For the other 99 percent, the scan data can reveal things we might expect to remain private.
"With the time, date, and location data it includes, you can learn a lot of sensitive things about a person," says EFF's Lynch. "You can see where they live, where they work, where they worship, where their kids go to school, or where their doctor's office is."
While most police departments have rules about how the scan data can be used, there's no telling how the rules are actually enforced. And these rules vary widely from department to department. One police department documented in the ACLU report says the use of the scan database is limited "only by the officer's imagination."
Hinch says in the Oakland jurisdiction, officers may access the scan data on a "need to know" basis only. Also, he says, the California Department of Justice does periodic audits of officers' use of the scan data, in which the officer must justify the necessity of specific queries.
Law enforcement in most parts of the country have resisted laws regulating the use and storage of license plate data, preferring to manage it themselves.
"A lot of the police agencies that are getting questioned about the ACLU report state that 'we have internal policies regarding how this technology is used,'" Westin says. "To me that is usually a sign that they are overreaching."
"Laws are what police are tasked with enforcing and protecting, not creating their own laws through internal policies regarding how our personal data is used," Westin says.
Only time will tell if the new ACLU report will revive efforts to get a federal law passed.
Sign up for Computerworld eNewsletters.