A company that operates 46 shopping centers up and down California has been providing sensitive information collected by automated license plate readers (ALPRs) to Vigilant Solutions, a surveillance technology vendor that in turn sells location data to Immigrations & Customs Enforcement. The Irvine Company—a real estate company that operates malls and mini-malls in Irvine, La Jolla, Newport Beach, Redwood City, San Jose, Santa Clara and Sunnyvale—has been conducting the ALPR surveillance since just before Christmas 2016, according to an ALPR Usage and Privacy Policy published on its website (archived version). The policy does not say which of its shopping centers use the technology, only disclosing that the company and its contractors operates ALPRs at “one or more” of its locations.

Automated license plate recognition is a form of mass surveillance in which cameras capture images of license plates, convert the plate into plaintext characters, and append a time, date, and GPS location. This data is usually fed into a database, allowing the operator to search for a particular vehicle’s travel patterns or identify visitors to a particular location. By adding certain vehicles to a “hot list,” an ALPR operator can receive near-real time alerts on a person’s whereabouts.

EFF contacted the Irvine Company with a series of questions about the surveillance program, including which malls deploy ALPRs and how much data has been collected and shared about its customers and employees. After accepting the questions via phone, Irvine Company did not provide further response or answer questions.

The Irvine Company’s policy describes a troubling relationship between the retail world and the surveillance state. The cooperation between the two companies allows the government to examine the travel patterns of consumers on private property with little transparency and no consent from those being tracked. As private businesses, Vigilant Solutions and the Irvine Company are generally shielded from transparency measures such as the California Public Records Act. The information only came to light due to a 2015 law passed in California that requires ALPR operators—both public and private alike—to post their ALPR policies online. Malls in other states where no such law exists could well be engaged in similar violations of customer privacy without any public accountability.
https://www.eff.org/deeplinks/2018/0...ice-contractor