Powerful new technologies make mass surveillance easier than ever for law enforcement. One such technology, automatic license plate readers (ALPRs), capture location data that can reveal people’s religious, political, sexual, medical, and social activities. For years, law enforcement agencies across the country have collected and stored this data with very little oversight and few legal constraints.

In Virginia, by 2013, the Virginia State Police had collected and stored in a database eight million pictures of license plates when then-Attorney General Ken Cuccinelli gave his official opinion on whether state law allowed the practice. Included in the state police’s database were records of every car that had crossed a Potomac River bridge from Virginia into the District of Columbia on the day of Pres. Barack Obama's first inauguration and every car that was present at a Sarah Palin rally in a D.C. suburb. In his opinion, the attorney general ruled that collection and storage of ALPR information by law enforcement without a reason (i.e. outside an investigation or intelligence gathering related to criminal activity) violated the state’s Government Data Collection and Dissemination Practices Act (“Data Act”).

Working with legislators on both sides of the aisle, the ACLU of Virginia had legislation introduced in the 2015 legislative session that would have codified the attorney general’s opinion, making it clear that mass data collection by police was prohibited under state law and limiting the storage of ALPR data to seven days unless part of an ongoing criminal investigation. Law enforcement agencies across the Commonwealth opposed the legislation, sought to have the seven-day limit extended to 60 days, and, when that was unsuccessful, convinced then-Gov. Terry McAuliffe to veto the legislation. Left with no alternative, the ACLU of Virginia initiated a lawsuit in 2015 under the Data Act on behalf of Fairfax resident Harrison Neal challenging the Fairfax County Police Department’s (FCPD) collection of ALPR data where there was no suspicion of criminal activity.

FCPD has mounted ALPRs on the back of patrol cars and has used them to create a database of license plate photos to which other law enforcement agencies may have access. Some other Virginia law enforcement agencies have cameras mounted on poles along major highways that take pictures of every car that goes by and maintain these photos for up to two years or more. The ALPR technology logs the comings and goings of motorists, including exact times and GPS coordinates of the vehicles. The FCPD and other law enforcement agencies in Virginia have defended this mass data collection practice arguing that license plate numbers are not personally identifiable information protected under the Data Act and that there are no privacy issues because the license plate is in plain sight.

In a major win for privacy advocates, on Monday, a Fairfax County judge (ruling after a trial that followed a Virginia Supreme Court decision in favor of the ACLU of Virginia’s reading of the Data Act) granted the ACLU of Virginia’s petition for an injunction prohibiting the FCPD from collecting and storing ALPR data outside of an investigation or intelligence gathering related to a criminal investigation.

While some limited uses of ALPR technology may be permissible where there is suspected criminal activity, gathering and storing data on people who are simply going about their daily lives is invasive governmental overreach. The right to privacy is fundamental to a free society, and warrantless dragnet surveillance from ALPRs and other devices is a violation of that right.

The decision from the Fairfax County judge puts law enforcement agencies across Virginia on notice that they cannot collect and store personal information not directly related to a criminal investigation. Police departments across the country should also recognize the significance of the court’s opinion. ALPRs may be increasingly accessible to law enforcement, but every hour an ALPR is in use, it has the potential to capture thousands of people’s personal information without their knowledge or consent.

Indeed, this technology has fed enormous databases containing staggering quantities of Americans’ location data. Without strong legal protections, these databases risk enabling chilling abuses of power. That’s why in another case, the ACLU joined the Electronic Frontier Foundation in arguing that under the Fourth Amendment to the U.S. Constitution, police need a warrant before searching for people’s location data in ALPR databases.

These are not hypothetical concerns. As the ACLU of Northern California recently revealed, U.S. Immigration and Customs Enforcement has access to an ALPR database containing more than six billion data points of location information.

The FCPD pushed the boundaries of its authority. Instead of protecting and serving, it violated and abused the privacy rights of the people of Fairfax County. The department’s lack of respect for the privacy of the community it serves should be a cautionary tale for other law enforcement agencies looking to preserve both safety and freedom.