 1798.90.5, subd. (d); see §§ 1798.90.51, 1798.90.53, 1798.90.55.) It

sets forth certain requirements that an “ ‘ALPR operator’ ” must follow. 2 First, ALPR operators must “[m]aintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access,

destruction, use, modification, or disclosure.” 3 (§ 1798.90.51, subd. (a).) Second, ALPR operators must “[i]mplement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties.” (§ 1798.90.51, subd. (b)(1).) The usage and privacy policy must be made available to the public in writing and be “posted conspicuously” on any website maintained by the operator. (Ibid.)

2 An “ ‘ALPR operator’ ” is “a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.” (§ 1798.90.5, subd. (c).) 3 “ ‘ALPR information’ means information or data collected through the use of an ALPR system.” (§ 1798.90.5, subd. (b).) 3 Additionally, the usage and privacy policy “shall, at a minimum,” include the following seven items of information: “(A) The authorized purposes for using the ALPR system and collecting ALPR information.

“(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.

“(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.

“(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.

“(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.

“(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.

“(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.” (§ 1798.90.51, subd. (b)(2)(A)–(G).) 4

Third and last, if an ALPR operator accesses or provides access to ALPR information, it must maintain a record of that access and require the

4 The ALPR statute similarly requires that an “ ‘ALPR end-user,’ ” generally defined as “a person that accesses or uses an ALPR system” (§ 1798.90.5, subd. (a)(1)–(3)), maintain reasonable security procedures and practices to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure (§ 1798.90.53, subd. (a)); and implement and make available a written usage and privacy policy to the public and post it conspicuously on the end-user’s website (§ 1798.90.53, subd. (b)(1)–(2)). 4 ALPR information only be used for the authorized purposes described in the usage and privacy policy. (§ 1798.90.52, subds. (a)–(b).) Significantly, the ALPR statute does not restrict or place limitations on a private entity’s collection or use of ALPR information. (See Bartholomew v. Parking Concepts, Inc. (2026) 118 Cal.App.5th 438, 449 (Bartholomew) [“the ALPR [statute] does not impose specific substantive requirements on private

entities’ collection and use of ALPR data”].) 5 It does, however, impose restrictions on public agencies: a “public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment” at a public meeting before its implementation, and it “shall not sell, share, or transfer ALPR information, except to another public agency, and only as

otherwise permitted by law.” 6 (§ 1798.90.55, subds. (a)–(b).) By contrast, the ALPR statute “vests private entities that collect and use ALPR information with wide leeway to determine what to do with this data.” (Bartholomew, at p. 449.) II. The ALPR Statute’s Private Right of Action The ALPR statute allows a private right of action under section 1798.90.54. It provides: “In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including but not limited to, unauthorized access or use of ALPR

5 Bartholomew, supra, 118 Cal.App.5th 438, was decided while this appeal was pending. As such, we invited and considered the parties’ supplemental letter briefs addressing the impact of the decision in this case. 6 “ ‘Public agency’ means the state, any city, county, or city and county, or any agency or political subdivision [thereof], including, but not limited to, a law enforcement agency.” (§ 1798.90.5, subd. (f).)

5 information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.” (§ 1798.90.54, subd. (a), italics added.) In such an action, the court may award any combination of actual damages, but not less than liquidated damages of $2,500, punitive damages upon proof of willful or reckless disregard of the law, reasonable attorney fees and costs, and other preliminary and equitable relief deemed appropriate. (§ 1798.90.54, subd. (b)(1)–(4).) III. DRN’s ALPR Business DRN is an “ALPR operator” within the meaning of the ALPR statute. 7 It “offers license plate recognition services to customers in the private sector.” It sells ALPR hardware, including mobile and fixed cameras that are mounted on vehicles like tow trucks or other physical infrastructure, with the integrated software to capture images of license plates on vehicles in areas visible to the public. DRN stores the original images from its cameras and their associated computer-readable data in an ALPR system that it owns and maintains. The information in DRN’s ALPR system includes images of license plates and vehicles, with the date, time, and location the images were captured, as well as the license plate characters and state captured from the images. In May 2024, DRN’s ALPR system contained “over 9 billion historical license plate images.”

7 Although Mata’s complaint alleged that DRN qualified as either an ALPR operator or ALPR end-user, Mata describes DRN solely as an ALPR operator in his appellate briefing. We thus omit any discussion of Mata’s allegations under section 1798.90.53, subdivision (b), which pertains to the regulation of an ALPR end-user.

6 The parties agree that, in late 2015, DRN adopted an ALPR usage and privacy policy (DRN’s policy) and did so “in a deliberate and conscious manner.” The policy was drafted by DRN’s founder and former executive chairman, Todd Hodnett, “who looked at the [ALPR] statute and drafted the [policy], and then obtained approval from his CEO, CTO, and outside counsel.” DRN’s policy includes the seven items of information required by the ALPR statute. (See § 1798.90.51, subd. (b)(2)(A)–(G).) The policy is hyperlinked at the bottom of the homepage of DRN’s website under the title “California ALPR policy.” DRN’s policy identifies three “authorized uses” of its ALPR system: by its “customers to identify or ascertain the location of a specific vehicle under circumstances when there is a legitimate commercial interest”; by “law enforcement agencies for law enforcement purposes”; and by DRN “to make [A]LPR data available to customers and law enforcement agencies for the purposes above, and to provide market research information to customers based on aggregated [A]LPR data.” (§ 1798.90.51, subd. (b)(2)(A).) It identifies its users and their training requirements, specifically providing that “[a]ll independent contractors of the company are authorized to use the ALPR system for purposes consistent with their underlying contract with the company and this policy.” (§ 1798.90.51, subd. (b)(2)(B).) In accord with that statement, DRN requires all third parties to execute a written contract in which the third party agrees to comply with all applicable laws, including state privacy laws, when accessing and using information stored in the ALPR system. Additionally, DRN’s policy describes its monitoring process to ensure security and compliance with applicable privacy laws, including conducting periodic audits of its usage logs.

