Three shopping centers in California under the management of real estate outfit The Irvine Company are automatically pulling and parsing the license plates of cars that visit, and they’re sharing that data with select parties including local police and a contractor with ties to the United States’ Immigration & Customs Enforcement organization. The contractor in question is Vigilant Solutions, who manages the ALPR, or automatic license plate recognition, for at least those plazas and perhaps others. The three shopping plazas in question are Irvine Spectrum Center, Fashion Island, and The Marketplace.
To go into detail about how it all works, The Irvine Company contracts with Vigilant Solutions to manage ALPR for these shopping centers. Vigilant Solutions is technically not supposed to keep the data or do anything with it that The Irvine Company does not expressly order, but given the company’s own policies, which include keeping data “as long as it has commercial value”, operation outside of The Irvine Company’s orders is entirely plausible. If there are any contracts whose terms it would go against, The Irvine Company has not produced these contracts for review. Since Vigilant Solutions has contracts with ICE for surveillance, shoppers at The Irvine Company’s managed plazas that feature ALPR may well be providing ICE, and perhaps even other Vigilant Solutions customers, with details of their whereabouts. It is worth noting that a 2015 law in California that states that ALPR information must be posted online for the public seems to be the catalyst behind this information making it to the web. This means that outside of California, companies like Vigilant Solutions and The Irvine Company may well be perfectly within the purview of their legal rights to conduct such surveillance without consumers knowing about it.
Consumer advocacy organization Electronic Frontier Foundation says that this is a massive breach of privacy without any informed consent, and must be shut down immediately. ALPR data can not only provide a log of who has come and gone in a location, or at least the registered owners of visiting cars, but a marked car could trigger a notification and essentially tell entities with access to the data exactly where that car is, when they got there, and whether they’ve left. While this could potentially be useful information for local police, as The Irvine Company claims, it can also be used nefariously or for purposes besides public safety. Naturally, the risk of that data or even access to the database in real time falling into the wrong hands is also something to consider.