A state judge in Virginia ruled earlier this month that license plate tracking data collected by automatic license plate reader (ALPR) systems are personally identifiable information, outlawing their storage when law enforcement has no good reason to collect and retain them.

The impact of the ruling by Virginia Fairfax County Circuit Court Judge Robert J. Smith is likely to be enormous, as it effectively bans law enforcement in the state from conducting dragnet surveillance.

The lawsuit dates back to 2015. That year, the American Civil Liberties Union of Virginia sued the Fairfax County Police Department on behalf of Harrison Neal. Through a public records request, Neal discovered that the Fairfax police department had collected data on his whereabouts using license plate readers. The police collected and maintained these records on Neal—and millions of other Virginians—even though they never suspected him of involvement in any criminal activity. The ACLU filed suit representing Neal, arguing that the police department’s collection and retention of information on his whereabouts for nearly a year violated Virginia’s Government Data Collection and Dissemination Practices Act, a state law controlling how government agencies in Virginia are allowed to collect, store, and share personal information about residents.

License plate readers are surveillance devices mounted on police vehicles or stationary objects like light poles or bridges. The cameras read and record every license plate that comes into their field of vision—as many as 3,600 plates per minute, or 216,000 an hour. Each time the cameras capture a license plate, they create a file containing an image of the car, the license plate number, and the time, date, and location where the surveillance occurred.

The ACLU has been sounding the alarm about the use of ALPRs all over the country since 2012. While some states have regulated their use, limiting the time police departments can retain non-derogatory information, most police departments use the systems to conduct both active and passive surveillance—that is, to actively search for cars connected to suspected criminal activity, and to collect and retain for long periods information about drivers who are not suspected of any crimes.

In this ACLU lawsuit in Virginia, the key question was whether the collection and storage of Neal’s license plate data without suspicion of any criminal activity was legal under Virginia state law. To determine if the surveillance violated that law, the ACLU had to prove two things. First, the ACLU had to demonstrate that the state data protection law applied to the police department’s collection of license plate reader data—specifically, that the records constituted personal information and that the license plate reader record keeping system was an information system as defined under the state law. Second, provided the law applied, the ACLU had to prove that the police department’s passive surveillance was not exempt from the law and that therefore the creation of the database violated it. To do that, the ACLU argued that this type of surveillance violated the law’s provision requiring a clear and established need to collect information.

The ACLU lost at the circuit court, which held in favor of the police department. But the ACLU appealed, and the Virginia Supreme Court reversed the lower court’s decision, ruling in favor of the ACLU and Neal. Writing for the Court, Justice Powell’s decision hinged on three main questions. First, does ALPR information constitute “personal information” as defined by the statute? Second, is the ALPR database an “information system” protected under the state law? And finally, if the answers to the first two questions are ‘yes,’ is there an exemption from the data protection law that applies to the personal records and information system at issue?

To answer the first question, the Court looked to the nature of the information collected. The Justices used a framework that distinguished license plate numbers per se from ALPR data. While the former is not personal information, the latter is, the Court held. Under Virginia law, information is considered “personal information” when it affords a basis for inferring personal characteristics or the presence of an identified individual. The Court ruled that license plate numbers alone are just a combination of characters, and that whether or not they constitute personal information depends on the context in which they are used. But ALPR data is different, the Court held, because it contains not only the license plate number, but also images of the vehicle, its license plate, its immediate surroundings, and the GPS location, time, and date captured with the image. Taken together, this information allows its holder to infer personal characteristics and show where individuals have been. Consequently, the Justices decided, ALPR records fall under the statutory definition of “personal information.”

Next, the Court examined whether the ALPR system constitutes an “information system” protected under the statute. Unsurprisingly, there is a direct connection between this issue and the previous one: the law defines an information system as a record-keeping process that contains both personal information and identifiers (like names or personal numbers) of particular individuals. Here, the Court ruled that the ALPR information constitutes personal information. But given the information before it, the Court could not discern if there was a sufficient link between the license plate number and Neal to characterize that number as one of the identifiers that would complete the information system equation. Accordingly, the Justices remanded the case to the lower court to decide this issue.

Finally, the Court looked at the scope of the law enforcement exemption in the state law. The exemption excludes from the statute’s protections information systems that relate to investigations and intelligence gathering related to criminal activity. Here, in accordance with the opinion of the Attorney General, issued in 2013, the Court decided that the exemption did not apply to passive surveillance. The 2013 AG opinion concluded that the state police’s passive collection of ALPR data violated state law because there was not a clear “need” for its collection. The AG reasoned that the value of records revealing where people not suspected of criminal activity have traveled to a criminal investigation was “wholly speculative”—a value the data protection statute does not incorporate in any of its exceptions. In other words, the AG and the High Court agreed: There’s no valid need for cops to track the movements of people not suspected of criminal activity.

On remand to the lower court, the only issue left to decide was whether license plate numbers could effectively identify Neal, meaning the ALPR system constituted an information system.

The evidence the lower court heard was very clear: In Virginia, police officers have unlimited access not only to ALPR information but also DMV records and other law enforcement databases—including the National Crime Information Center maintained by the FBI. It’s therefore a trivial matter for a Virigina law enforcement official to connect ALPR data to a person’s name and address. The circle therefore closed. The passive surveillance database was an information system that permitted police to identify people using ALPR data and license plate numbers. Accordingly, its existence was against the law because there was no established need for it to exist.

The Virigina High Court has dealt a major blow to law enforcement surveillance of people not suspected of criminal activity, giving privacy advocates cause to celebrate. Put simply: Despite common claims to the contrary, license plate numbers are not anonymous.

“The spectator makes the picture,” Marcel Duchamp said. It does not matter if police need to toggle between two discrete databases to perform the identification—it’s nonetheless an identification.

Generally, the legality of data collection hinges on the purpose for which it is collected. Privacy cannot protect itself; it requires principles, safeguards, and rules. Only then we can speak about the legitimate collection and storage of information. Government surveillance is not exempt from this rule. Virginia is on the right track. Governments should be required to prove the existence of a valid—real, not speculative—reason for collecting information about residents.

State privacy laws ought to incorporate this bedrock principle and, following Virginia’s lead, start to dismantle passive, dragnet surveillance. Thankfully, according to the Virginia Supreme Court, Virginia’s Government Data Collection and Dissemination Practices Act does the job.

This blog post was written by Technology for Liberty Program Policy Counsel Emiliano Falcon-Morano.