7 IV. Mata’s Class Action Lawsuit In 2021, Mata filed a putative class action lawsuit against DRN on behalf of “[a]ll persons in the State of California whose license plate data was

collected by [DRN] using an automatic license plate reader.” 8 The complaint contained a single cause of action: an asserted violation of the ALPR statute by DRN. Mata alleged that although DRN maintains a written privacy and usage policy on its website, it does so only “to maintain the appearance of adhering” to the ALPR statute and “to pay lip service to privacy laws without having any intention of actually complying with them.” Specifically, he alleged DRN violated section 1798.90.51, because it (1) “does not make a meaningful usage and/or privacy policy available to the public, nor does it conspicuously post any information about usage and/or privacy on its website”; (2) “does not implement a meaningful usage and privacy policy in order to ensure that its collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties”; and (3) “expressly disclaims the highly sensitive nature and serious privacy implications of its ALPR data, and as a result fails to conduct the security procedures and practices reasonably necessary to protect such sensitive information from unauthorized access, destruction, use, modification, or disclosure.” He further alleged DRN violated section 1798.90.52, subdivision (b), because “it allows, and indeed encourages its

8 The complaint, along with other documents that were filed in the trial court but omitted from the clerk’s transcript, is one of the exhibits submitted by DRN in an unopposed motion to augment the appellate record, filed on August 21, 2025. We hereby grant DRN’s motion to augment.

8 customers to use its ALPR system for the unauthorized purpose of tracking and locating individuals.” As for harm, Mata asserted that “[he] and the Class have been harmed by [DRN’s] conduct because their private and sensitive personal information has been improperly collected and used without their notice or consent.” (Italics added.) Mata further asserted he is “one of millions of individuals who has fallen victim to DRN’s pervasive surveillance network,” as it has “tracked Mata’s vehicle, thus gaining access to his home and work address and other sensitive information such as the time he typically leaves and comes home and where he likes to spend his free time.” His complaint states, “This lawsuit seeks to put an end to DRN’s portentous surveillance tactics and to hold the company accountable for disparaging the privacy rights of California citizens.” V. The Trial Court Grants DRN Summary Judgment DRN moved for summary judgment on two grounds: Mata lacked standing to bring a civil action under the ALPR statute because he had not been harmed by any alleged violation, and there was no evidence that DRN had violated the ALPR statute. The trial court agreed that Mata lacked standing and granted summary judgment for DRN on that basis. It did not

reach DRN’s second argument. 9

9 Before its motion for summary judgment, DRN had removed the action to federal district court based on diversity jurisdiction. The district court remanded the action back to the superior court, concluding that it lacked subject matter jurisdiction because Mata failed to allege injury in fact to satisfy standing under Article III of the United States Constitution. (Mata v. Digital Recognition Network, Inc. (S.D. Cal., May 6, 2022, No. 21-CV-1485 JLS (BLM)) 2022 WL 1445225; see also Mata v. Digital Recognition Network,

9 In support of its showing that Mata lacked standing 10 DRN argued Mata’s involvement in the lawsuit “does not arise out of any specific event or injury he has suffered” and produced the following evidence. In his deposition, Mata testified his ALPR information in DRN’s system has never been the subject of a data security breach or unauthorized access or use. He has not had his identity stolen, never been stalked, has not suffered any physical injury or harm, has not lost any wages or suffered any monetary damage because of any conduct by DRN. When asked if DRN’s conduct caused him to suffer any mental anguish, Mata testified: “[M]y privacy is something that I think—privacy I think is something a lot of other people will agree that it’s very personal to them. [¶] And for myself, my privacy is very important. I hold it to high—I think a lot of people take a lot of precautions to protect their privacy. So for me, my harm—the harm of mine, and I’m sure a lot of others would agree, is the privacy has been—my privacy has been violated on multiple occasions.” (Italics added.)

Inc. (S.D. Cal., Mar. 25, 2022, No. 21-CV-1485 JLS (BLM)) 2022 WL 891433 [explaining that Mata had not adequately alleged standing, as he failed to identify any injury in fact].) After remand, DRN filed an answer and the trial court certified the class, defined as “[a]ll residents of California whose California license plate data was collected by [DRN] (either directly or through an affiliate) in the State of California at least fifteen times between June of 2017 and the date of final judgment.” 10 In support of DRN’s alternative argument that summary judgment was proper because the undisputed evidence established it did not violate the ALPR statute, DRN produced evidence of its security protocols; its usage and privacy policy, which is available on its website; and its contracts and requirements for its customers. We previously summarized this evidence in the Background, section III.

