Vallejo police shared data in violation of state law, watchdog alleges

VALLEJO – The Vallejo Police Department  shared Automated License Plate Reader data with out-of-state law enforcement agencies in violation of state law, according to the Electronic Frontier Foundation, a nonprofit organization that litigates digital privacy issues.

Vallejo’s Surveillance Advisory Board was alerted that Vallejo police shared data with outside law enforcement agencies after an October article by the Guardian named the City of Vallejo as an example of a jurisdiction that shares data with law enforcement agencies in states like Texas that have enacted abortion bans, raising questions about how the data may be used.

In response, the surveillance board recommended policy changes at its meeting Thursday that would require agencies that access Vallejo’s ALPR data to sign an agreement stating that the information will not be used to prosecute or interfere with individuals who access abortion services in California.

But the EFF argued that sharing any data with out-of-state jurisdictions violates state law.

Dave Maass, director of investigations at EFF, said that the organization recommends that agencies create data sharing agreements restricting the use of the data for certain purposes similar to what the surveillance board proposed. “I’m glad to see that they have taken these recommendations to heart,” he said.

But, he said there is a section in the draft policy that specifically refers to requirements for agencies outside of California who request access to Vallejo’s ALPR data. “Agencies outside of California are not allowed to access this data,” Maass said. “That is a flat out violation of California law.”

“We have litigated this in the past and won and this has been the interpretation up and down the coast. That is why you see a lot of places cutting off federal and out-of-state agencies and only sharing in California,” said Maass.

The Vallejo Police department uses an Automatic License Plate Reader (ALPR) service called Flock Safety which records vehicle images at 74 locations throughout the city, including a block away from the Planned Parenthood clinic. Law enforcement agencies can search for matches based on vehicle characteristics or plate number and they can receive notifications if a suspect vehicle is picked up by one of the ALPR cameras.

Flock Safety works with over 2,000 law enforcement agencies, according to their website. The cloud-based service allows cities to share their data with other law enforcement agencies, creating the potential to track vehicles through a national network of ALPR cameras.

Since the U.S. Supreme Court decision in Dobbs v. Jackson Women’s Health Organization overturned Roe v. Wade and allowed individual states to enact abortion bans, there has been growing concern that interstate sharing of ALPR data could be used by states that have criminalized abortion to track the vehicles of people who travel to another state to access reproductive health care or to monitor areas around health clinics.

The surveillance board first took up the issue at its  Jan. 19 meeting and posed questions to Vallejo police Capt. Drew Ramsay, who is the manager of VPD’s Flock Safety ALPR System.

As part of the Jan. 19 review of VPD’s policy on sharing ALPR data, the Surveillance Advisory Board reviewed the Vallejo police Flock Safety Transparency Portal as of Jan. 11, which lists all of the agencies that the department allows to access the ALPR data collected in Vallejo. That list included law enforcement agencies from Arizona, Kansas, Texas and several federal agencies.

“We have a saying here in the Police Department that ‘all roads lead to Vallejo,” said Ramsay. “We get suspects from all over the country that somehow find our city for some reason.”

“A lot of the places that are on the list are cities that contacted VPD because they were looking for someone that they thought might have come to Vallejo,” Ramsay said. He also said that the department was in the process of cleaning up some of the agencies that had been approved simply because they joined Flock.

At the Jan. 19 Surveillance Advisory Board meeting there was no mention of California state law that prohibits sharing of ALPR data with out-of-state agencies.

But when the board was scheduled to take up the issue again last week, Councilmember Cristina Arriola, who is the council liaison to the surveillance board, received an email from Ramsay that said, “As a heads up, yesterday, I attended a legal update class and per a newly affected  law, we are unable to share ALPR data with anyone outside of California so the changes to the policy and forum have become more of a moot point. We have turned off access to anyone outside of California.”

It is not clear what newly affected law Ramsay was referring to, but Maass said the state law that prohibits out-of-state sharing of ALPR data is known as SB 34 and it went into effect in 2016, well before Vallejo began using the Flock system.

The Vallejo police Flock Safety Transparency portal was updated last week to remove many of the out of state agencies that Vallejo police had been sharing data with. Two out-of-state federal agencies still remain on the list: the U.S. Postal Inspection Service and the US Marshals Service, which Maass said still violates state law.

The surveillance board voted to recommend policy changes so agencies are not allowed to use Vallejo’s ALPR data to cite, arrest, prosecute, intimidate or harass people who are seeking reproductive health care services.

“I think this is probably going to end up being a statewide issue as we try to protect reproductive freedoms,” said  Andrea Sorce, vice-president of the Surveillance Advisory Board. “It sounds like it might be fresh enough that we don’t necessarily have hard information so I do feel that this is  a valuable addition to the policy regardless of whether or not we end up having any data sharing agreements with out-of-state agencies.”

But the new policy still allowed for sharing data outside of the state, which Maass said would be in violation of state law.

“Ultimately, there should not be any language that approves out of state sharing,” said Maass.

However, he said that requiring agencies within the state of California to agree to limitations on the use of shared data is still a valuable policy. “We do have cities in California that would like to ban abortion,” Maass said. “You may have cities collaborating with other cities and you may not know the reach of that collaboration.”

SB 34 provides the right to sue if an individual’s privacy is violated by license plate readers. So, if an agency signs an agreement stating that the information cannot be used for those purposes that document would support a plaintiff’s privacy infringement case, said Maass.  

“The best option is not to collect this data period.” said Maass “The next best option is to toss everything out after three minutes or so except for data that is already attached to a watch list.”

Flock servers retain Vallejo’s ALPR data for 30 days, according to the transparency portal.

The policy change recommendations made by the Surveillance Advisory Board will now go to the police chief who can choose to adopt or decline the changes.