Opinion ID: 4579435
Heading Depth: 1
Heading Rank: 2

Heading: analysis

Text: Modern technology enables governments to acquire information on the population on an unprecedented scale. National, state, and local governments can use that information for a variety of administrative purposes and to help apprehend dangerous criminals. But knowledge is power, and power can be abused. “Well managed, responsible data systems are as essential to the orderly and efficient operation of modern business, industry and government as uncontrolled, unrestricted gathering of total information dossiers about total populations are antithetical to a free society.” Va. Advisory Legislative Council, Computer Privacy and Security, Va. S. Doc. No. 27 at 11 (1976). Mindful of the risk of abuse, however, the General Assembly enacted the Data Act to impose certain obligations and restrictions on Virginia governmental agencies with respect to the information they gather and to confer certain rights on Virginians. In the words of the Data Act, “[i]n order to preserve the rights guaranteed a citizen in a free society, legislation is necessary to establish procedures to govern information systems containing records on individuals.” Code § 2.2-3800(B)(4). In resolving this case, our task is not to reach the right public policy balance by weighing competing demands for efficiency and security against considerations of privacy. Our duty is more modest: we must determine from the text and structure of the Data Act where the legislature has drawn the line. I. THE ALPR SYSTEM DOES NOT SATISFY THE STATUTORY DEFINITION OF AN “INFORMATION SYSTEM” BECAUSE IT DOES NOT CONTAIN “THE NAME, PERSONAL NUMBER, OR OTHER IDENTIFYING PARTICULARS OF A DATA SUBJECT.” Under well-established principles, an issue of statutory interpretation is a pure question of law which we review de novo. Conyers v. Martial Arts World of Richmond, 273 Va. 96, 104 (2007). The operative facts are not in dispute. We must resolve a question of law: does the 8 ALPR system qualify as an “information system” because it contains “the name, personal number, or other identifying particulars of a data subject.” Code § 2.2-3801 defines an “information system” as follows: “[i]nformation system” means the total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject. There is no dispute that the ALPR system captures license-plate numbers and records images of the vehicle, along with the date, time, and GPS location where the information was recorded. We concluded in Neal I that a license plate alone is not “personal information” under the Data Act; however, we concluded that the images of the vehicle, its license plate, and the vehicle’s immediate surroundings, along with the GPS location, time, and date when the image was captured did constitute “personal information.” Neal I, 295 Va. at 346-47. On remand, the circuit court found that “the ALPR record-keeping process does not itself gather or directly connect to ‘identifying particulars’ of a vehicle owner . . . .” Identifying particulars can be gleaned only from other databases, maintained by other agencies, that an officer has to access separately from the ALPR system. In Neal I, we said the agency’s record-keeping process must contain “both ‘personal information’ and the ‘name, personal number, or other identifying particulars’ of an individual” in order to constitute an “information system.” Neal I, 295 Va. at 347 (quoting Code § 2.2-3801) (emphasis added). The facts as found by the circuit court make it clear that the ALPR database itself does not contain the name, personal number, or other identifying particulars of an individual. Therefore, the ALPR system itself does not include the things that would bring it under the strictures of the Data Act. Based on these facts, we conclude that the Police Department’s passive use of the ALPR system to capture license plates, 9 photographs of the vehicles, and the date, time, and GPS location of the vehicles do not run afoul of the Data Act. Neal does not dispute the fact that the ALPR system does not contain the personal details specified in the Data Act. Instead, he contends that the “record-keeping process” under the Data Act includes information gleaned by an officer after the officer logs off of the ALPR system and separately logs on to other databases maintained by other agencies to learn additional information. We do not agree. The text of the statute covers “a record-keeping” process. Code § 2.2-3801. “Keeping” is “the act of one that keeps.” Webster’s Third New International Dictionary 1236 (2002). Since we are dealing with records, to “keep” as intended by the Data Act is to “preserve, maintain” or to “maintain a record.” Id. at 1235; see also Black’s Law Dictionary 1039 (11th ed. 2019) (a “keeper” is “[s]omeone who has the care, custody, or management of something and who [usually] is legally responsible for it.”). There is no evidence that upon searching for information in separate databases, the Police Department is “keeping” any of this information within the ALPR system. The ability to query data in a variety of databases does not offend the Data Act if none of that data is kept in the ALPR system. Having access to data is not the same as “keeping” it. Other provisions of the Data Act support this reading. For example, Code § 2.2-3800(C) addresses obligations of “[r]ecordkeeping agencies of the Commonwealth.” Code § 2.2-3800(C)(8) requires “[a]ny agency holding personal information [to] assure its reliability and take precautions to prevent its misuse.” (emphasis added). The strictures of the Data Act contemplate accountability and responsibility by an agency for the data it keeps – not data it can query from other sources. Code §§ 2.2-3800, 3803. 