PRESENT: Lemons, C.J., Mims, Powell, Kelsey, McCullough, and Chafin, JJ., and Millette, S.J.
HARRISON NEAL v. Record No. 191127
FAIRFAX COUNTY POLICE DEPARTMENT, ET AL. OPINION BY JUSTICE STEPHEN R. McCULLOUGH October 22, 2020
FAIRFAX COUNTY POLICE DEPARTMENT, ET AL.
v. Record No. 191129 HARRISON NEAL
FROM THE CIRCUIT COURT OF FAIRFAX COUNTY Robert J. Smith, Judge
The Fairfax County Police Department (“Police Department”) appeals from an injunction that prohibits it from passively collecting, storing, and using license plate and related data through its Automated License Plate Recognition (“ALPR”) system. Among other things, the Police Department contends that the circuit court erred in concluding that the ALPR system satisfies the definition of an “information system” under the Government Data Collection and Dissemination Practices Act, Code §§ 2.2-3800 through -3809 (“Data Act”). Neal separately appeals the circuit court’s award of attorney’s fees, contending the circuit court erred in reducing the fees sought by his attorneys. App. 2089. We agree with the Police Department that the ALPR system does not constitute an “information system” within the intendment of the Data Act and we, therefore, reverse the decision below.
BACKGROUND
I. THE ALPR SYSTEM.
The Police Department’s ALPR system uses cameras that capture images of passing vehicles’ license plates. The cameras can be stationary or mounted on a police vehicle. Once the camera captures a license plate image it converts that image into an alpha-numeric combination. In order to access that alpha-numeric combination and associated data, an officer of the Police Department must specifically log on to the ALPR software program. Logging on to the ALPR software program requires a unique log-in credential and password. Only officers who have completed the required training can gain access to the software. The Police Department employs the ALPR system for “active” and “passive” uses.
“Active” use involves checking the license plates that are scanned against a “hot list.”
The Virginia State Police publishes this “hot list” twice daily. The list consists of all active stolen license plates and vehicles from two databases, the National Crime Information Center (“NCIC”) and Virginia Criminal Information Network (“VCIN”). The hot list also contains license plates associated with suspected criminal activity, such as abductions. The hot list is available to authorized law enforcement personnel who can access it through a secure website. The hot list can be imported into the ALPR system either automatically through a server or manually by the end user. The end user may also manually enter a license plate into the ALPR system along with a notation regarding the reason for the entry, for example a stolen vehicle.
While scanning license plates, the ALPR software alerts the operator when it detects a potential stolen vehicle or license plate. According to a Standard Operating Procedure (“SOP”) developed by the Police Department, “[a]n alarm is NOT conclusive confirmation that a license plate or vehicle is wanted, but an indicator that additional investigation is warranted.” If the
3
ALPR system alerts, the officer is instructed to visually verify the license plate, to make sure it is from the correct state and displays the same characters as the ones on the screen. The SOP then instructs the officer to make sure the hot list is still active by checking the NCIC/VCIN databases, either by running the information in a search on the computer in the car or by a voice request. The SOP further states that “[s]tolen vehicle or license plate responses from NCIC/VCIN shall be confirmed by Teletype in accordance with established procedures as soon as practical.” Additionally, if an officer makes contact with a suspect, the contact must be “documented as appropriate in the I/Leads Records Management System” or by “using the COMMENT button from the event screen in I/MOBILE.” The I/Leads system documents arrests or a contact between an officer and a suspect. There is no connection between the ALPR program and the I/Leads police report system. The two are separate systems.
The ALPR database does not contain the name or other identifying information about the owner of the vehicle. To obtain this information, the officer must log off of the ALPR database and log on to a separate database, such as the VCIN, NCIC, or Department of Motor Vehicles (“DMV”) databases, that are maintained by other agencies. There is no computerized link between the ALPR database and these other databases.
Beyond “active use,” the Police Department also engages in what the parties refer to as “passive use.” The Police Department maintains a database that stores the images that are captured, as well as the GPS coordinates of the locations where those images were captured. This data is stored for 364 days, after which time the information is purged. The database can be searched only by license plate number. Only police officers who are trained and certified as ALPR system users can query the database. The Police Department’s passive use of the ALPR system data is what is at issue in this case.
4
II. INITIAL PROCEEDINGS.
Harrison Neal filed a complaint seeking “an injunction and/or writ of mandamus”
pursuant to the Data Act. He asked the circuit court to prohibit the Police Department from continuing to collect and store license plate data without suspicion of any criminal activity, i.e., the Police Department’s passive use of the technology. Neal contended that the ALPR database is an “information system” that gathers personal information during its passive use and that this practice contravenes the Data Act. Neal filed his complaint after he submitted a Freedom of Information Act request to the Police Department asking for its ALPR records regarding his vehicle. He received two sheets of paper in response. Each sheet contained a picture of his vehicle and his license plate, and listed the time and date the photo was taken.
