‘Constant Surveillance’: Lawsuit Claims DRN’s Collection of License Plate Data Violates Calif. Privacy Law

Software company Digital Recognition Network, Inc. (DRN) is on the receiving end of a proposed class action lawsuit that claims its practice of using automated license plate recognition devices to track vehicles—and their drivers—violates a California privacy law.

Front and center in the case, which was removed from state to federal court in California last week, is DRN’s massive “privately-owned surveillance network” that allegedly allows the company to trace millions of vehicles, log their locations and predict where they’re going. Marketed toward lenders, collection agencies and insurance companies and other entities and individuals focused on locating people and their vehicles, DRN’s system is available to “anyone willing to pay for access to it,” the lawsuit alleges.

At the core of DRN’s system, the case explains, is a fleet of unmarked vehicles equipped with high-speed cameras capable of capturing images of other vehicles’ license plates and the time and location of each picture. Based on this data, DRN can then apply its “proprietary algorithm” to predict where certain vehicles (and their drivers) are traveling and build “a full, historical story on a vehicle and owner,” the complaint relays. Per the suit, DRN boasts that it has amassed “more than 20 billion historical scans of license plates or approximately over 70 scans—including time and GPS data—for each registered vehicle in the country.”

The case alleges that the data captured by DRN can not only pinpoint the location of a vehicle, but offers insight into the personal life of its driver, including where they live, where they work, who they associate with, where they shop and how they spend their free time. These so-called vehicle “stories,” which contain a trove of personal and possibly sensitive information, are monetized by DRN and sold to clients without regard to their subjects’ privacy, or even their knowledge that the information has been captured and shared, the suit says. Per the case, DRN’s network is essentially an unchecked, “clandestine operation” that monitors the whereabouts of millions of ordinary citizens who are not the subject of any criminal investigation, watchlist or government surveillance program:

[M]illions of guiltless and unsuspecting individuals are monitored and tracked while going about their daily lives—going to work, picking up groceries, and visiting friends and family—without the slightest inkling that any of this is happening.”

The lawsuit looks to “put an end to DRN’s portentous surveillance tactics and to hold the company accountable” for allegedly infringing upon Californians’ privacy rights.

This Data Tracking Seems Concerning…

That’s exactly what the lawsuit alleges.

According to the suit, DRN’s collection of vast amounts of data through its ominously named ReaperHD cameras presents “serious concerns” for individuals, especially when combined with other features of DRN’s product. More specifically, the case notes that DRN offers “Vehicle Tagging,” which allows clients to target communications to specific drivers; “Picture Proof,” which captures images from multiple angles to show how a vehicle is being used; “Radius Response,” which alerts clients when a vehicle is detected outside of a certain area; and “Active Duty Alerts,” which notifies clients when a driver’s military status changes from active duty (and their vehicle can therefore be repossessed).

The lawsuit further alleges DRN’s vehicle “stories” may capture sensitive information that offers insight into drivers’ health information, religious beliefs, sexual orientation or other details they may not want to share—such as when an individual has, for instance, visited an abortion clinic, cancer treatment center, religious center or LGBT community center.

Moreover, if DRN’s data falls into the wrong hands, it can potentially endanger individuals who are the targets of malicious actors, the case claims:

For instance, DRN’s license plate database can reveal an individual’s location and their travel patterns, which an abusive spouse or ex can obtain and use to find the location of an individual—even if they participate in an address confidentiality program. DRN’s predictive technology allows a malicious individual to predict exactly where their victim could be found at a certain point in time.”

Foreseeing the privacy concerns associated with the use of automatic license plate readers, the California legislature in 2016 enacted strict rules governing how entities may use this technology and the data it captures. More specifically, the case says California’s automatic license plate reader law mandates that operators of the technology, such as the defendant, must “maintain reasonable security procedures and practices” to protect residents’ data; implement a privacy policy; “conspicuously” disclose the privacy policy and related information on their website; maintain a record of when, by whom and why their system is accessed; and require that the information only be used “for the authorized purposes” described in the usage and privacy policy.

The lawsuit claims DRN posts a “privacy policy” on its website simply to “pay lip service” to California’s regulations “without having any intention of actually complying with them.” In truth, the company’s policies “reflect little concern for individuals’ privacy and civil liberties,” the case alleges, noting that DRN itself maintains that there is “not a privacy concern” related to its data given the information is supposedly “anonymous.”

“However, the company’s advertised uses of the data suggests that it is anything but anonymous,” the complaint scathes, claiming DRN’s attempts to recharacterize the “highly sensitive nature” of the information do not allow it to skirt California law.

At further issue in the case is that DRN has allegedly “not taken any steps” to notify specific drivers or the general public about its data collection practices and “surveillance program.” Indeed, the suit says, even if a California resident were to “somehow discover” that their license plate data had been collected by DRN, the company’s “indifferent privacy policy” is “hardly visible” on the defendant’s website and does little to explain how consumers’ data is collected and used.

As summarized in the lawsuit:

The purpose of DRN’s product is obvious: to collect license plate data together with date/time and GPS coordinates, tracking individuals as they go on about their day and, most importantly, to monetize this data. In its efforts to build an expansive (and lucrative) database of personal location information, DRN puts its own profits over the individual privacy and civil liberties of its unsuspecting subjects.”

Who Does the Case Look to Cover?

The lawsuit looks to represent anyone in California whose license plate information was collected by Digital Recognition Network, Inc. using an automatic license plate reader.

What If I Don’t Live in California?

At this time, the lawsuit is only looking to cover California residents. If you live in another state, you may want to reach out to an attorney in your area to find out more about your legal rights and options. Attorneys typically offer free initial consultations.

How Do I Know if DRN Collected My License Plate Data?

DRN itself should have a record of the data collected through its automatic license plate readers. If the lawsuit were to move forward and settle, the company would likely be forced to disclose that information so that those covered by the settlement, i.e., “class members,” could be identified and contacted.

Is There Anything I Need to Do to Join the Case?

There’s nothing you need to do at this time to join or be considered part of the lawsuit. It’s generally only if and when a lawsuit settles that those affected will need to take action, such as by filling out a form on a settlement website to claim their piece of the deal.

Keep in mind, however, that it can take months or even years for a lawsuit to be resolved – and there’s no guarantee a settlement will result – as suits can be dismissed at any time for a number of reasons.

How Do I Stay Informed?

We’ll do our best to post any notable updates to this page, so check back here for more information. You can also sign up for ClassAction.org’s free weekly newsletter if you want to sit back, relax, and have class action updates and settlement information sent straight to your inbox. Simply enter your email on this page to sign up.