10 Mata testified he decided to file this lawsuit when he learned about ALPR technology in something he read. In his words, “One day, . . . I was at home and it came across to me, I mean, I think it was some kind of—I forgot what it was. It was maybe like an article or something talking about how companies are retrieving customer’s data. And I felt like that—that applied to me, so, . . . not being an attorney, I didn’t know if it did or not. So that’s when I reached out to my—to my attorney to just let them know, hey, this is what I think, and then I let them decide from there.” Although ALPR information for his vehicles had been collected by DRN—the license plates for Mata’s two vehicles have each been captured at least 15 times and appear in DRN’s ALPR system—Mata conceded his data has only been accessed by his own attorneys, with his express authorization, for this litigation. He also has never gone to DRN’s website to review DRN’s usage and privacy policy, but has read it only “as part of the preparation for the documents that [his] attorneys prepared.” In opposition, Mata did not refute DRN’s evidence that he had not suffered any direct harm because of DRN’s conduct, such as unauthorized

access or use of his ALPR information. 11 But in his view, “[t]he ALPR statute is designed to protect [individual] privacy, and presumes that invasions of privacy are harmful.” And any infringement of that “statutory right” constitutes actionable harm. He asserted DRN violated his and class members’ privacy rights by collecting “at least 15 license plate scans of every

11 Mata argued DRN was aware of “credential sharing,” which “is when users share their login information with other people” and enables others to gain unauthorized access to ALPR information, but failed to take reasonable steps to prevent it. Although he argued credential sharing is “a form of unauthorized access,” Mata did not produce any evidence of an actual occurrence of this with his own ALPR information. 11 Class member,” while maintaining “a meaningless, non-compliant usage and privacy policy, failing to enact reasonable data security protocols, and failing to provide adequate notice to the public,” in violation of the ALPR statute. The trial court did not agree with Mata’s theory of harm and granted summary judgment in favor of DRN. Among other things, the court found the undisputed evidence showed Mata had not sustained any physical, mental or monetary injury due to DRN’s collection of ALPR data, and Mata’s ALPR information has never been disclosed or accessed by anyone without his consent. Construing the ALPR statute to require harm that is “the result of some action which causes injury stemming from improper access or use of ALPR data,” the court concluded there was no triable issue that Mata lacked standing. DISCUSSION I. Summary Judgment Was Proper Because Mata Lacks Standing Appealing the judgment, Mata contends the trial court erred in its interpretation of the ALPR statute’s standing requirement and summary judgment should not have been granted. We review the trial court’s summary judgment order and questions of statutory interpretation de novo. (Olson v. La Jolla Neurological Associates (2022) 85 Cal.App.5th 723, 733 [summary judgment]; Bruns v. E-Commerce Exchange, Inc. (2011) 51 Cal.4th 717, 724 (Bruns) [statutory interpretation].) On our de novo review, we find no error. A. The Parties’ Competing Theories of Harm Under the ALPR statute, “an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a

12 civil action . . . against a person who knowingly caused the harm.” (§ 1798.90.54, subd. (a), italics added.) Mata’s standing turns on whether he has been “harmed by a violation” of the ALPR statute. The parties offer competing responses. The relevant facts are not disputed. Mata’s ALPR information stored in DRN’s system has never been the subject of unauthorized access or use, or a data security breach. His ALPR information has not been accessed by anyone except his own attorneys, with his authorization, in connection with his lawsuit. He has not experienced any physical or monetary injury. Based on these undisputed facts, DRN contends Mata has not been harmed within the meaning of the ALPR statute. In DRN’s view, the “harm” which must be shown to confer standing is actual harm. Mata, in contrast, sets forth a broad theory of harm that he calls a

“collection-based invasion of privacy” harm. 12 He explains his theory as follows: California recognizes “an invasion of privacy as itself harmful, without the need to examine any consequences flowing from the invasion.” Specifically, the “collection and retention of information about an individual, by itself, threatens” this individual privacy interest. “Because DRN has collected massive amounts of data about Mr. Mata, as well as every other member of the class, they have intruded on [this] well-recognized privacy

12 Mata’s complaint asserted an even broader theory of harm, under which the mere collection and use of ALPR information without his notice or consent constitutes harm. This is not a viable theory because the ALPR statute does not require an ALPR operator (or end-user) to provide notice or obtain consent for the collection and use of ALPR information, nor does it restrict or place any substantive limitations on a private entity’s collection or use of ALPR information. (See Bartholomew, supra, 118 Cal.App.5th at p. 449.)

13 interest.” “Having undertaken to do so, unless DRN’s collection of this data comports with, and respects, Mr. Mata’s privacy interests and civil liberties, . . . Mr. Mata can plausibly claim to have been ‘harmed’ by DRN’s actions.” Put another way by Mata, “the collection of a sufficient number of scans to reveal sensitive details about one’s life, and the storage of that data indefinitely in a database that is not secured in the manner required by California law, both because the database operator lacks a statutorily compliant [usage and privacy] policy and has failed to implement necessary security measures, is an actionable harm.” (Italics added.) He adds, however, that he makes “no argument that any violation of the ALPR law, no matter how technical, invades the privacy of those whose data has been

collected.” 13 As we understand Mata’s theory, the harm sufficient to confer standing is the invasion of his privacy that results from the very collection and retention of ALPR information that is permitted by the statute, so long as the ALPR operator is out of compliance with a nontechnical provision of the statute. We find no support for this theory in the text or the legislative history of the ALPR statute, and conclude standing requires actual harm by the violation. B. Standing Under the ALPR Statute Requires Actual Harm “Standing rules for actions based upon statute may vary according to the intent of the Legislature and the purpose of the enactment.” (Angelucci v.