The circuit court entered summary judgment in favor of the Police Department, concluding the data at issue did not qualify as “personal information” under the Data Act. We reversed that judgment of the circuit court in Neal v. Fairfax County Police Department, 295 Va. 334 (2018) (“Neal I”). We examined to what extent the data gathered by the ALPR system constituted “personal information” as defined in the Data Act. Neal I, 295 Va. at. 345-47.
“Personal information” means all information that (i) describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver’s license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, or (ii) affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual; and the record of his presence, registration, or membership in an organization or activity, or admission to an institution. “Personal information” shall not include routine information maintained for the purpose of internal office administration whose use could not be such as to affect adversely
5
any data subject nor does the term include real estate assessment information.
Code § 2.2-3801.
We concluded that “a license plate number stored in the ALPR database would not be personal information because it does not describe, locate or index anything about an individual.” Neal I, 295 Va. at 346. That, however, did not end the inquiry. We further held that “pictures and data associated with each license plate number constitute ‘personal information’” under Code § 2.2-3801. Id. That is because “[t]he images of the vehicle, its license plate, and the vehicle’s immediate surroundings, along with the GPS location, time, and date when the image was captured ‘afford a basis for inferring personal characteristics, such as . . . things done by or to’ the individual who owns the vehicle, as well as a basis for inferring the presence of the individual who owns the vehicle in a certain location at a certain time.” Id. at 346-47 (quoting Code § 2.2-3801).
The Data Act imposes certain strictures that are keyed to an “information system.” For example, Code § 2.2-3803 restricts an agency’s collection, use and dissemination of personal information if the agency maintains an “information system.” The Data Act also affords certain rights to data subjects when an agency maintains personal information in an information system. See Code § 2.2-3803(A)(5). Agencies maintaining information systems also must make a report of the existence of the system that includes “a description of the nature of the data in the system and the purpose for which it is used.” Code § 2.2-3807. In short, an agency is subject to certain legal obligations if it maintains an “information system.” If an agency does not maintain an information system as defined by the Data Act, those strictures do not apply.
In Neal I, we held that “an agency’s ‘record-keeping process’ is an ‘information system’
if it contains both ‘personal information and the name, personal number, or other identifying
6
particulars’ of an individual.” Id. at 347. We determined that “a license plate number may be an ‘identifying particular’ because it has the potential to identify the individual to whom the plate number is registered in the same way a ‘name’ or ‘personal number’ identifies the individual to which it is assigned.” Id. at 348. Based on the record before us, which came to us on summary judgment, we lacked a sufficient record to determine “whether a sufficient link can be drawn to qualify a license plate number as an ‘identifying particular.’” Id. Consequently, we remanded the case to the circuit court to determine “whether the total components and operations of the ALPR record-keeping process provide a means through which a link between a license plate number and the vehicle’s owner may be readily made.” Id.
III. PROCEEDINGS ON REMAND.
On remand, the circuit court heard evidence concerning the Police Department’s ALPR record-keeping process. The evidence established that the same computer in a police vehicle that hosts ALPR software also contains software programs that are capable of accessing DMV registration data, VCIN criminal information, and NCIC criminal information about motor vehicles and their owners and operators. The DMV database is maintained by the Virginia Department of Motor Vehicles, VCIN is maintained by the Virginia State Police, and the Federal Bureau of Investigation maintains the NCIC database. ALPR operators who obtain a license plate number can readily access information from these separate databases from the same computer that allows them to access the ALPR system.
The circuit court issued a letter opinion in which it concluded that the ALPR record-
keeping process constituted an “information system” under Code § 2.2-3801. The circuit court found that “the ALPR record-keeping process does not itself gather or directly connect to ‘identifying particulars’ of a vehicle owner.” “[W]hile an officer can access all [of those]
7
databases from the same computer, human intervention is required to match personal, identifying information from one database with the license plate number in the ALPR database.” “If an officer acquires a license plate number from the ALPR software on the [laptop]” and wants to search that information in the NCIC, VCIN, or DMV databases, the officer must take several additional steps. The officer must first “clos[e] out of the ALPR software.” Then, the “officer must log into a separate software program called I/MOBILE with a unique state-issued user ID, which is separate from the Fairfax County user ID.” Once an officer has logged into I/MOBILE, “[t]here is a tab [he or she] would click on that would bring up” those databases. The circuit court found that “no less than two computer programs and three passwords” are required before an officer can take information maintained in the ALPR system and use that information to find “the name, personal number, or other identifying particulars of a data subject.” Nevertheless, finding that the ALPR system provides a means through which a link to the identity of a vehicle’s owner can be readily made, the circuit court concluded that the ALPR record-keeping process is subject to the Data Act when in passive use.
