PRESENT: Lemons, C.J., Mims, Powell, Kelsey, McCullough, and Chafin, JJ., and Millette, 

S.J. 

HARRISON NEAL

v. Record No. 191127 

FAIRFAX COUNTY POLICE

DEPARTMENT, ET AL. OPINION BY

 JUSTICE STEPHEN R. McCULLOUGH

 October 22, 2020 

FAIRFAX COUNTY POLICE 

DEPARTMENT, ET AL.

v. Record No. 191129 

HARRISON NEAL

FROM THE CIRCUIT COURT OF FAIRFAX COUNTY

Robert J. Smith, Judge 

 The Fairfax County Police Department (“Police Department”) appeals from an injunction 

that prohibits it from passively collecting, storing, and using license plate and related data

through its Automated License Plate Recognition (“ALPR”) system. Among other things, the 

Police Department contends that the circuit court erred in concluding that the ALPR system 

satisfies the definition of an “information system” under the Government Data Collection and 

Dissemination Practices Act, Code §§ 2.2-3800 through -3809 (“Data Act”). Neal separately 

appeals the circuit court’s award of attorney’s fees, contending the circuit court erred in reducing 

the fees sought by his attorneys. App. 2089. We agree with the Police Department that the 

ALPR system does not constitute an “information system” within the intendment of the Data Act 

and we, therefore, reverse the decision below. 
2

BACKGROUND

I. THE ALPR SYSTEM. 

The Police Department’s ALPR system uses cameras that capture images of passing 

vehicles’ license plates. The cameras can be stationary or mounted on a police vehicle. Once 

the camera captures a license plate image it converts that image into an alpha-numeric 

combination. In order to access that alpha-numeric combination and associated data, an officer

of the Police Department must specifically log on to the ALPR software program. Logging on to 

the ALPR software program requires a unique log-in credential and password. Only officers 

who have completed the required training can gain access to the software. The Police

Department employs the ALPR system for “active” and “passive” uses. 

“Active” use involves checking the license plates that are scanned against a “hot list.” 

The Virginia State Police publishes this “hot list” twice daily. The list consists of all active 

stolen license plates and vehicles from two databases, the National Crime Information Center 

(“NCIC”) and Virginia Criminal Information Network (“VCIN”). The hot list also contains 

license plates associated with suspected criminal activity, such as abductions. The hot list is 

available to authorized law enforcement personnel who can access it through a secure website. 

The hot list can be imported into the ALPR system either automatically through a server or 

manually by the end user. The end user may also manually enter a license plate into the ALPR 

system along with a notation regarding the reason for the entry, for example a stolen vehicle. 

While scanning license plates, the ALPR software alerts the operator when it detects a 

potential stolen vehicle or license plate. According to a Standard Operating Procedure (“SOP”) 

developed by the Police Department, “[a]n alarm is NOT conclusive confirmation that a license 

plate or vehicle is wanted, but an indicator that additional investigation is warranted.” If the 
3

ALPR system alerts, the officer is instructed to visually verify the license plate, to make sure it is 

from the correct state and displays the same characters as the ones on the screen. The SOP then 

instructs the officer to make sure the hot list is still active by checking the NCIC/VCIN 

databases, either by running the information in a search on the computer in the car or by a voice 

request. The SOP further states that “[s]tolen vehicle or license plate responses from 

NCIC/VCIN shall be confirmed by Teletype in accordance with established procedures as soon 

as practical.” Additionally, if an officer makes contact with a suspect, the contact must be 

“documented as appropriate in the I/Leads Records Management System” or by “using the 

COMMENT button from the event screen in I/MOBILE.” The I/Leads system documents arrests 

or a contact between an officer and a suspect. There is no connection between the ALPR 

program and the I/Leads police report system. The two are separate systems.

 The ALPR database does not contain the name or other identifying information about the 

owner of the vehicle. To obtain this information, the officer must log off of the ALPR database 

and log on to a separate database, such as the VCIN, NCIC, or Department of Motor Vehicles 

(“DMV”) databases, that are maintained by other agencies. There is no computerized link 

between the ALPR database and these other databases.

