Police departments cannot categorically deny access to data collected through automated license plate readers, California's Supreme Court said on Thursday – a ruling that may help privacy advocates monitor government data practices.

The ACLU Foundation of Southern California and the Electronic Frontier Foundation sought to obtain some of this data in 2012 from the Los Angeles Police Department and Sheriff's Department, but the agencies refused, on the basis that investigatory data is exempt from disclosure laws.

So the following year, the two advocacy groups sued, hoping to understand more about how this data hoard is handled.

Automated license plate readers, or ALPRs, are high-speed cameras mounted on light poles and police cars that capture license plate images of every passing vehicle.

The LAPD, according to court documents, collects data from 1.2 million vehicles per week and retains that data for five years. The LASD captures data from 1.7 to 1.8 million vehicles per week, which it retains for two years.

Authorities use this data to investigate crimes, though most of the license plates captured are associated with drivers not implicated in any wrongdoing. Regardless, license plate images can reveal where drivers go, which may point to the people they associate with and the kinds of activities they engage in. And if combined with other data sets, like mobile phone records, an even more complete surveillance record may be available.

The ACLU contends [PDF] that indiscriminate license plate data harvesting presents a risk to civil liberties and privacy. It argues that constant monitoring has the potential to chill rights of free speech and association and that databases of license plate numbers invite institutional abuse, not to mention security risks.

EFF senior staff attorney Jennifer Lynch said the ruling demonstrates that the court recognizes the privacy implications of license plate data.

At the same time, making license plate data available to researchers seeking to understand the privacy implications is itself a privacy risk. The court recognized this conundrum in its ruling.

"Although we acknowledge that revealing raw ALPR data would be helpful in determining the extent to which ALPR technology threatens privacy, the act of revealing the data would itself jeopardize the privacy of everyone associated with a scanned plate," the ruling says.

Accordingly, the California Supreme Court does not call for the release of this data; rather, it sends the plaintiffs' record request back to the trial court, which will decide what data can be made public and whether some of it will need to be redacted or anonymized to protect driver privacy. ®