The circuit court entered an order that “permanently enjoined [the Police Department]
from the passive collection, storage and use of [ALPR] data.” The court awarded Neal’s attorneys $75,000, out of a fee submission requesting $642,569.75 in fees.
The Police Department appeals, asking us to overturn the circuit court’s conclusion that its retention of license plate data qualifies as an “information system” as defined in the Data Act. For his part, Neal appeals from the circuit court’s fee award, which greatly reduced the fees sought by his attorneys. We awarded both parties an appeal.
8
ANALYSIS
Modern technology enables governments to acquire information on the population on an unprecedented scale. National, state, and local governments can use that information for a variety of administrative purposes and to help apprehend dangerous criminals. But knowledge is power, and power can be abused. “Well managed, responsible data systems are as essential to the orderly and efficient operation of modern business, industry and government as uncontrolled, unrestricted gathering of total information dossiers about total populations are antithetical to a free society.” Va. Advisory Legislative Council, Computer Privacy and Security, Va. S. Doc. No. 27 at 11 (1976). Mindful of the risk of abuse, however, the General Assembly enacted the Data Act to impose certain obligations and restrictions on Virginia governmental agencies with respect to the information they gather and to confer certain rights on Virginians. In the words of the Data Act, “[i]n order to preserve the rights guaranteed a citizen in a free society, legislation is necessary to establish procedures to govern information systems containing records on individuals.” Code § 2.2-3800(B)(4).
In resolving this case, our task is not to reach the right public policy balance by weighing competing demands for efficiency and security against considerations of privacy. Our duty is more modest: we must determine from the text and structure of the Data Act where the legislature has drawn the line.
I. THE ALPR SYSTEM DOES NOT SATISFY THE STATUTORY DEFINITION OF AN “INFORMATION SYSTEM” BECAUSE IT DOES NOT CONTAIN “THE NAME, PERSONAL NUMBER, OR OTHER IDENTIFYING PARTICULARS OF A DATA SUBJECT.”
Under well-established principles, an issue of statutory interpretation is a pure question of law which we review de novo. Conyers v. Martial Arts World of Richmond, 273 Va. 96, 104 (2007). The operative facts are not in dispute. We must resolve a question of law: does the
9
ALPR system qualify as an “information system” because it contains “the name, personal number, or other identifying particulars of a data subject.”
Code § 2.2-3801 defines an “information system” as follows:
“[i]nformation system” means the total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject.
There is no dispute that the ALPR system captures license-plate numbers and records images of the vehicle, along with the date, time, and GPS location where the information was recorded. We concluded in Neal I that a license plate alone is not “personal information” under the Data Act; however, we concluded that the images of the vehicle, its license plate, and the vehicle’s immediate surroundings, along with the GPS location, time, and date when the image was captured did constitute “personal information.” Neal I, 295 Va. at 346-47. On remand, the circuit court found that “the ALPR record-keeping process does not itself gather or directly connect to ‘identifying particulars’ of a vehicle owner . . . .” Identifying particulars can be gleaned only from other databases, maintained by other agencies, that an officer has to access separately from the ALPR system. In Neal I, we said the agency’s record-keeping process must contain “both ‘personal information’ and the ‘name, personal number, or other identifying particulars’ of an individual” in order to constitute an “information system.” Neal I, 295 Va. at 347 (quoting Code § 2.2-3801) (emphasis added). The facts as found by the circuit court make it clear that the ALPR database itself does not contain the name, personal number, or other identifying particulars of an individual. Therefore, the ALPR system itself does not include the things that would bring it under the strictures of the Data Act. Based on these facts, we conclude that the Police Department’s passive use of the ALPR system to capture license plates,
10
photographs of the vehicles, and the date, time, and GPS location of the vehicles do not run afoul of the Data Act.