Beyond “active use,” the Police Department also engages in what the parties refer to as 

“passive use.” The Police Department maintains a database that stores the images that are

captured, as well as the GPS coordinates of the locations where those images were captured. 

This data is stored for 364 days, after which time the information is purged. The database can be 

searched only by license plate number. Only police officers who are trained and certified as 

ALPR system users can query the database. The Police Department’s passive use of the ALPR 

system data is what is at issue in this case.
4

II. INITIAL PROCEEDINGS. 

Harrison Neal filed a complaint seeking “an injunction and/or writ of mandamus” 

pursuant to the Data Act. He asked the circuit court to prohibit the Police Department from 

continuing to collect and store license plate data without suspicion of any criminal activity, i.e., 

the Police Department’s passive use of the technology. Neal contended that the ALPR database 

is an “information system” that gathers personal information during its passive use and that this 

practice contravenes the Data Act. Neal filed his complaint after he submitted a Freedom of 

Information Act request to the Police Department asking for its ALPR records regarding his 

vehicle. He received two sheets of paper in response. Each sheet contained a picture of his 

vehicle and his license plate, and listed the time and date the photo was taken. 

The circuit court entered summary judgment in favor of the Police Department, 

concluding the data at issue did not qualify as “personal information” under the Data Act. We 

reversed that judgment of the circuit court in Neal v. Fairfax County Police Department, 295 Va. 

334 (2018) (“Neal I”). We examined to what extent the data gathered by the ALPR system 

constituted “personal information” as defined in the Data Act. Neal I, 295 Va. at. 345-47. 

“Personal information” means all information that (i) describes, 

locates or indexes anything about an individual including, but not 

limited to, his social security number, driver’s license number, 

agency-issued identification number, student identification 

number, real or personal property holdings derived from tax 

returns, and his education, financial transactions, medical history, 

ancestry, religion, political ideology, criminal or employment 

record, or (ii) affords a basis for inferring personal characteristics, 

such as finger and voice prints, photographs, or things done by or 

to such individual; and the record of his presence, registration, or 

membership in an organization or activity, or admission to an 

institution. “Personal information” shall not include routine 

information maintained for the purpose of internal office 

administration whose use could not be such as to affect adversely 
5

any data subject nor does the term include real estate assessment 

information. 

Code § 2.2-3801. 

We concluded that “a license plate number stored in the ALPR database would not be 

personal information because it does not describe, locate or index anything about an individual.” 

Neal I, 295 Va. at 346. That, however, did not end the inquiry. We further held that “pictures 

and data associated with each license plate number constitute ‘personal information’” under 

Code § 2.2-3801. Id. That is because “[t]he images of the vehicle, its license plate, and the 

vehicle’s immediate surroundings, along with the GPS location, time, and date when the image 

was captured ‘afford a basis for inferring personal characteristics, such as . . . things done by or 

to’ the individual who owns the vehicle, as well as a basis for inferring the presence of the 

individual who owns the vehicle in a certain location at a certain time.” Id. at 346-47 (quoting 

Code § 2.2-3801). 

The Data Act imposes certain strictures that are keyed to an “information system.” For 

example, Code § 2.2-3803 restricts an agency’s collection, use and dissemination of personal 

information if the agency maintains an “information system.” The Data Act also affords certain 

rights to data subjects when an agency maintains personal information in an information system. 

See Code § 2.2-3803(A)(5). Agencies maintaining information systems also must make a report 

of the existence of the system that includes “a description of the nature of the data in the system 

and the purpose for which it is used.” Code § 2.2-3807. In short, an agency is subject to certain 

legal obligations if it maintains an “information system.” If an agency does not maintain an 

information system as defined by the Data Act, those strictures do not apply. 

In Neal I, we held that “an agency’s ‘record-keeping process’ is an ‘information system’ 

if it contains both ‘personal information and the name, personal number, or other identifying 
6

particulars’ of an individual.” Id. at 347. We determined that “a license plate number may be an 

‘identifying particular’ because it has the potential to identify the individual to whom the plate 

number is registered in the same way a ‘name’ or ‘personal number’ identifies the individual to 

which it is assigned.” Id. at 348. Based on the record before us, which came to us on summary 

judgment, we lacked a sufficient record to determine “whether a sufficient link can be drawn to 

qualify a license plate number as an ‘identifying particular.’” Id. Consequently, we remanded 

the case to the circuit court to determine “whether the total components and operations of the 

ALPR record-keeping process provide a means through which a link between a license plate 

number and the vehicle’s owner may be readily made.” Id.

