If you're a regular reader of this blog you know the government and private companies are tracking our movements using license plate readers, a practice that is in most states completely unregulated. The largest known database of license plate location records is held by Vigilant Solutions, a private firm that collects data from other companies and police departments, and leases access to its billions of records to cops and federal agencies.

The ACLU has been raising the alarm about license plate tracking for years now. And every day that legislatures fail to pass sensible laws restricting the amount of time law enforcement agencies can retain our historical location records, the databases get bigger—along with the threat they pose to our freedom.

Only a handful of states have laws on the books regulating license plate readers and the powerful, invasive data they produce. Recently my colleagues in Virginia worked with a broad coalition of groups, including the Tea Party, to get the legislature to pass two laws limiting how long police could store this sensitive information. Virginia's democratic governor vetoed them both.

Now the ACLU of Virginia has filed suit against the Fairfax police department arguing that its retention of non-derogatory license plate data violates state privacy law.

They write:

The lawsuit was filed on behalf of Fairfax resident Harrison Neal, who discovered that his license plate had been scanned twice in the course of a year and stored in a database, even though neither Neal nor his vehicle are part of any police investigation. The suit claims that in keeping date and location information for thousands of vehicle’s, including Neal’s, FCPD has violated Virginia’s Government Data Collection and Dissemination Practices Act (the “Data Act”).

“The Department’s ALPR database can be used to discover the location of thousands of vehicles at a particular date and time,” said ACLU of Virginia Legal Director Rebecca Glenberg. “It is an unacceptable invasion of privacy.” She continued, “The Data Act is very clear. Personal information cannot be collected, stored, or disseminated unless the need for such collection has been clearly established in advance and the information is appropriate and relevant for the purpose for which it was collected. None of this is true of the thousands of license plate numbers stored in FCPD’s database.”

The ACLU is not alone in thinking the police collection and retention of all of this information violates the law. In 2013, the state's Attorney General "issued an opinion advising the Superintendent of the State Police that data collected with ALPRs or any surveillance technology is “personal information” as defined by the Data Act, and that the collection, storage, and dissemination of ALPR records not related to a specific criminal investigation violates the statute."

The state police subsequently stopped retaining data unless it was part of a criminal investigation, but plenty of other police departments in Virginia kept doing it despite the AG's opinion. The Fairfax police have a policy allowing them to retain the data for a full year, and share it with other departments in Virginia, Maryland, and DC. So the ACLU is suing.

Visit the ACLU of Virginia site to read more about license plate tracking in that state, and to read their complaint.