The debate over ALPR technology has renewed concerns about data privacy and trust across the security industry, with end users feeling betrayed as data that was expected to remain private has been exposed.
The reality, the industry says, is that a majority of technologies developed for security are secure by design and manufacturers follow industry best practices, but the sins of a few have caused collateral damage that affects many. Camera manufacturers still stress NDAA/TAA compliance nearly a decade after the initial ban because lost trust continues to linger.
Why the ALPR debate matters
Perception has been that individual data protected by technological safeguards and company processes was openly abused. In some cases that did occur, but not on a mass scale; nonetheless the perception has allowed claims of visceral betrayal to gain traction.
This pattern has repeated with biometrics, as more states each year enact privacy laws often modeled on the Illinois Biometric Information Privacy Act (BIPA) of 2008. Under those frameworks, businesses may capture biometric data with user consent but must handle and delete it correctly within specific timeframes; failure to do so can be costly. As of this writing, more than $7 billion globally has been generated by biometric privacy settlements alone.
Doug OGorden, Founder at Aid2entry and A&E Consultant Sales Advisor for Johnson Controls, said: “Just like BIPA and biometrics, the dispute we are having with ALPR today is that the technology itself isn’t necessarily the problem. It is how it’s being implemented and/or used. Any technology that is created can be used for good or evil. The question now is whether we establish the right guidelines, guardrails, and expectations around the technology before it becomes the problem.”
As ALPR is the newest technology to reach the legal scene, financial penalties have been limited so far; the relief most widely sought has been injunctive, forcing end users to remove cameras, destroy data, and implement stronger controls before data can be accessed.
Recovery and industry response
With trust broken, recovery is now the industry’s task. The current situation is a forced tech trend that will touch all security actors: companies must educate clients on technologies, partner with vendors that are secure by design, and act as trustworthy partners to end users.
Industry participants are being pressed into helping end users ensure they have the policies and processes in place to keep private data private. “This too shall pass. It might pass like a kidney stone, but it will pass.” Until the next one. That’s where we, as a security industry, need to do better.