13 As Mata explained in his opposition to DRN’s motion for summary judgment, “Some violations may not cause privacy harm in themselves, like if an ALPR operator’s policy fails to identify ‘[t]he title of the official custodian, or owner, of the ALPR system responsible for implementing this section,’ ” quoting section 1798.90.51, subdivision (b)(2)(E).

14 Century Supper Club (2007) 41 Cal.4th 160, 175.) Thus, where a cause of action is based on a California statute, standing is “a matter of statutory interpretation.” (Adolph v. Uber Technologies Inc. (2023) 14 Cal.5th 1104, 1120.) Our fundamental task in construing a statute is “ ‘to determine and give effect to the intent of the enacting legislative body.’ ” (Holland v. Assessment Appeals Bd. No. 1 (2014) 58 Cal.4th 482, 490.) We begin by looking at the language of the statute because it is generally the most reliable indicator of legislative intent, and we give it a plain and commonsense meaning. (Ibid.) We do not examine that language in isolation, but in the context of the entire statutory framework. (Bruns, supra, 51 Cal.4th at p. 724.) “[W]e must follow the fundamental rule of statutory construction that requires every part of a statute be presumed to have some effect and not be treated as meaningless unless absolutely necessary. ‘Significance should be given, if possible, to every word of an act. . . . Conversely, a construction that renders a word surplusage should be avoided.’ ” (People v. Arias (2008) 45 Cal.4th 169, 180 (Arias).) “ ‘If the language is clear in context, our work is at an end. If it is not, we may consider other aids, including the statute’s legislative history.’ ” (City of Gilroy v. Superior Court (2026) 19 Cal.5th 38, 51.) 1. Statutory Text Turning first to the plain text of the provision that authorizes a private right of action—section 1798.90.54, subdivision (a) (hereafter § 1798.90.54(a))—we find several items significant to our construction of the words, “harmed by a violation.” First, section 1798.90.54(a) differentiates between the concept of harm, on the one hand, and the concept of a statutory violation, on the other.

15 Specifically, an individual may bring suit if “harmed by a violation.” (§ 1798.90.54(a), italics added). “When the Legislature uses different words as part of the same statutory scheme, those words are presumed to have different meanings.” (Romano v. Mercury Ins. Co. (2005) 128 Cal.App.4th 1333, 1343.) In choosing to make the violation itself distinct from the harm that the violation causes, the Legislature requires both to be shown. Thus, more than a mere statutory violation is required to confer standing to bring suit. On this point, we agree with the court in Bartholomew, supra, 118 Cal.App.5th 438, when it rejected the plaintiff’s argument “that harm results from any violation” of the ALPR statute.” (Id. at p. 447 [“The statutory language limiting civil actions to persons ‘harmed by a violation’ against defendants who ‘caused the harm’ indicates that more than just the fact of a violation is required.”].) As the Bartholomew court observed, “[i]n contrast, other statutes contain language expressly imposing liability for ‘violations.’ For example, the Fair Debt Buying Practices Act (§ 1788.50 et seq.) provides, ‘[A] debt buyer that violates any provision of this title with respect to any person shall be liable to that person’ for actual or statutory damages.” (Bartholomew, supra, 118 Cal.App.5th at p. 447, quoting § 1788.62, subd. (a) and citing Chai v. Velocity Investments, LLC (2025) 108 Cal.App.5th 1030, 1040 (Chai); see also Parsonage v. Wal-Mart Inc. (2026) 118 Cal.App.5th 399, 406, 420–421 [holding no showing of injury required under provision of the Investigative Consumer Reporting Agencies Act (§ 1786 et seq.) that makes an employer who “fails to comply with any requirement” of the statute liable to consumers; collecting cases construing other statutes containing language expressly imposing liability for violations].) These statutes demonstrate that the Legislature knows how to create a statutory right and “deem a violation of

16 that right an injury sufficient to confer standing.” (Chai, at p. 1040.) The Legislature did not do that with the ALPR statute. Further still, section 1798.90.54(a), gives several non-exclusive examples of how a plaintiff might be harmed by a statutory violation. It authorizes suit by “an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system.” (§ 1798.90.54(a), italics added.) The “inclusion of [several] examples of harm-causing violations indicates that more than just a violation is required, as there would be no need to provide examples if any violation was sufficient.” (Bartholomew, supra, 118 Cal.App.5th at p. 447.) Second, the preposition “by” in the phrase, “harmed by a violation” is used to connect “harmed” and “violation.” (§ 1798.90.54(a), italics added.) Giving the word its usual meaning and effect, “by” explains what caused the person to be harmed and means “as a result of” or “because of” the violation. (People v. Cole (2004) 33 Cal.4th 1158, 1208 [“The preposition ‘by,’ in itself, commonly signifies a causal connection.”].) The harm then must arise from the violation. Third, we turn to the dictionary definition of “harm.” As noted by the district court in Navarro v. Skidata, Inc. (C.D. Cal., Dec. 7, 2022, No. 2:20- CV-07370-SVW-SK) 2022 WL 18280359 (Navarro)), “[t]he ordinary meaning of harm, according to the Merriam-Webster Dictionary, is ‘physical or mental damage; injury.’ Black’s Law Dictionary is in accord, defining harm as ‘injury, loss, damage; material or tangible detriment.’ ” (Id. at p. *5.) From the plain meaning of “harm,” among other reasons, the district court

