California attorney general sues El Cajon for sharing license plate data out of state

The California Attorney General’s Office sued El Cajon on Friday, looking to force its police department to stop sharing access to data collected from automated license plate readers with other states.

The suit, filed in San Diego Superior Court, asks the court to declare El Cajon’s practice of sharing data outside of California unlawful and alleges that El Cajon has shared data with law enforcement agencies in roughly two dozen states.

“Unfortunately, despite clear guidance from my office and multiple warnings, the city of El Cajon and its police department have refused to comply with this law,” California Attorney General Rob Bonta said during a news conference in his San Diego offices Friday.

The suit names the city of El Cajon, the El Cajon Police Department and Police Chief Jeremiah Larson.

The fight appears to center on the interpretation of Senate Bill 34, signed into law in 2015, which regulates the dissemination of data from automated license plate recognition systems, or ALPRs. The readers, set up throughout the city, capture license plates of vehicles in their view, as well as time, date and location.

In fall 2023, the Attorney General’s Office issued statewide guidance noting that under the ALPR law, agencies could share the data only with other state or local agencies in California. It said sharing with out-of-state or federal law enforcement agencies is barred.

Bonta said Friday that the decade-old law is clear, and the guidance was issued “to reemphasize what the law says.”

El Cajon City Manager Graham Mitchell said Friday that his city is following the law, and the guidance issued by the Attorney General’s Office is not binding.

“Our concern is this: There are bad people that come to the state of California from other states, and we believe that the law allows us to share our license plate data with those other states for the purpose of getting these bad people,” Mitchell said.

El Cajon Mayor Bill Wells said he is “very confident” in his city’s interpretation of the law, and said he thinks “the things the state seems to be concerned about are, frankly, fairly paranoid and a bit delusional.”

Privacy advocates argue that data collected by automated license plate readers have the potential to reveal where people go throughout their day, including where they shop, worship or seek medical care, and immigration advocates fear that federal agencies could use the data to trace people.

Bonta said the data “can reveal extremely sensitive aspects of an individual’s private life and of their routines.”

“When information leaves California, we no longer have a say over whether it will be misused, whether that’s for immigration enforcement, surveillance of protesters, tracking individuals traveling here for reproductive care or gender-affirming care and other purposes that infringe on constitutional rights,” Bonta said.

He said the “consequences for these violations of privacy are too severe to allow the misuse of this data to fly under our radar.”

He also said that other agencies his office contacted about sharing data outside of California quickly came into compliance. “But not El Cajon,” he said. “They have stubbornly refused.”

Bonta said his office has no evidence that federal agencies have used the data El Cajon made available to other states.

El Cajon turned its ALPR cameras on in summer 2023. Authorities there have touted the license plate readers as a tool to solve crimes and used them to quickly zero in on a potential suspect in a fatal shooting spree at a dental office. The city has about 82 license plate readers, which are located at about 20 intersections — generally four per intersection — throughout town.

Information provided online by Flock Safety, the company that operates the cameras, lists dozens of policing agencies in California and across the country, from Arizona to Florida, with access to the data.

The Flock site indicated Friday that, in the prior 30 days, El Cajon’s system has detected about 745,000 vehicles. The data was searched about 580 times over that same period, but the Flock site does not clarify who searched it.

Dave Maass,  director of investigations with Electronic Frontier Foundation, which advocates for privacy and civil liberties, issued a statement Friday noting that most police departments in California have stopped sharing license plate data across state lines.

“The El Cajon Police Department is one of the holdouts, violating state law and recklessly putting Californians at risk by sharing data with many out-of-state agencies, including those in states with abortion bans,” he said. “We commend the California Department of Justice for enforcing this law in court to protect every driver on our roads from agencies who think privacy laws are optional.”

San Diego police disclosed earlier this year that it had shared ALPR data with federal agencies in 2024 — including four times with Homeland Security Investigations and six times with U.S. Customs and Border Protection. Those instances were not related to immigration matters.

But in making that disclosure, San Diego police announced that the department had ended that practice of sharing in order to come into full compliance with the law outlined in SB 34.

The Flock Safety transparency page for San Diego police indicates that it has 500 cameras and detected 3.1 million vehicles over the last month. The city of San Diego has a surveillance law that limits who has access to its data, and the transparency page indicates that no outside agencies have access to San Diego police ALPR data.

Chula Vista, the second-biggest city in the county, has detected more than 1.1 million vehicles in the last month, according to its Flock transparency page. Dozens of agencies are listed as having access, but all appear to be agencies within California.

Other local police departments with a Flock transparency page include Coronado, Escondido and National City.