10 Furthermore, the Data Act defines an “information system” as “the total components and operations of a record-keeping process” – singular. Code § 2.2-3801 (emphasis added). Of course, record-keeping may involve multiple inputs from multiple sources, such as direct downloads from the State Police, and possibly from other sources, as well as manual inputs from an operator. Nevertheless, “a record-keeping process,” singular, cannot plausibly consist of a combination of multiple separately generated and maintained systems. In Neal I, we referred on multiple occasions to the Police Department’s “ALPR record-keeping process.” Neal I, 295 Va. at 348-50. But “a record-keeping” process for ALPR does not include logging off of the ALPR system and separately logging on to other databases to query their contents. Thus, a plain language reading of the words “a record-keeping process” does not support Neal’s expansive reading. Moreover, the facts are undisputed that these databases, such as the VCIN, NCIC, or DMV databases, are maintained by other agencies. The Data Act defines and regulates the actions of an “agency.” See Code § 2.2-3801 (defining “agency”). The Data Act imposes obligations on an agency with respect to the data it collects and maintains. Code § 2.2-3803 (imposing duties on “[a]ny agency maintaining an information system that includes personal information”). As the Police Department points out, interpreting “record-keeping process” and “information system” in a way that includes databases maintained by other agencies cannot be squared with the structure and requirements of the Data Act. For example, the Data Act requires an agency to (1) “[m]aintain information in the system with accuracy, completeness, timeliness, and pertinence as necessary to ensure fairness in determinations relating to a data subject,” Code § 2.2-3803(A)(4); (2) “[m]aintain a list of all persons or organizations having regular access to personal information in the information system,” Code § 2.2-3803(A)(6); (3) “[m]aintain for a 11 period of three years or until such time as the personal information is purged, whichever is shorter, a complete and accurate record, including identity and purpose, of every access to any personal information in a system,” Code § 2.2-3803(A)(7); and (4) “[e]stablish appropriate safeguards to secure the system from any reasonably foreseeable threat to its security,” Code § 2.2- 3803(A)(9). In order to fulfill these obligations, the Data Act necessarily presupposes that the agency controls the components and operations of the record-keeping process. See Code § 2.2-3806(A)(5)(a) (referencing “[t]he agency maintaining the information system”); id. § 2.2-3806(A)(5)(e) (same). The Data Act imposes restrictions and obligations on “an agency.” Code § 2.2-3803. It does not contemplate holding an agency accountable for the information systems of other agencies. To resist this construction of the Data Act, Neal points to the fact that the definition of “information system” encompasses “information collected or managed by means of computer networks and the Internet.” Code § 2.2-3801. However, the statutory text is clear that not all information that is “collected or managed by means of computer networks and the Internet” is swept into an “information system.” The information that counts, for purposes of the Data Act, is information, from whatever source, that is part of an agency’s “record-keeping process.” Information from a separate database that is queried but not stored by a particular record-keeping process is not part of a record-keeping process under the act. The same is true of the phrase “the Neal argues that the Police Department failed to argue for below, or offer evidence in support of, a finding that the Data Act would be unworkable if interagency databases like the NCIC/VCIN/DMV databases were included within the total components and operations of the ALPR because they are not controlled locally by the Police Department. Therefore, he maintains, this argument was waived. We disagree. This is a statutory construction point, not an evidentiary issue. The text of the Data Act holds an agency accountable for its own information systems, not those of others. The fact that an agency may or may not be able to cooperate with another agency is beside the point when determining whether the Data Act applies to a specific information system. 