17 concluded “actual harm is required to establish a violation of the California

ALPR statute.” 14 (Id. at pp. *5–*6) Here we note the ALPR statute does not require a plaintiff to suffer measurable monetary damages to establish harm. (See Bartholomew, supra, 118 Cal.App.5th at p. 447.) It allows recovery of actual damages or the statutory minimum of $2,500 as liquidated damages. (§ 1798.90.54, subd. (b)(1).) We agree with Mata that the Legislature’s inclusion of statutory damages evinces the Legislature’s intention to allow a plaintiff to recover for “difficult to quantify” harm. But it does not follow, as Mata contends, that it signals the Legislature’s intention to authorize an individual to bring suit based on the type of amorphous harm he has articulated. Fourth, the Legislature provides three specific examples of how an individual may be harmed by a violation of the ALPR statute: (1) unauthorized access of ALPR information, (2) unauthorized use of ALPR information, and (3) breach of security of an ALPR system. (§ 1798.90.54(a).) All three are examples of actual, not abstract, harm. The interpretive canon of ejusdem generis, meaning “of the same kind,” applies here. (Brown v. City

14 In Navarro, after discovering that ALPR technology was being used in shopping mall parking lots, plaintiffs sued the shopping malls and the manufacturers of the ALPR technology, alleging, among other things a violation of the ALPR statute. (Navarro, supra, 2022 WL 18280359, at pp. *1–*2.) The district court concluded that “actual harm” was required for the plaintiffs to have standing under the ALPR statute (id. at p. *6), but that plaintiffs had failed “to demonstrate actual harm that was caused by any particular defendant” since “[n]othing in the record, for instance, shows that any [d]efendant’s improper handling of data led to its misuse that could in turn justifiably spark [p]laintiffs’ allegations of ‘identity theft,’ apparent discovery of data on the ‘dark web,’ acquisition of credit monitoring services, emotional distress, or diminution in value of personally identifying information.” (Id. at p. *8.)

18 of Inglewood (2025) 18 Cal.5th 33, 43 (Brown).) “The canon, which ‘ “ ‘applies whether specific words follow general words in a statute or vice versa,’ ” ’ instructs that ‘ “the general term or category is ‘restricted to those things that are similar to those which are enumerated specifically.’ ” ’ ” (Ibid.) Important here, the interpretive canon of ejusdem generis applies even where the specifically enumerated items of the statute are preceded by the words “including, but not limited to.” (Brown, supra, 18 Cal.5th at p. 43.) And although Mata is correct that the words “including, but not limited to” are “a phrase of enlargement,” it is “not necessarily a phrase without limits.” (Ibid.) The phrase “must be read in conjunction with the examples the statute sets forth” and while the phrase connotes an illustrative listing, “ ‘the specific examples’ listed may restrict the meaning of the defined term.” (Ibid.) Contrary to Mata’s argument, ejusdem generis “does not allow us to ignore the restrictions the Legislature set or to broaden the meaning of [the term to be interpreted] beyond the restrictions set forth in the Legislature’s . . . example[s].” (Arias, supra, 45 Cal.4th at p. 180.) “The rule is ‘based on the obvious reason that if the Legislature had intended the general words to be used in their unrestricted sense, it would not have mentioned the particular things or classes of things which would in that event become mere surplusage.’ ” (Ibid.) In sum, giving effect “to every word” in section 1798.90.54(a), we conclude standing under the ALPR statute requires that a plaintiff must demonstrate actual harm that arises from the violation. (Arias, supra, 45 Cal.4th at p. 180 [“Significance should be given, if possible, to every word of an act.”].)

19 2. Legislative History We have reviewed the legislative history, but we do not find that it provides any further clarity as to the meaning of “harmed by a violation” beyond the statutory text we have just discussed. However, the limited information that we have gleaned is consistent with our construction of the

statute. 15 The ALPR statute was enacted by Senate Bill No. 34 in 2015. (Stats. 2015, ch. 532, § 3.) None of the committee reports or analyses for Senate Bill No. 34 discuss the meaning of the requirement that, to file a lawsuit, an individual must be “harmed by a violation” of the statute. (§ 1798.90.54(a).) We also do not find the amendments made to the statutory language as it proceeded through the Legislature to be particularly instructive on that

question. 16 (See Kaufman & Broad Communities, Inc. v. Performance

15 Mata’s discussion of the legislative history is mostly focused on establishing that the Legislature viewed ALPR information as implicating the public’s privacy interests, at least to some extent. Our review of legislative history here has a more specific focus. Namely, we review the legislative history to determine whether it sheds any light on what the Legislature meant by “an individual who has been harmed by a violation” of the statute. (§ 1798.90.54(a).) 16 In interpreting the private cause of action provision in the ALPR statute, the district court in Navarro, supra, 2022 WL 18280359 at page *6, focused on an amendment to Senate Bill No. 34, in which the phrase allowing a lawsuit “against a person who knowingly caused that violation” was changed to a phrase allowing a lawsuit “against a person who knowingly caused the harm.” (Legis. Counsel’s Dig., Sen. Bill No. 34 (2015–2016 Reg. Sess.) p. 15, as amended July 2, 2015, italics added.) Bartholomew also found this amendment to be significant. (Bartholomew, supra, 118 Cal.App.5th at pp. 447–448.) In our view, however, that language serves only to describe the class of defendants who may be sued, not the class of plaintiffs who may sue.