III. PROCEEDINGS ON REMAND. 

 On remand, the circuit court heard evidence concerning the Police Department’s ALPR 

record-keeping process. The evidence established that the same computer in a police vehicle that 

hosts ALPR software also contains software programs that are capable of accessing DMV 

registration data, VCIN criminal information, and NCIC criminal information about motor 

vehicles and their owners and operators. The DMV database is maintained by the Virginia 

Department of Motor Vehicles, VCIN is maintained by the Virginia State Police, and the Federal 

Bureau of Investigation maintains the NCIC database. ALPR operators who obtain a license 

plate number can readily access information from these separate databases from the same 

computer that allows them to access the ALPR system. 

The circuit court issued a letter opinion in which it concluded that the ALPR recordkeeping process constituted an “information system” under Code § 2.2-3801. The circuit court 

found that “the ALPR record-keeping process does not itself gather or directly connect to 

‘identifying particulars’ of a vehicle owner.” “[W]hile an officer can access all [of those] 
7

databases from the same computer, human intervention is required to match personal, identifying 

information from one database with the license plate number in the ALPR database.” “If an 

officer acquires a license plate number from the ALPR software on the [laptop]” and wants to 

search that information in the NCIC, VCIN, or DMV databases, the officer must take several 

additional steps. The officer must first “clos[e] out of the ALPR software.” Then, the “officer 

must log into a separate software program called I/MOBILE with a unique state-issued user ID, 

which is separate from the Fairfax County user ID.” Once an officer has logged into I/MOBILE, 

“[t]here is a tab [he or she] would click on that would bring up” those databases. The circuit

court found that “no less than two computer programs and three passwords” are required before 

an officer can take information maintained in the ALPR system and use that information to find 

“the name, personal number, or other identifying particulars of a data subject.” Nevertheless, 

finding that the ALPR system provides a means through which a link to the identity of a 

vehicle’s owner can be readily made, the circuit court concluded that the ALPR record-keeping 

process is subject to the Data Act when in passive use.

The circuit court entered an order that “permanently enjoined [the Police Department] 

from the passive collection, storage and use of [ALPR] data.” The court awarded Neal’s 

attorneys $75,000, out of a fee submission requesting $642,569.75 in fees. 

 The Police Department appeals, asking us to overturn the circuit court’s conclusion that 

its retention of license plate data qualifies as an “information system” as defined in the Data Act. 

For his part, Neal appeals from the circuit court’s fee award, which greatly reduced the fees 

sought by his attorneys. We awarded both parties an appeal.
8

ANALYSIS

 Modern technology enables governments to acquire information on the population on an 

unprecedented scale. National, state, and local governments can use that information for a 

variety of administrative purposes and to help apprehend dangerous criminals. But knowledge is 

power, and power can be abused. “Well managed, responsible data systems are as essential to 

the orderly and efficient operation of modern business, industry and government as uncontrolled, 

unrestricted gathering of total information dossiers about total populations are antithetical to a 

free society.” Va. Advisory Legislative Council, Computer Privacy and Security, Va. S. Doc. 

No. 27 at 11 (1976). Mindful of the risk of abuse, however, the General Assembly enacted the 

Data Act to impose certain obligations and restrictions on Virginia governmental agencies with 

respect to the information they gather and to confer certain rights on Virginians. In the words of 

the Data Act, “[i]n order to preserve the rights guaranteed a citizen in a free society, legislation is 

necessary to establish procedures to govern information systems containing records on 

individuals.” Code § 2.2-3800(B)(4). 

 In resolving this case, our task is not to reach the right public policy balance by weighing 

competing demands for efficiency and security against considerations of privacy. Our duty is 

more modest: we must determine from the text and structure of the Data Act where the 

legislature has drawn the line.