12 total components and operations” of a “record-keeping process.” Code § 2.2-3801. Under the statutory definition, “the total components and operations” that are relevant are those of “a record-keeping process.” The definition of “information system” does not sweep in all components and operations that an agency has access to, or components and operations that in some way support a particular crime-fighting or public protection task. Neal also contends that the word “manual” in the definition of “information system” includes the actions of an officer. Under this suggested interpretation, an information system includes situations when an officer obtains a license plate through ALPR, and then signs on to a separate database to glean information about the potential driver of a car, or even makes a telephone call to find out more information. This broad reading of the term “manual” is counterintuitive. The word “manual,” under the statutory text, refers to the manual inputting of data within a specific record-keeping process, not the ability of an operator to log on to a separate system to learn additional information. See Code § 2.2- 3801. Neal advances a number of other contentions. He points to the fact that the ALPR system downloads a hot list from the State Police’s VCIN database. If the hot list contained the type of information covered by the Data Act, Neal would have a point. The hot list, however, consists of full or partial license plate numbers. It contains no name, personal number, or other identifying particular of a data subject that would trigger the application of the Data Act to the ALPR system. Neal also contends that the Police Department’s SOP establishes that the ALPR system is an “information system” under the Data Act. That is so, he argues, because the SOP shows that the Police Department obtains information from other databases and directs the users of the ALPR system to use those resources to verify the correctness of the license plate information in 13 the ALPR system. The SOP lends no support to the contention that the separate databases, such as VCIN or NCIC, are part of “a,” singular, ALPR “record-keeping process.” These separate databases certainly facilitate the investigative process by confirming the accuracy of a hit generated by the ALPR system, but they are not part of the ALPR system and do not form part of its record-keeping process. Neal’s argument conflates the ultimate goal of the ALPR system – accurately locating suspects or stolen vehicles – with the ALPR system itself. Finally, Neal asserts that the Data Act is a remedial statute, and, therefore, we should construe it broadly. However, we are not at liberty to stretch the meaning of a statute in a manner that would contravene the legislature’s intent. See, e.g., Faulkner v. Town of South Boston, 141 Va. 517, 524 (1925) (observing that “[c]ourts cannot read into a statute something that is not within the manifest intention of the legislature, as gathered from the [language of the] statute itself” and that “[t]o depart from the meaning expressed by the words [in a statute] is to alter the statute[;] to legislate and not to interpret”); Low Splint Coal Co. v. Bolling, 224 Va. 400, 404 (1982) (“Liberal construction” of a statute “may not be used to amend a statute by changing the meaning of the statutory language.”). That intent is manifested by the text and structure of the statute which, as explained above, does not apply to the ALPR system as currently configured. We remanded this case to determine “whether the total components and operations of the ALPR record-keeping process provide a means through which a link between a license plate number and the vehicle’s owner may be readily made.” Neal I, 295 Va. at 348 (emphasis added). Under Code § 2.2-3801, a “record-keeping process” that is maintained by an agency as an “information system” must contain both “personal information” and “the name, personal number, or other identifying particulars of a data subject.” See also Neal I, 295 Va. at 347. We 14 concluded that “the determination of whether the ALPR database is an ‘information system’ under the Data Act turns on whether it also contains ‘the name, personal number, or other identifying particulars’ of an individual.” Id. at 347 (emphasis added). The evidence adduced at the hearing establishes that the answer to that question is “no.” The ALPR database does not contain “the name, personal number, or other identifying particulars of an individual.” Id. Although other databases maintained by other agencies can allow the Police Department to learn “the name, personal number, or other identifying particulars of a data subject,” the ALPR system does not. Therefore, the Police Department’s passive use of the ALPR system is lawful under the Data Act. II. OUR DECISION IN FAVOR OF THE POLICE DEPARTMENT FORECLOSES THE RECOVERY OF ATTORNEYS’ FEES. We also granted Neal’s separate appeal to address the propriety of the circuit court’s reduction of the attorneys’ fees sought by Neal’s counsel. The Data Act allows for the recovery of attorneys’ fees “[i]n the case of any successful proceeding by an aggrieved party.” Code § 2.2-3809. Our resolution of this case favorably to the Police Department moots the question of the propriety of the circuit court’s reduction of the requested attorneys’ fees. Because Neal’s challenge to the Police Department’s passive collection of data was ultimately unsuccessful, he is not entitled to an award of attorney’s fees.