Tuesday, July 21, 2026
Page 3
Court of Appeal:
Privacy Breach Is Not ‘Harm’ Under License Plate Data Law
Opinion Says Putative Class Action Against Company Offering Car-Mounted Mobile Scanners Rightly Axed Where Proposed Representative Admitted No Actual Injury, Concrete Violation of Statutory Scheme
By a MetNews Staff Writer
Div. One of the Fourth District Court of Appeal yesterday affirmed a summary judgment in favor of a company offering car-mounted license plate scanners in a putative class action accusing it of violating a California statute requiring safeguards regarding the collection of such information, saying that the proposed representative’s failure to point to an injury other than an alleged invasion of privacy was fatal to his assertion of standing under the law.
At issue is a statutory scheme governing automated license plate recognition (“ALPR”) systems, found at Civil Code §1798.90.5 et seq., which provides, in relevant part:
“[A]n individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action…against a person who knowingly caused the harm.”
Yesterday’s opinion, authored by Justice Truc T. Do, declares:
“The question presented in this appeal is whether a person, like [proposed-class representative] Guillermo Mata, who alleges a violation of the ALPR statute but identifies no resulting harm—other than his own subjective belief that his privacy has been invaded by the collection and storage of his data—has standing to sue under the ALPR statute. We conclude the answer is no.”
She added:
“Based on the plain text, standing under the ALPR statute requires actual harm. For this reason, we affirm the trial court’s grant of summary judgment in favor of Digital Recognition Network, Inc. (DRN) on the basis that Mata, as class representative, lacked standing under the ALPR statute.”
Presiding Justice Judith McConnell and Justice David M. Rubin joined in the opinion.
February Decision
Do acknowledged the February decision by Div. Five of the First District Court of Appeal in Bartholomew v. Parking Concepts Inc., which held that a plaintiff’s allegations that a parking garage’s collection of license-plate information without posting notices of the entity’s implementation of privacy policies required by the scheme were sufficient to confer standing even in the absence of evidence that the data was mishandled.
The Bartholomew court “rejected the plaintiff’s argument ‘that harm results from any violation of the ALPR Law’ ” but held that standing was supported because the lack of notice of the data-collection practice was a sufficient injury.
Do said that “we agree” with the conclusion that a simple breach of the mandated practices required by the scheme is not sufficient to confer standing. However, she wrote:
“Although we are skeptical of this ‘right to know’ harm, we need not resolve our concerns at this juncture. The Bartholomew court explicitly acknowledged the limits of its own holding. In a footnote, the court stated, ‘We express no opinion as to whether collecting and maintaining ALPR information with a usage and privacy policy that does not include every component identified in [the statute] would also cause such harm.’…Here, there is no dispute DRN implemented and made publicly available a usage and privacy policy.”
Putative-Class Complaint
Mata filed a putative class complaint in May 2021 on behalf of “[a]ll persons in the State of California whose license plate data was collected by [DRN] using an automatic license plate reader,” asserting a single violation of the ALPR statutory scheme. He alleged that the defendant “claims to have over 1,000 clients who…pay for DRN data” and added:
“Victims of DRN’s license plate scanning do not know they are part of its widespread and unchecked surveillance network. Indeed, California residents, and the public in general, are completely unaware of DRN’s existence—let alone its clandestine operation of patrolling streets with unmarked vehicles equipped with ALPR technology.”
The plaintiff did not dispute that DRN has adopted, and posted on its website, usage and privacy policies as required by the statutory scheme, but he characterized them as providing “lip service” to the concerns underlying the framework.
In connection with the defendant’s motion for summary judgment, Mata testified that DRN’s ALPR system had captured license plate images for each of his two vehicles and said that his data had not been accessed by anyone other than his attorneys. However, he asserted that the statute presumes that invasions of privacy are harmful.
In July 2024, San Diego Superior Court Judge Joel Wohlfeil (now retired) granted the defendant’s motion.
Theory of Harm
Do remarked:
“As we understand Mata’s theory, the harm sufficient to confer standing is the invasion of his privacy that results from the very collection and retention of ALPR information that is permitted by the statute, so long as the ALPR operator is out of compliance with a nontechnical provision of the statute. We find no support for this theory in the text or the legislative history of the ALPR statute, and conclude standing requires actual harm by the violation.”
Saying that the law “differentiates between the concept of harm, on the one hand, and the concept of a statutory violation, on the other,” she opined:
“In choosing to make the violation itself distinct from the harm that the violation causes, the Legislature requires both to be shown. Thus, more than a mere statutory violation is required to confer standing to bring suit. On this point, we agree with the court in Bartholomew….’ ”
The jurist reasoned:
“[W]e note the ALPR statute does not require a plaintiff to suffer measurable monetary damages to establish harm….It allows recovery of actual damages or the statutory minimum of $2,500 as liquidated damages….We agree with Mata that the Legislature’s inclusion of statutory damages evinces the Legislature’s intention to allow a plaintiff to recover for ‘difficult to quantify’ harm. But it does not follow, as Mata contends, that it signals the Legislature’s intention to authorize an individual to bring suit based on the type of amorphous harm he has articulated.”
Addressing his assertion of “nontechnical” breaches, she wrote:
“The ALPR statute does not distinguish between a ‘technical’ and nontechnical requirement, and Mata does not explain how that distinction is to be made. He does not identify any specific violation of the ALPR statute that would not infringe on his privacy interests.”
No Attempt
She highlighted that, “[a]part from his theory of harm we have rejected, Mata makes no attempt to show he has been harmed by any of DRN’s alleged violations,” and declared:
“On this record, we conclude there is no triable issue of material fact that Mata suffered harm within the meaning of the ALPR statute. Mata’s ALPR information in DRN’s system has never been the subject of a data security breach or unauthorized access or use. In his own words, ‘the harm of mine,…is the privacy has been—my privacy has been violated,’ by the collection and storage of ALPR information that is permitted under the statute.”
Continuing, she added:
“The fear is understandable. As one court put it, ‘[l]icense plates are publicly visible on cars, making it likely that they are captured numerous times per day by stoplights, camera-wielding pedestrians, and security cameras. Relatedly—and perhaps regrettably—life in the twenty-first century is defined by an ever-increasing amount of digital surveillance.’…Mata’s subjective belief of harm, however, is not a cognizable harm for standing under the ALPR statute.”
The case is Mata v. Digital Recognition Network Inc., 2026 S.O.S. 2123.
Copyright 2026, Metropolitan News Company