I. THE ALPR SYSTEM DOES NOT SATISFY THE STATUTORY DEFINITION OF AN 

“INFORMATION SYSTEM” BECAUSE IT DOES NOT CONTAIN “THE NAME, PERSONAL 

NUMBER, OR OTHER IDENTIFYING PARTICULARS OF A DATA SUBJECT.” 

Under well-established principles, an issue of statutory interpretation is a pure question of 

law which we review de novo. Conyers v. Martial Arts World of Richmond, 273 Va. 96, 104 

(2007). The operative facts are not in dispute. We must resolve a question of law: does the 
9

ALPR system qualify as an “information system” because it contains “the name, personal 

number, or other identifying particulars of a data subject.” 

 Code § 2.2-3801 defines an “information system” as follows: 

“[i]nformation system” means the total components and operations 

of a record-keeping process, including information collected or 

managed by means of computer networks and the Internet, whether 

automated or manual, containing personal information and the 

name, personal number, or other identifying particulars of a data 

subject.

 There is no dispute that the ALPR system captures license-plate numbers and records 

images of the vehicle, along with the date, time, and GPS location where the information was 

recorded. We concluded in Neal I that a license plate alone is not “personal information” under 

the Data Act; however, we concluded that the images of the vehicle, its license plate, and the 

vehicle’s immediate surroundings, along with the GPS location, time, and date when the image 

was captured did constitute “personal information.” Neal I, 295 Va. at 346-47. On remand, the 

circuit court found that “the ALPR record-keeping process does not itself gather or directly 

connect to ‘identifying particulars’ of a vehicle owner . . . .” Identifying particulars can be 

gleaned only from other databases, maintained by other agencies, that an officer has to access 

separately from the ALPR system. In Neal I, we said the agency’s record-keeping process must 

contain “both ‘personal information’ and the ‘name, personal number, or other identifying 

particulars’ of an individual” in order to constitute an “information system.” Neal I, 295 Va. at 

347 (quoting Code § 2.2-3801) (emphasis added). The facts as found by the circuit court make it 

clear that the ALPR database itself does not contain the name, personal number, or other 

identifying particulars of an individual. Therefore, the ALPR system itself does not include the 

things that would bring it under the strictures of the Data Act. Based on these facts, we conclude 

that the Police Department’s passive use of the ALPR system to capture license plates, 
10

photographs of the vehicles, and the date, time, and GPS location of the vehicles do not run afoul 

of the Data Act. 

 Neal does not dispute the fact that the ALPR system does not contain the personal details 

specified in the Data Act. Instead, he contends that the “record-keeping process” under the Data 

Act includes information gleaned by an officer after the officer logs off of the ALPR system and 

separately logs on to other databases maintained by other agencies to learn additional 

information. We do not agree. The text of the statute covers “a record-keeping” process. Code 

§ 2.2-3801. “Keeping” is “the act of one that keeps.” Webster’s Third New International 

Dictionary 1236 (2002). Since we are dealing with records, to “keep” as intended by the Data 

Act is to “preserve, maintain” or to “maintain a record.” Id. at 1235; see also Black’s Law 

Dictionary 1039 (11th ed. 2019) (a “keeper” is “[s]omeone who has the care, custody, or 

management of something and who [usually] is legally responsible for it.”). There is no 

evidence that upon searching for information in separate databases, the Police Department is 

“keeping” any of this information within the ALPR system. The ability to query data in a variety 

of databases does not offend the Data Act if none of that data is kept in the ALPR system. 

Having access to data is not the same as “keeping” it. Other provisions of the Data Act support 

this reading. For example, Code § 2.2-3800(C) addresses obligations of “[r]ecordkeeping

agencies of the Commonwealth.” Code § 2.2-3800(C)(8) requires “[a]ny agency holding 

personal information [to] assure its reliability and take precautions to prevent its misuse.” 