Neal does not dispute the fact that the ALPR system does not contain the personal details specified in the Data Act. Instead, he contends that the “record-keeping process” under the Data Act includes information gleaned by an officer after the officer logs off of the ALPR system and separately logs on to other databases maintained by other agencies to learn additional information. We do not agree. The text of the statute covers “a record-keeping” process. Code § 2.2-3801. “Keeping” is “the act of one that keeps.” Webster’s Third New International Dictionary 1236 (2002). Since we are dealing with records, to “keep” as intended by the Data Act is to “preserve, maintain” or to “maintain a record.” Id. at 1235; see also Black’s Law Dictionary 1039 (11th ed. 2019) (a “keeper” is “[s]omeone who has the care, custody, or management of something and who [usually] is legally responsible for it.”). There is no evidence that upon searching for information in separate databases, the Police Department is “keeping” any of this information within the ALPR system. The ability to query data in a variety of databases does not offend the Data Act if none of that data is kept in the ALPR system. Having access to data is not the same as “keeping” it. Other provisions of the Data Act support this reading. For example, Code § 2.2-3800(C) addresses obligations of “[r]ecordkeeping agencies of the Commonwealth.” Code § 2.2-3800(C)(8) requires “[a]ny agency holding personal information [to] assure its reliability and take precautions to prevent its misuse.” (emphasis added). The strictures of the Data Act contemplate accountability and responsibility by an agency for the data it keeps – not data it can query from other sources. Code §§ 2.2-3800, 3803.
11
Furthermore, the Data Act defines an “information system” as “the total components and operations of a record-keeping process” – singular. Code § 2.2-3801 (emphasis added). Of course, record-keeping may involve multiple inputs from multiple sources, such as direct downloads from the State Police, and possibly from other sources, as well as manual inputs from an operator. Nevertheless, “a record-keeping process,” singular, cannot plausibly consist of a combination of multiple separately generated and maintained systems. In Neal I, we referred on multiple occasions to the Police Department’s “ALPR record-keeping process.” Neal I, 295 Va. at 348-50. But “a record-keeping” process for ALPR does not include logging off of the ALPR system and separately logging on to other databases to query their contents. Thus, a plain language reading of the words “a record-keeping process” does not support Neal’s expansive reading.
Moreover, the facts are undisputed that these databases, such as the VCIN, NCIC, or DMV databases, are maintained by other agencies. The Data Act defines and regulates the actions of an “agency.” See Code § 2.2-3801 (defining “agency”). The Data Act imposes obligations on an agency with respect to the data it collects and maintains. Code § 2.2-3803 (imposing duties on “[a]ny agency maintaining an information system that includes personal information”). As the Police Department points out, interpreting “record-keeping process” and “information system” in a way that includes databases maintained by other agencies cannot be squared with the structure and requirements of the Data Act. For example, the Data Act requires an agency to (1) “[m]aintain information in the system with accuracy, completeness, timeliness, and pertinence as necessary to ensure fairness in determinations relating to a data subject,” Code § 2.2-3803(A)(4); (2) “[m]aintain a list of all persons or organizations having regular access to personal information in the information system,” Code § 2.2-3803(A)(6); (3) “[m]aintain for a
12
period of three years or until such time as the personal information is purged, whichever is shorter, a complete and accurate record, including identity and purpose, of every access to any personal information in a system,” Code § 2.2-3803(A)(7); and (4) “[e]stablish appropriate safeguards to secure the system from any reasonably foreseeable threat to its security,” Code § 2.2- 3803(A)(9). In order to fulfill these obligations, the Data Act necessarily presupposes that the agency controls the components and operations of the record-keeping process. See Code § 2.2-3806(A)(5)(a) (referencing “[t]he agency maintaining the information system”); id. § 2.2-3806(A)(5)(e) (same). The Data Act imposes restrictions and obligations on “an agency.” Code § 2.2-3803. It does not contemplate holding an agency accountable for the information systems of other agencies. ∗ To resist this construction of the Data Act, Neal points to the fact that the definition of “information system” encompasses “information collected or managed by means of computer networks and the Internet.” Code § 2.2-3801. However, the statutory text is clear that not all information that is “collected or managed by means of computer networks and the Internet” is swept into an “information system.” The information that counts, for purposes of the Data Act, is information, from whatever source, that is part of an agency’s “record-keeping process.” Information from a separate database that is queried but not stored by a particular record-keeping process is not part of a record-keeping process under the act. The same is true of the phrase “the
∗ Neal argues that the Police Department failed to argue for below, or offer evidence in support of, a finding that the Data Act would be unworkable if interagency databases like the NCIC/VCIN/DMV databases were included within the total components and operations of the ALPR because they are not controlled locally by the Police Department. Therefore, he maintains, this argument was waived. We disagree. This is a statutory construction point, not an evidentiary issue. The text of the Data Act holds an agency accountable for its own information systems, not those of others. The fact that an agency may or may not be able to cooperate with another agency is beside the point when determining whether the Data Act applies to a specific information system.