20 Plastering, Inc. (2005) 133 Cal.App.4th 26, 31 [a court may consider different versions of the bill as part of a legislative history analysis].) However, two enrolled bill reports sent to the Governor provide some relevant statements. “Enrolled bill reports are legislative history that may be considered by courts in construing a statute.” (People v. Adir International, LLC (2025) 114 Cal.App.5th 275, 324; see also Elsner v. Uveges (2004) 34 Cal.4th 915, 934, fn. 19 [“we have routinely found enrolled bill reports, prepared by a responsible agency contemporaneous with passage and before signing, instructive on matters of legislative intent”].) First, an enrolled bill report from the Department of Finance explains that “[p]otential costs at the local level may arise from the following requirements of this bill: . . . Damages resulting from civil actions brought by individuals who have been harmed by improper use of [ALPR] system data.” (Dept. of Finance, Enrolled Bill Mem. to Governor on Sen. Bill No. 34 (2015– 2016 Reg. Sess.) Sept. 10, 2015, p. 1, italics added.) Second, an enrolled bill report from the California Highway Patrol states, “[Senate Bill No.] 34 would permit anyone whose information is disclosed in violation of the sections proposed by this bill to seek civil action against the individual who knowingly caused the violation.” (Cal. Highway Patrol, Enrolled Bill Rep. on Sen. Bill No. 34 (2015–2016 Reg. Sess.) Sept. 1, 2015, p. 1, italics added.) That same report describes the following argument in favor of the bill: “This bill outlines rules and regulations regarding the use of personal information and the consequences for allowing that personal information to be obtained or released without cause.” (Id. at p. 10, italics added.) The language we have italicized above supports the conclusion that the ALPR statute was intended to give an individual the right to sue when that individual’s ALPR

21 information has been improperly obtained, used or released, not merely when that individual has identified a statutory violation. DRN also cites a letter to the Governor from the Senate Republican leader, urging him to veto the bill. That letter reflects the same understanding of the statute as the enrolled bill reports discussed above, as it refers to “a private cause of action for the release of any information collected through the use or operation of an ALPR system.” (Sen. Jean Fuller, letter to Governor Edmund G. Brown, Jr. re Sen. Bill No. 34 (2015–2016 Reg. Sess.) Sept. 22, 2015, italics added.) To the extent that letter reiterates legislative discussion, we consider it here. (People v. Grays (2016) 246 Cal.App.4th 679, 689, fn. 11 [“We recognize that ‘statements [in letters to the Governor] about pending legislation are entitled to consideration to the extent they constitute ‘a reiteration of legislative discussion . . . rather than merely an expression of personal opinion.” ’ [Citation.] The statement here is consistent with the discussion in legislative analyses about the purpose of the bill.”]; see also American Financial Services Assn. v. City of Oakland (2005) 34 Cal.4th 1239, 1263 [considering content of letters from Assembly Republican Leader and Senate Republican Whip to the Governor urging a veto of a bill].) Mata contends that his interpretation of the statute is supported by provisions appearing in two pieces of proposed (but not enacted) legislation concerning ALPR information in the years prior to the enactment of Senate Bill No. 34. As we understand Mata’s argument, he intends to refer to Senate Bill No. 893 from the 2013–2014 Regular Session and Senate Bill No. 1330 from the 2011–2012 Regular Session. However, Mata fails to support his argument with any citation to the appellate record where that legislative history is available. He also does not provide any legal authority allowing us to base our interpretation of a statute on a provision appearing in failed

22 legislation from prior legislative sessions. “Unpassed bills, as evidence of legislative intent, have little value.” (Graham v. DaimlerChrysler Corp. (2004) 34 Cal.4th 553, 572.) We accordingly do not consider Mata’s arguments concerning unpassed legislation when interpreting the meaning of the ALPR statute. In sum, the relevant statements we have identified in the legislative history support the statutory meaning that we have derived from the words of the statute itself. To have standing as someone “harmed by a violation of the statute” (§ 1798.90.54(a)), a plaintiff must show actual harm arising from a violation of the statute (see Navarro, supra, 2022 WL 18280359, at p. *8). 3. Mata’s Theory of Harm is Not Supported by the Statutory Text or Legislative History. We briefly turn back to Mata’s theory of a collection-based invasion of privacy harm. As we explained, Mata contends the harm sufficient to confer standing is the invasion of his privacy that results from the very massive collection and retention of ALPR information that is permitted by the Legislature, so long as the ALPR operator is out of compliance with a nontechnical provision of the statute. His theory finds no footing in the statutory text, or the legislative history we have just discussed. The ALPR statute does not distinguish between a “technical” and nontechnical requirement, and Mata does not explain how that distinction is to be made. He does not identify any specific violation of the ALPR statute that would not infringe on his privacy interests. Instead, without elaboration, he asserts the failure to identify the “title of the official custodian, or owner, of the ALPR system responsible for implementing” the usage and privacy policy (see § 1798.90.51, subd. (b)(2)(E)) would be a technical violation that, as his counsel explained at the summary judgment motion hearing, could not “imagin[ably] . . . constitute a privacy harm or an

