An Agency Linked To ICE Has Been Getting License Plate Data From California Malls

An Agency Linked To ICE Has Been Getting License Plate Data From California Malls

A large real estate company that operates malls is sharing license plate data with a network linked to Immigration and Customs Enforcement, according to a report from the nonprofit digital privacy group Electronic Frontier Foundation.

Irvine Company, a real estate company based in Newport Beach, California, told the organization that it is collecting and sharing license plate data at three of its shopping centers — the Irvine Spectrum Center, Fashion Island in Newport Beach, and the Market Place in Tustin and Irvine.

Irvine Company said in a statement Tuesday that it is a customer of Vigilant Solutions, which is the leading network for license plate recognition data, and signed a contract with ICE in December that allows the agency to use its database to assist with investigations.

"Vigilant is required by contract, and have assured us, that ALPR data collected at these locations is only shared with local police departments as part of their efforts to keep the local community safe,” it added.

According to the company's website, Irvine Company’s property portfolio includes more than 550 office buildings, 40 retail centers, 125 apartment communities, one resort, two hotels, three golf courses, and five marinas. Its properties are primarily in Orange County, with several others in West Los Angeles, San Diego, Silicon Valley, Chicago, and New York City.

The Irvine Company did not immediately respond to BuzzFeed News' request for comment on how it collects data and which police departments have access to the data. Vigilant also did not respond to an inquiry.

"Even if ICE is not involved, the fact they’re sharing with law enforcement, the idea that you go to the mall to enjoy yourself and get Chipotle and buy a pair of penny loafers, you don’t expect your data is accessible by police," David Maass, a senior investigative researcher with Electronic Frontier Foundation, told BuzzFeed News.

California law requires a disclosure when companies or cities use license plate readers. Irvine Company discloses this on its website and said it deletes the data it collects once it is sent to Vigilant Solutions.

At that point, the information becomes a part of Vigilant Solutions' collection of more than 2 billion license plate photos as of 2016, shared with roughly 3,000 law enforcement agencies, according to the Atlantic. It processes roughly 100 million license plates each year, according to an April press release.

ICE agents would be able to search the database for license plate records that give a history of where that plate had been located. It could also be used to find someone's residence or identify associates if a car is frequently recorded in a certain parking lot.

The ACLU sued ICE in May for additional details on how the agency stores license plate data and how it manages privacy.

ICE told BuzzFeed News in a statement that it uses information obtained from license plate readers as one tool in support of its civil and criminal investigations. It added that it "is not seeking to build a license plate reader database, and will not collect nor contribute any data to a national public or private database."

Lindsey Barrett, a teaching fellow and staff attorney at the Institute for Public Representation at Georgetown University Law Center, told BuzzFeed News that Irvine Company's work with Vigilant Solutions illustrates one of the biggest problems of privacy — consent by disclaimer.

"It's great that California law requires anyone who uses an ALPR to post a privacy policy," said Barrett, who discovered that Irvine Company collects data at Fashion Island while browsing the website in June to shop for a pair of jean shorts. "But again, you’re going to the mall: you’re not looking at the small print and saying, 'Wait, Irvine Company is tracking my license plate and letting government agencies access that database.'"