(emphasis added). The strictures of the Data Act contemplate accountability and responsibility 

by an agency for the data it keeps – not data it can query from other sources. Code §§ 2.2-3800, 

3803. 
11

 Furthermore, the Data Act defines an “information system” as “the total components and 

operations of a record-keeping process” – singular. Code § 2.2-3801 (emphasis added). Of 

course, record-keeping may involve multiple inputs from multiple sources, such as direct 

downloads from the State Police, and possibly from other sources, as well as manual inputs from 

an operator. Nevertheless, “a record-keeping process,” singular, cannot plausibly consist of a 

combination of multiple separately generated and maintained systems. In Neal I, we referred on 

multiple occasions to the Police Department’s “ALPR record-keeping process.” Neal I, 295 Va. 

at 348-50. But “a record-keeping” process for ALPR does not include logging off of the ALPR

system and separately logging on to other databases to query their contents. Thus, a plain 

language reading of the words “a record-keeping process” does not support Neal’s expansive 

reading. 

 Moreover, the facts are undisputed that these databases, such as the VCIN, NCIC, or 

DMV databases, are maintained by other agencies. The Data Act defines and regulates the 

actions of an “agency.” See Code § 2.2-3801 (defining “agency”). The Data Act imposes 

obligations on an agency with respect to the data it collects and maintains. Code § 2.2-3803 

(imposing duties on “[a]ny agency maintaining an information system that includes personal 

information”). As the Police Department points out, interpreting “record-keeping process” and 

“information system” in a way that includes databases maintained by other agencies cannot be 

squared with the structure and requirements of the Data Act. For example, the Data Act requires 

an agency to (1) “[m]aintain information in the system with accuracy, completeness, timeliness, 

and pertinence as necessary to ensure fairness in determinations relating to a data subject,” Code 

§ 2.2-3803(A)(4); (2) “[m]aintain a list of all persons or organizations having regular access to 

personal information in the information system,” Code § 2.2-3803(A)(6); (3) “[m]aintain for a 
12

period of three years or until such time as the personal information is purged, whichever is 

shorter, a complete and accurate record, including identity and purpose, of every access to any 

personal information in a system,” Code § 2.2-3803(A)(7); and (4) “[e]stablish appropriate 

safeguards to secure the system from any reasonably foreseeable threat to its security,” Code 

§ 2.2- 3803(A)(9). In order to fulfill these obligations, the Data Act necessarily presupposes that 

the agency controls the components and operations of the record-keeping process. See Code 

§ 2.2-3806(A)(5)(a) (referencing “[t]he agency maintaining the information system”); id.

§ 2.2-3806(A)(5)(e) (same). The Data Act imposes restrictions and obligations on “an agency.” 

Code § 2.2-3803. It does not contemplate holding an agency accountable for the information 

systems of other agencies.∗

 To resist this construction of the Data Act, Neal points to the fact that the definition of 

“information system” encompasses “information collected or managed by means of computer 

networks and the Internet.” Code § 2.2-3801. However, the statutory text is clear that not all 

information that is “collected or managed by means of computer networks and the Internet” is 

swept into an “information system.” The information that counts, for purposes of the Data Act, 

is information, from whatever source, that is part of an agency’s “record-keeping process.” 

Information from a separate database that is queried but not stored by a particular record-keeping 

process is not part of a record-keeping process under the act. The same is true of the phrase “the 

∗ Neal argues that the Police Department failed to argue for below, or offer evidence in 

support of, a finding that the Data Act would be unworkable if interagency databases like the 

NCIC/VCIN/DMV databases were included within the total components and operations of the 

ALPR because they are not controlled locally by the Police Department. Therefore, he 

maintains, this argument was waived. We disagree. This is a statutory construction point, not an 

evidentiary issue. The text of the Data Act holds an agency accountable for its own information 

systems, not those of others. The fact that an agency may or may not be able to cooperate with 

another agency is beside the point when determining whether the Data Act applies to a specific 

information system.
13

total components and operations” of a “record-keeping process.” Code § 2.2-3801. Under the 

statutory definition, “the total components and operations” that are relevant are those of “a 

record-keeping process.” The definition of “information system” does not sweep in all

components and operations that an agency has access to, or components and operations that in 

some way support a particular crime-fighting or public protection task. 

 Neal also contends that the word “manual” in the definition of “information system” 

includes the actions of an officer. Under this suggested interpretation, an information system 

includes situations when an officer obtains a license plate through ALPR, and then signs on to a 

separate database to glean information about the potential driver of a car, or even makes a 

telephone call to find out more information. This broad reading of the term “manual” is 

counterintuitive. The word “manual,” under the statutory text, refers to the manual inputting of 

data within a specific record-keeping process, not the ability of an operator to log on to a 

separate system to learn additional information. See Code § 2.2- 3801. 

