A large real estate company that operates several malls and retail centers in California is collecting license plate data using a database that is also used by Immigration and Customs Enforcement, according to a report from the nonprofit digital privacy group Electronic Frontier Foundation.
Irvine Company, a real estate company based in Newport Beach, California, told BuzzFeed News that it gathers this data at three of its shopping centers — the Irvine Spectrum Center, Fashion Island in Newport Beach, and the Market Place in Tustin and Irvine — and shares it with local police departments, but not with ICE.
Irvine Company said in a statement Tuesday that it is a customer of Vigilant Solutions, which is the leading network for license plate recognition data, and which also signed a contract with ICE in December that allows the agency to use its database to assist with investigations. But the license plate information the Irvine Company collects is only shared with the Irvine Police Department, Tustin Police Department and Newport Beach Police Department, Scott Starkey, a spokesperson for Irvine Company, told BuzzFeed News.
Irvine Police Department and Newport Beach Police Department said in a statement to BuzzFeed News that it does not share this data with ICE. Tustin Police Department referred BuzzFeed News to Irvine Company for comment.
"Vigilant is required by contract, and have assured us, that ALPR data collected at these locations is only shared with local police departments as part of their efforts to keep the local community safe,” Irvine Company said in its statement online.
According to the company's website, Irvine Company’s property portfolio includes more than 550 office buildings, 40 retail centers, 125 apartment communities, one resort, two hotels, three golf courses, and five marinas. Its properties are primarily in Orange County, with several others in West Los Angeles, San Diego, Silicon Valley, Chicago, and New York City.
Vigilant Solutions told BuzzFeed News in a statement that it does not share the license plate data gathered at malls with ICE. However, law enforcement agencies can choose whether or not to share their license plate recognition data with other agencies or jurisdictions, which they sometimes do.
"Vigilant Solutions always has been and will continue to be compliant with all applicable laws in California and throughout the nation that apply to the use of its technologies," the company said.
"Even if ICE is not involved, the fact they’re sharing with law enforcement, the idea that you go to the mall to enjoy yourself and get Chipotle and buy a pair of penny loafers, you don’t expect your data is accessible by police," David Maass, a senior investigative researcher with Electronic Frontier Foundation, told BuzzFeed News.
California law requires a disclosure when companies or cities use license plate readers. Irvine Company discloses this on its website and said it deletes the data it collects once it is sent to Vigilant Solutions.
At that point, the information becomes a part of Vigilant Solutions' collection of more than 2 billion license plate photos as of 2016. Vigilant Solutions works with roughly 3,000 law enforcement agencies, according to the Atlantic. It processes roughly 100 million license plates each year, according to an April press release.
ICE agents would be able to search the database for license plate records that law enforcement agencies have elected to share that give a history of where that plate had been located. It could also be used to find someone's residence or identify associates if a car is frequently recorded in a certain parking lot.
The ACLU sued ICE in May for additional details on how the agency stores license plate data and how it manages privacy.
ICE told BuzzFeed News in a statement that it uses information obtained from license plate readers as one tool in support of its civil and criminal investigations. It added that it "is not seeking to build a license plate reader database, and will not collect nor contribute any data to a national public or private database."
Lindsey Barrett, a teaching fellow and staff attorney at the Institute for Public Representation at Georgetown University Law Center, told BuzzFeed News that Irvine Company's work with Vigilant Solutions illustrates one of the biggest problems of privacy — consent by disclaimer.
"It's great that California law requires anyone who uses an ALPR to post a privacy policy," said Barrett, who discovered that Irvine Company collects data at Fashion Island while browsing the website in June to shop for a pair of jean shorts. "But again, you’re going to the mall: you’re not looking at the small print and saying, 'Wait, Irvine Company is tracking my license plate and letting government agencies access that database.'"
UPDATE
This update includes responses from Vigilant Solutions and the Irvine Company, and clarifies what information is shared with law enforcement based on their comments.