13
total components and operations” of a “record-keeping process.” Code § 2.2-3801. Under the statutory definition, “the total components and operations” that are relevant are those of “a record-keeping process.” The definition of “information system” does not sweep in all components and operations that an agency has access to, or components and operations that in some way support a particular crime-fighting or public protection task.
Neal also contends that the word “manual” in the definition of “information system”
includes the actions of an officer. Under this suggested interpretation, an information system includes situations when an officer obtains a license plate through ALPR, and then signs on to a separate database to glean information about the potential driver of a car, or even makes a telephone call to find out more information. This broad reading of the term “manual” is counterintuitive. The word “manual,” under the statutory text, refers to the manual inputting of data within a specific record-keeping process, not the ability of an operator to log on to a separate system to learn additional information. See Code § 2.2- 3801.
Neal advances a number of other contentions. He points to the fact that the ALPR system downloads a hot list from the State Police’s VCIN database. If the hot list contained the type of information covered by the Data Act, Neal would have a point. The hot list, however, consists of full or partial license plate numbers. It contains no name, personal number, or other identifying particular of a data subject that would trigger the application of the Data Act to the ALPR system.
Neal also contends that the Police Department’s SOP establishes that the ALPR system is an “information system” under the Data Act. That is so, he argues, because the SOP shows that the Police Department obtains information from other databases and directs the users of the ALPR system to use those resources to verify the correctness of the license plate information in
14
the ALPR system. The SOP lends no support to the contention that the separate databases, such as VCIN or NCIC, are part of “a,” singular, ALPR “record-keeping process.” These separate databases certainly facilitate the investigative process by confirming the accuracy of a hit generated by the ALPR system, but they are not part of the ALPR system and do not form part of its record-keeping process. Neal’s argument conflates the ultimate goal of the ALPR system – accurately locating suspects or stolen vehicles – with the ALPR system itself.
Finally, Neal asserts that the Data Act is a remedial statute, and, therefore, we should construe it broadly. However, we are not at liberty to stretch the meaning of a statute in a manner that would contravene the legislature’s intent. See, e.g., Faulkner v. Town of South Boston, 141 Va. 517, 524 (1925) (observing that “[c]ourts cannot read into a statute something that is not within the manifest intention of the legislature, as gathered from the [language of the] statute itself” and that “[t]o depart from the meaning expressed by the words [in a statute] is to alter the statute[;] to legislate and not to interpret”); Low Splint Coal Co. v. Bolling, 224 Va. 400, 404 (1982) (“Liberal construction” of a statute “may not be used to amend a statute by changing the meaning of the statutory language.”). That intent is manifested by the text and structure of the statute which, as explained above, does not apply to the ALPR system as currently configured.
We remanded this case to determine “whether the total components and operations of the ALPR record-keeping process provide a means through which a link between a license plate number and the vehicle’s owner may be readily made.” Neal I, 295 Va. at 348 (emphasis added). Under Code § 2.2-3801, a “record-keeping process” that is maintained by an agency as an “information system” must contain both “personal information” and “the name, personal number, or other identifying particulars of a data subject.” See also Neal I, 295 Va. at 347. We
15
concluded that “the determination of whether the ALPR database is an ‘information system’ under the Data Act turns on whether it also contains ‘the name, personal number, or other identifying particulars’ of an individual.” Id. at 347 (emphasis added). The evidence adduced at the hearing establishes that the answer to that question is “no.” The ALPR database does not contain “the name, personal number, or other identifying particulars of an individual.” Id. Although other databases maintained by other agencies can allow the Police Department to learn “the name, personal number, or other identifying particulars of a data subject,” the ALPR system does not. Therefore, the Police Department’s passive use of the ALPR system is lawful under the Data Act.
II. OUR DECISION IN FAVOR OF THE POLICE DEPARTMENT FORECLOSES THE RECOVERY OF ATTORNEYS’ FEES.
We also granted Neal’s separate appeal to address the propriety of the circuit court’s reduction of the attorneys’ fees sought by Neal’s counsel. The Data Act allows for the recovery of attorneys’ fees “[i]n the case of any successful proceeding by an aggrieved party.” Code § 2.2-3809. Our resolution of this case favorably to the Police Department moots the question of the propriety of the circuit court’s reduction of the requested attorneys’ fees. Because Neal’s challenge to the Police Department’s passive collection of data was ultimately unsuccessful, he is not entitled to an award of attorney’s fees.
CONCLUSION
We will reverse the judgment below, dissolve the injunction, and enter final judgment in favor of the Police Department.
Reversed and final judgment.