Friday, February 6, 2026
Page 1
Misuse of Data Is Not Required ‘Harm’ for Liability Under License Plate Privacy Law
Opinion Says Section Contemplates That Collection of Data Without Publicly Posting Terms of Required Policy on Security Is Sufficient Injury to Sustain Liability
By a MetNews Staff Writer
Div. Five of the First District Court of Appeal held yesterday that a trial judge erred in sustaining a demurrer, without leave to amend, to a putative class action complaint asserting that a parking garage company, with locations throughout the state, automatically collected license plate information in violation of a California privacy law that requires the public posting of a statutorily-compliant policy based on the pleading failing to allege any harm.
Declaring that the trial judge’s conclusion was contrary to the plain language of the statute, which calls for liquidated damages and relies on an implicit public “right to know” about the collection and use of the data, the court announced:
“[W]e conclude that Plaintiff’s allegation that Parking Concepts collected and used his [license plate] information without implementing or making publicly available a usage and privacy policy constitutes ‘harm’ within the meaning of the [statute].”
At issue is a statutory scheme governing automated license plate recognition (“ALPR”) systems, found at Civil Code §1798.90.5 et seq., which defines the targeted programs as “searchable computerized database[s] resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates…into computer-readable data.”
Security Procedures
Under the scheme, those operating an ALPR system must, subject to certain exceptions, “[m]aintain reasonable security procedures…to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure,” including the implementation of a privacy policy that respects the liberty concerns at stake.
Any policy implemented under the law must include a description of how the system will ensure the security of the information and be made available to the public in writing and on the company’s webpage.
Sec. 1798.90.54 provides that a court may award “[a]ctual damages, but not less than liquidated damages in the amount of [ $2,500],” as well as punitive damages, attorney fees, and injunctive relief, to “an individual who has been harmed by a violation of this title, including…unauthorized access or use of ALPR information.”
The question arose after Brendan P. Bartholomew filed a putative class action complaint against Parking Concepts Inc. in February 2024, asserting claims under the ALPR law, California’s Unfair Competition Law, found at Business & Professions Code, § 17200 et seq. (“UCL”), and the Constitution. In the pleading, he alleged that he parked his car in the defendant’s San Francisco location “multiple times” in 2022 and 2023.
Allegations in Complaint
Bartholomew claimed that each time he entered, he was directed to “press a button on a kiosk” and take a printed ticket that displayed the “license plate number” of his vehicle along with the date and time of entry. He asserted that the information was shown a second time on a screen at the exit before a “barrier arm would automatically lift.”
In August 2024, San Francisco Superior Court Judge Ethan P. Schulman issued an order sustaining a demurrer to the complaint, saying that “the mere fact that the parking kiosk displays the license plate number…cannot establish harm within the meaning of the statute” and that the plaintiff has failed to show “that he can amend the complaint” to remedy the deficiency.
Acting Presiding Justice Mark B. Simons authored yesterday’s opinion, joined in by Justices Gordon B. Burns and Danny Y. Chou, reversing the order as to the cause of action under the ALPR law and remanding for further proceedings.
Operation of ALPR System
Concluding that the plaintiff had adequately alleged that the defendant operated a covered ALPR system, Simons wrote:
“Plaintiff alleges his license plate number was displayed on the printed parking ticket he received when entering the Garage and on a kiosk screen he passed when exiting….It is an entirely reasonable inference that Parking Concepts was able to display Plaintiff’s license plate number…by use of an automated system that took a photograph of his license plate and used a computer program to automatically convert the image…to computer-readable data. It is also a reasonable inference that Parking Concepts stores this…data—at least temporarily— in a searchable database.”
As to harm, the jurist acknowledged that “[t]his issue turns on the meaning of the word” in the statutory scheme. Pointing to the provision contemplating liquidated damages, he said:
“The provision of a set amount of liquidated damages demonstrates a legislative intent that cognizable harm does not require a measurable monetary injury….Thus, ‘harm’ within the meaning of the ALPR Law is not limited to injuries resulting in measurable damages.”
Any Violation
Rejecting the plaintiff’s assertion that harm results from any violation of the statutory scheme, he remarked:
“The statutory language limiting civil actions to persons ‘harmed by a violation’ against defendants who ‘caused the harm’ indicates that more than just the fact of a violation is required. In contrast, other statutes contain language expressly imposing liability for ‘violations.’ ”
Saying that “the legislative history provides support for our conclusion,” he pointed out that the original proposed language was changed from language addressing a person who creates a “violation” to one who causes “harm.”
Commenting that “[o]ur conclusion that harm requires more than just a violation of the ALPR Law does not resolve the issue before us,” he rejected the defendant’s contention that the terms require some type of affirmative mishandling of the data. He acknowledged that a Central District of California federal decision dealing with the ALPR law supported that interpretation, but opined:
“[C]onsideration of the overall statutory scheme weighs against such a construction. Significantly, the ALPR Law does not impose specific substantive requirements on private entities’ collection and use of ALPR data. Instead, the substantive requirements imposed by the ALPR Law are stated in fairly general terms.”
Right to Know
He continued:
“[W]hile the ALPR Law does not impose specific restrictions on the use of ALPR information, it grants individuals the right to know which entities are collecting their…data and how it is being used and maintained. Collecting and maintaining individuals’ ALPR information without implementing and making public the statutorily required policy harms these individuals by violating this right to know.”
Noting that the Legislature was concerned with increasing transparency, he reasoned:
“[T]he facts alleged here do not mirror the widespread and involuntary collection of ALPR information described in the legislative history. But in enacting the ALPR Law, the Legislature did not exempt ALPR operators who maintain only a single camera or collect ALPR information from only a single, easily avoidable location. Absent any indication in the plain language exempting such ALPR operators from liability, we see no basis to do so.”
He affirmed the order as to the UCL claim, saying that the plaintiff’s “claimed injuries of a ‘risk of future identity theft’ and ‘a loss of value of [his personal identifying information]’ are too speculative to support UCL standing.” He also agreed with Schulman that Bartholomew had failed to demonstrate a serious enough invasion of privacy to amount to a constitutional violation.
The case is Bartholomew v. Parking Concepts Inc., A171546.
Copyright 2026, Metropolitan News Company