By itself, your license plate doesn’t say much except in what state, month, and year you registered your car. But start tracking where and when that license plate goes, and you’ve suddenly got a whole huge pile of personal data about all the comings and goings in someone’s life. We’ve reported before that license plate scanning by public and private entities is both widespread and unregulated. Now, the ACLU is suing police in one state to get them to stop.

The ACLU of Virginia filed suit this week, on the behalf of one Fairfax County resident, against the Fairfax County Police department for unlawfully storing massive amounts of license plate data collected using automatic license plate readers (ALPRs).

The resident, the ACLU explains, learned that his license plate had been scanned twice in one year, and that the data had been saved in a database even though neither he nor his car are involved in any kind of police investigation. This, the suit claims, violates Virginia law.

That law itself has been the subject of much discussion in the commonwealth this year. During their last session, Virginia’s state legislature passed a bill that would have permitted law-enforcement agencies to keep using the optical readers, but with slimitations on how the data could be used, and for how long it could be kept:

[L]aw-enforcement agencies shall be allowed to collect information from license plate readers, provided such information (i) is held for no more than seven days and (ii) is not subject to any outside inquiries or internal usage, except in the investigation of a crime or missing persons report. After seven days, the information shall be purged from the system unless it is being utilized in an ongoing investigation.

However, Gov. Terry McAuliffe this month vetoed the bill and so those limitations will now not become law.

And that’s where this lawsuit comes in. Virginia already has an existing Government Data Collection & Dissemination Practices Act (PDF) — the vetoed bill was an amendment, not the whole. And the ACLU claims that the license plate data scanning, as currently done, is violation of the existing statute.

The law says, in part, that, “Information shall not be collected unless the need for it has been clearly established in advance,” and that, “Information shall be appropriate and relevant to the purpose for which it has been collected.” Blanket-collecting random citizens’ scanned license plate data, the ACLU posits, is neither.

ACLU of Virginia legal director Rebecca Glenberg added in a statement that active use — seeking specific tags to correspond with stolen cars, Amber alerts, fleeing suspects, and so on — is just fine by the ACLU. It’s the passive use of the tech, the indiscriminate hoovering up of data, that poses the problem: “We do not object to the real-time use of ALPRs to compare license plate numbers to a current ‘hot list’ of vehicles involved in current investigations,” Glenberg said. “The danger to privacy comes when the government collects tens of thousands of license plate records so it can later find out where people were and when.”

Referring to data-sharing agreements that the Fairfax County police have with other northern Virginia jurisdictions, as well as with nearby Maryland and the District of Columbia, Glenberg added, “The intrusion is magnified in the Washington, D.C. area, where multiple law enforcement agencies may access each other’s information.”

Claire Guthrie Gastañaga, the executive director of ACLU of Virginia, specifically called out McAuliffe’s veto as the source of the lawsuit, saying that he “had the opportunity” to clarify the existing law to protect Virginians’ personal information unless it was necessary and relevant, but instead left “no choice but to go to court to ensure that law enforcement follows the Data Act.”

As the AP points out, back in 2013 the Virginia Attorney General’s office advised the state police that keeping ALPR data unrelated to an investigation was indeed against state law. The state police stopped then, but cities and counties in Virginia, like Fairfax, continue to collect and share the information.

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.