23 actionable harm for any particular individual out there.” We fail to perceive why identification of the person responsible for implementing the very usage and privacy policy that Mata contends is vital to safeguarding his privacy interests is not important to those interests. Mata does not provide us with an explanation. As we understand Mata’s theory, provisions of the ALPR statute that if violated would substantively infringe on his privacy interests would comprise almost all the requirements of the ALPR statute, including: (1) maintain reasonable security procedures and practices (§ 1798.90.51, subd. (a)); (2) implement a compliant usage and privacy policy (id., subd. (b)(1)); (3) make the usage and privacy policy available to the public, including by posting it conspicuously on the operator’s website (ibid.); (4) maintain a record of access to its ALPR information (§ 1798.90.52, subd. (a)); and (5) restrict use of its ALPR information to the authorized purposes described in the usage and privacy policy (id., subd. (b)). He argues these “specific provisions . . . that DRN is alleged to have violated seek to ensure that the implementation and operation of an ALPR system is ‘consistent with respect for individuals’ privacy and civil liberties.” In Mata’s view, “[i]t makes little sense to think that the Legislature elevated these specific values in the text of the law but permitted suit only for a much narrower class of injuries, when there is no textual indication of such a limit.” But as we have explained, there are textual indications of such a limit to standing under the ALPR statute. Distilled to its core, there is not much daylight between Mata’s theory of harm and the one we (and other courts) have already rejected—that “harm results from any violation.” (Bartholomew, supra, 118 Cal.App.5th at p. 447;

24 see also Navarro, supra, 2022 WL 18280359, at p. *6 [requiring “plaintiffs to show actual harm and a knowing violation,” italics added].) C. The Undisputed Facts Show That Mata Has Not Been Harmed by Any Alleged Violation Apart from his theory of harm we have rejected, Mata makes no attempt to show he has been harmed by any of DRN’s alleged violations. On this record, we conclude there is no triable issue of material fact that Mata suffered harm within the meaning of the ALPR statute. Mata’s ALPR information in DRN’s system has never been the subject of a data security breach or unauthorized access or use. In his own words, “the harm of mine, . . . is the privacy has been—my privacy has been violated,” by the collection and storage of ALPR information that is permitted under the statute. (Italics added.) The fear is understandable. As one court put it, “[l]icense plates are publicly visible on cars, making it likely that they are captured numerous times per day by stoplights, camera-wielding pedestrians, and security cameras. Relatedly—and perhaps regrettably—life in the twenty-first century is defined by an ever-increasing amount of digital surveillance.” (Navarro, supra, 2022 WL 18280359, at p. *6.) Mata’s subjective belief of harm, however, is not a cognizable harm for standing under the ALPR statute. Thus, while he contends that there is a factual dispute about whether DRN’s usage and privacy policy is adequate, whether that policy is sufficiently conspicuous on DRN’s website, and whether DRN’s security procedures and practices are sufficient, Mata has not identified how he has been directly harmed by those alleged violations. Mata contends we should rely on Bartholomew to conclude he has been harmed within the meaning of the ALPR statute. In Bartholomew, the ALPR

25 operator, a parking garage owner and operator, had collected the plaintiff’s ALPR information upon the plaintiff’s entry and exit from the garage. (Bartholomew, supra, 118 Cal.App.5th at pp. 442, 445–446.) The ALPR operator had not implemented, or made available to the public, any usage and privacy policy, in violation of section 1798.90.51, subdivision (b)(1). (Bartholomew, at p. 445.) The court rejected the plaintiff’s argument “that harm results from any violation of the ALPR Law” and held that standing “require[s] harm beyond a mere statutory violation.” (Id. at p. 447, italics added.) As noted, we agree with Bartholomew on these points. We are less sure, however, of Bartholomew’s final conclusion that the plaintiff nonetheless had standing to sue based solely on the ALPR operator’s specific statutory violation. (Bartholomew, supra, 118 Cal.App.5th at pp. 448–451.) The court acknowledged the specified examples of “harm- causing violations,” unauthorized access or use of ALPR information or breach of an ALPR system’s security, “represent scenarios in which information was in fact affirmatively misused or mishandled, suggesting support for so limiting the requisite harm.” (Id. at p. 449.) But the court determined the requirement of a usage and privacy policy was a “significant end in itself, designed to ensure individuals know how their data is being used and to help protect their privacy interests.” (Bartholomew, supra, 118 Cal.App.5th at p. 451.) In this way, the court reasoned, the ALPR statute “grants individuals the right to know which entities are collecting their ALPR data and how it is being used and maintained,” and the collection and storage of that data “without implementing and making public the statutorily required policy harms these individuals by violating this right to know.” (Id. at p. 449.) It so harms a person whose ALPR information has been collected because that person

26 would have “more difficul[ty]” holding an ALPR operator accountable for unauthorized use of that information, which is one of the specified examples of a harm-causing violation. (Id. at p. 450.)

Although we are skeptical of this “right to know” harm, 17 we need not resolve our concerns at this juncture. The Bartholomew court explicitly acknowledged the limits of its own holding. In a footnote, the court stated, “We express no opinion as to whether collecting and maintaining ALPR information with a usage and privacy policy that does not include every component identified in section 1798.90.51, subdivision (b)(2) would also cause such harm.” (Bartholomew, supra, 118 Cal.App.5th at p. 449, fn. 10.) Here, there is no dispute DRN implemented and made publicly available a usage and privacy policy. Mata’s complaints about the alleged deficiency of DRN’s policy is not that it fails to contain the information required by section 1798.90.51, subdivision (b)(1), but that DRN has implemented the policy only “to maintain the appearance of adhering” to the law. In other words, he contends DRN does not really mean what it says in the policy. We are dubious that insincerity constitutes a violation where there is nonetheless actual and literal compliance with the ALPR statute. Further, although he contends the hyperlinked policy is not posted conspicuously, Mata concedes he has never gone to DRN’s website to look for, let alone review, DRN’s usage and privacy policy. He has, instead, only read the policy as part of the documents provided to him by his attorneys during litigation. Even under the rationale of Bartholomew’s “right to know” harm, none of these alleged deficiencies show that Mata’s “right to know” has been harmed.

