A number of California malls appear to be feeding data back to a national license-plate reader network linked to Immigration and Customs Enforcement (ICE), according to a new report from the Electronic Frontier Foundation (EFF).

The report focuses on Irvine Company Retail Properties, which operates a string of open-air malls in southeastern Los Angeles. According to a disclosure on the company’s website, Irvine Company has been an active client of Vigilant Solutions since at least 2016 by feeding back data to the Vigilant network and appropriate law enforcement agencies.

Reached by The Verge, Irvine Company confirmed that license-plate data was being collected from three Orange County-area malls, but insisted that data was only shared with local agencies. “Vigilant is required by contract, and have assured us, that ALPR data collected at these locations is only shared with local police departments as part of their efforts to keep the local community safe,” the company said in a statement.

“The company is putting not only immigrants at risk, but invading the privacy of its customers.”

Still, outside groups are concerned the data could end up in the hands of ICE, which signed an agency-wide contract with Vigilant earlier this year. As EFF’s Dave Maass told The Verge, “They’re sharing with Vigilant, and then Vigilant can do what it wants.”

Vigilant Solutions was built on a private network of license plate readers from retail sources like Irvine Company, but it has found success in selling access to law enforcement. The company currently has some form of data-sharing agreement with roughly 3,000 law enforcement agencies across the country, including departments in New York, Chicago, and Dallas. Vigilant’s network processes an estimated 100 million license plates every month. The ACLU is currently suing ICE for more details on how the agency accesses the network.

Reached by The Verge, ICE declined to confirm any specific data-sharing agreement, but emphasized that any use of the Vigilant database was performed in accordance with the agency’s 2015 Privacy Impact Assessment. “Like most other law enforcement agencies, ICE uses information obtained from license plate readers as one tool in support of its investigations,” a representative said. “ICE conducts both criminal investigations and civil immigration enforcement investigations. ICE is not seeking to build a license plate reader database, and will not collect nor contribute any data to a national public or private database.”

Vigilant Solutions disputed the EFF report, calling it “inaccurate and rooted in opinion, not fact.” In a subsequent response, Vigilant emphasized that Irvine Company retains ownership of its data and shares it with “select law enforcement agencies to ensure the security of mall patrons.”

The EFF has already called on Irvine Company to discontinue sharing data with Vigilant. “By conducting this location surveillance and working with Vigilant Solutions,” the report reads, “the company is putting not only immigrants at risk, but invading the privacy of its customers by allowing a third-party to hold onto their data indefinitely.”

Update 6:50PM ET: Updated with a statement from Vigilant Solutions.

Update 9:48PM ET: Updated with a statement from Irvine Company, with various changes to reflect the company’s position.

Update 7/12 11:17AM ET: Updated with further statement from Vigilant.