 Neal advances a number of other contentions. He points to the fact that the ALPR system 

downloads a hot list from the State Police’s VCIN database. If the hot list contained the type of 

information covered by the Data Act, Neal would have a point. The hot list, however, consists of 

full or partial license plate numbers. It contains no name, personal number, or other identifying 

particular of a data subject that would trigger the application of the Data Act to the ALPR 

system.

Neal also contends that the Police Department’s SOP establishes that the ALPR system is 

an “information system” under the Data Act. That is so, he argues, because the SOP shows that 

the Police Department obtains information from other databases and directs the users of the 

ALPR system to use those resources to verify the correctness of the license plate information in 
14

the ALPR system. The SOP lends no support to the contention that the separate databases, such 

as VCIN or NCIC, are part of “a,” singular, ALPR “record-keeping process.” These separate 

databases certainly facilitate the investigative process by confirming the accuracy of a hit 

generated by the ALPR system, but they are not part of the ALPR system and do not form part of 

its record-keeping process. Neal’s argument conflates the ultimate goal of the ALPR system – 

accurately locating suspects or stolen vehicles – with the ALPR system itself.

 Finally, Neal asserts that the Data Act is a remedial statute, and, therefore, we should 

construe it broadly. However, we are not at liberty to stretch the meaning of a statute in a 

manner that would contravene the legislature’s intent. See, e.g., Faulkner v. Town of South 

Boston, 141 Va. 517, 524 (1925) (observing that “[c]ourts cannot read into a statute something 

that is not within the manifest intention of the legislature, as gathered from the [language of the] 

statute itself” and that “[t]o depart from the meaning expressed by the words [in a statute] is to 

alter the statute[;] to legislate and not to interpret”); Low Splint Coal Co. v. Bolling, 224 Va. 400, 

404 (1982) (“Liberal construction” of a statute “may not be used to amend a statute by changing 

the meaning of the statutory language.”). That intent is manifested by the text and structure of 

the statute which, as explained above, does not apply to the ALPR system as currently 

configured. 

 We remanded this case to determine “whether the total components and operations of the 

ALPR record-keeping process provide a means through which a link between a license plate 

number and the vehicle’s owner may be readily made.” Neal I, 295 Va. at 348 (emphasis 

added). Under Code § 2.2-3801, a “record-keeping process” that is maintained by an agency as 

an “information system” must contain both “personal information” and “the name, personal 

number, or other identifying particulars of a data subject.” See also Neal I, 295 Va. at 347. We 
15

concluded that “the determination of whether the ALPR database is an ‘information system’ 

under the Data Act turns on whether it also contains ‘the name, personal number, or other 

identifying particulars’ of an individual.” Id. at 347 (emphasis added). The evidence adduced at 

the hearing establishes that the answer to that question is “no.” The ALPR database does not 

contain “the name, personal number, or other identifying particulars of an individual.” Id. 

Although other databases maintained by other agencies can allow the Police Department to 

learn “the name, personal number, or other identifying particulars of a data subject,” the ALPR 

system does not. Therefore, the Police Department’s passive use of the ALPR system is lawful 

under the Data Act.

II. OUR DECISION IN FAVOR OF THE POLICE DEPARTMENT FORECLOSES THE RECOVERY 

OF ATTORNEYS’ FEES. 

We also granted Neal’s separate appeal to address the propriety of the circuit court’s 

reduction of the attorneys’ fees sought by Neal’s counsel. The Data Act allows for the recovery 

of attorneys’ fees “[i]n the case of any successful proceeding by an aggrieved party.” Code 

§ 2.2-3809. Our resolution of this case favorably to the Police Department moots the question of 

the propriety of the circuit court’s reduction of the requested attorneys’ fees. Because Neal’s 

challenge to the Police Department’s passive collection of data was ultimately unsuccessful, he is 

not entitled to an award of attorney’s fees. 

CONCLUSION

We will reverse the judgment below, dissolve the injunction, and enter final judgment in 

favor of the Police Department. 

Reversed and final judgment.