17 At oral argument, even counsel for Mata conceded the primary right conferred by the ALPR statute is not a “right to know” but, as he has urged all along, a right to privacy. 27 D. Conclusion Based on the foregoing, we conclude the trial court properly granted summary judgment in favor of DRN because Mata was not “harmed by a violation of the statute” and thus did not have standing to pursue his lawsuit. (§ 1798.90.54(a).) II. Aker Fails to Demonstrate Reversible Error by the Trial Court’s Denial of His Ex Parte Application for Leave to Intervene The trial court denied class member Aker’s ex parte application for leave to intervene as a named plaintiff to substitute as class representative. Aker appeals this order. Because Aker has failed to address all bases for the trial court’s ruling, we conclude he has forfeited any challenge to the court’s denial of his ex parte application. The trial court issued its order granting summary judgment on May 7, 2024. In response to class counsel’s request, the court stayed the order and any eventual entry of judgment “for a period of sixty (60) days” to allow class counsel “to file a motion to substitute a new class representative into this action.” The court also continued the “trial and related dates” by the same period of sixty (60) days “to accommodate the expected [m]otion regarding the substitution.” On June 11, 2024, class counsel filed an ex parte application for an order to extend the deadline to file a motion to substitute a new plaintiff and the stay on entry of the order granting summary judgment “by 90 days to October 7, 2024,” citing the need for discovery. The trial court denied this request on June 17, finding no good cause to necessitate further delay. The court vacated all dates and ordered DRN to submit a proposed judgment, which it did on June 28.

28 On July 1, 2024, Aker sought leave to intervene as substitute class representative on an ex parte basis. Aker alleged he would have standing to sue DRN for an ALPR violation because he had reason to believe DRN had disclosed his ALPR information to his automobile insurance company. He formed this belief because, on two occasions between 2018 and 2019, his automobile insurance company sent him a form asking him to verify where one of his vehicles was garaged at night. He did not state that any adverse consequences flowed from the insurance company’s inquiries. DRN opposed, arguing among other things that the trial court had already denied the previous ex parte application to extend time, and that an ex parte application was not the correct procedural method to obtain leave to intervene as a substitute class representative. After a hearing on July 3, 2024 and taking the matter under submission, the trial court denied Aker’s ex parte application on July 12, one day after it entered judgment for DRN on July 11. The court gave two independent reasons for its ruling. First, the court explained it had stayed judgment for a period of 60 days and “[t]his 60-day period has now elapsed such that any motion to intervene is too late.” Second, the court determined it would be futile to allow Aker to intervene because, like Mata, he lacked standing due to the absence of any “injury . . . sustained as a result of the insurance company query.” In his opening appellate brief, Aker challenges only one of these grounds, namely, the futility of allowing him to intervene. Aker argues that ruling was erroneous because he should be able to establish standing by showing that “his ALPR data has been disclosed without his knowledge or consent.” His opening appellate brief makes no mention of the alternative,

29 independent ground for the trial court’s ruling, that “any motion to intervene is too late.” This is fatal to his appeal. “It is a fundamental principle of appellate procedure that a trial court judgment is ordinarily presumed to be correct and the burden is on an appellant to demonstrate, on the basis of the record presented to the appellate court, that the trial court committed an error that justifies reversal of the judgment.” (Jameson v. Desta (2018) 5 Cal.5th 594, 608–609.) In addressing only one of the trial court’s two independent grounds for denying his ex parte application, Aker has failed to meet his appellate burden to show the court committed reversible error. “When a trial court states multiple grounds for its ruling and appellant addresses only some of them, we need not address appellant’s arguments because ‘one good reason is sufficient to sustain the order from which the appeal was taken.’ ” (People v. JTH Tax, Inc. (2013) 212 Cal.App.4th 1219, 1237.) If a trial court gives an independent basis for its ruling, a party’s “failure to discuss it forfeits its challenge to the ruling.” (Briley v. City of West Covina (2021) 66 Cal.App.5th 119, 133 (Briley).) For the first time in his reply brief, Aker explains he did not address the part of the trial court’s statement that “any motion to intervene is too late” because he does not believe the court intended that statement as one of the reasons it was denying the ex parte application. Specifically, according to Aker, “that statement could not have referred to [him], since his motion came within the 60-day period.” We are not persuaded. The trial court’s July 12, 2024 minute order stated: “The Court’s May 7, 2024 Minute Order stayed judgment for a period of 60 days. This 60- day period has now elapsed such that any motion to intervene is too late. Defendant [DRN] has the right to seek a final disposition of this action. [¶]

30 In addition, Mr. Aker’s intervention and substitution as a class representative would be futile, and is denied on this basis as well.” (Italics added.) Aker’s reading of the trial court’s statement is not plausible. The only item that the trial court ruled upon in its July 12, 2024 minute order was Aker’s ex parte application. And the italicized words— “[i]n addition” and “as well”—make it clear its ruling denying his ex parte application rested on two alternative and independent grounds. Because Aker has failed to address both bases for the trial court’s ruling, he has forfeited any challenge to the court’s denial of his ex parte application. (Briley, supra, 66 Cal.App.5th at p. 133.) DISPOSITION We affirm the judgment, as well as the trial court’s July 12, 2024 order denying Aker’s ex parte application for leave to intervene. DRN shall recover its costs on appeal.

DO, J.

WE CONCUR:

McCONNELL, P. J.

RUBIN, J.