Part 6 of the Bend Surveillance Oversight series.
An automated license plate reader does not just capture a plate number.
It creates a time-and-place record.
And when many scans are collected over time, those records can reveal patterns about where a vehicle has been, when it was there, and how often it appeared in certain places.
That is why ALPR data should be treated as location data.
It is not “just a plate.”
It is a record of movement.
What an ALPR scan actually records
An ALPR system typically captures:
- the license plate number,
- the date and time of the scan,
- the location of the camera,
- an image of the plate or vehicle, and sometimes
- additional metadata about the scan.
One scan by itself may not say much.
But multiple scans over time can create a much richer picture.
If a vehicle is scanned near a home, workplace, school, clinic, place of worship, political event, protest, or support meeting, the scans may reveal sensitive patterns about a person’s life.
That is why ALPR data deserves careful limits.
Patterns matter more than single scans
The privacy issue is not only the plate number.
The privacy issue is the pattern.
A series of scans can show where a vehicle travels, how often it visits certain places, what route it takes, when it leaves, when it returns, and whether those movements change over time.
That is a form of location tracking.
Even if each individual scan appears routine, the system as a whole can become highly revealing.
That is why retention periods, search rules, and sharing rules matter so much.
This post does not claim Bend currently uses fixed ALPR technology
This post does not claim that Bend currently uses fixed automated license plate reader technology.
The point is broader: if Bend adopts fixed ALPRs in the future, or if related systems create similar location records, the City should have clear rules in place before deployment.
Oversight should come first, not later.
Short retention should be the default
If ALPR data is retained for long periods, it becomes easier to reconstruct a person’s travel history.
The longer the data is kept, the more it can be searched, shared, or misused later.
A reasonable rule would be:
Delete ALPR scans quickly unless they are tied to a legitimate, documented case.
I would support a default retention period as short as 72 hours unless the scan is associated with a specific investigative need such as a stolen vehicle, warrant hit, active case, or clearly documented law enforcement purpose.
That kind of rule allows legitimate use while reducing unnecessary long-term accumulation.
Every search should be logged
If ALPR data can be searched, every search should leave a record.
That record should show:
- who conducted the search,
- when it was conducted,
- what plate or data was searched,
- the case number or incident number,
- the reason for the search, and
- whether the results were shared.
Without logs, the public has to trust that the system is being used properly.
With logs, the City can verify that the rules are being followed.
Sharing should be limited and documented
ALPR data should not flow freely to outside agencies, vendors, private companies, or federal systems without clear public rules.
A strong policy would require:
- a specific legal basis for sharing,
- a documented case-related purpose,
- written authorization,
- an auditable record of what was shared and with whom, and
- clear limits on bulk or informal access.
The issue is not whether legitimate case-specific sharing can occur.
The issue is whether local location data becomes broadly accessible by default.
Public reports build trust
If Bend ever uses ALPRs, the City should publish annual public reports showing:
- how many cameras or systems were used,
- how many scans were collected,
- how long data was retained,
- how many searches were conducted,
- how many shares occurred,
- how many outside-agency requests were received,
- how many requests were granted or denied, and
- whether any misuse or policy violations were found.
These reports do not need to expose sensitive investigative details.
They should provide enough information for residents and elected officials to understand how the system is working.
The basic principle
An ALPR scan is not just a plate number.
It is a location record.
And location records deserve strong safeguards.
Short retention. Logged searches. Clear sharing limits. Public oversight.
Those are not extreme demands.
They are basic rules for a powerful system.
Further reading
- EFF: Automated License Plate Readers
- EFF: Automated License Plate Readers case page
- Brennan Center: Automatic License Plate Readers — Legal Status and Policy Recommendations
- Bend Surveillance Oversight Source Library
Leave a Reply